Key takeaways
- Every company using AI needs a short, practical policy, even if it is only a few pages.
- The core elements are approved tools, data rules, human review, accountability and vendor checks.
- Frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 provide structure to borrow from.
- Review the policy regularly, because AI tools and regulations change quickly.
AI is already in use in almost every business, whether leadership has approved it or not. Staff paste emails into chat tools, use AI note-takers in meetings and generate content for customers. A short governance policy turns that from a hidden risk into a managed advantage.
Why small companies need one
- Customer and employee data may be shared with tools that store or train on it.
- AI output can contain errors that reach customers or affect decisions.
- Clients increasingly ask suppliers how they use AI, especially in regulated industries.
- AI regulation is developing in many jurisdictions.
What the policy should cover
| Section | Contents |
|---|---|
| Purpose and scope | Which AI uses the policy covers, including tools, features in existing software and custom systems |
| Approved tools | A list of approved AI tools and plans, and how to request new ones |
| Data rules | What data may and may not be used with each tool, linked to data classification |
| Human review | Where AI output must be checked before use, such as customer communication, legal, financial or clinical content |
| Transparency | When to disclose AI use to customers or users |
| Accountability | Who owns AI decisions, approves tools and handles incidents |
| Vendor checks | Questions to ask AI vendors about data use, security and compliance |
| Training | What staff must know before using AI tools |
Simple data rules that work
- Public information: any approved tool.
- Internal information: approved business plans only.
- Confidential, personal or customer data: only tools with appropriate contracts and settings, and only when necessary.
- Highly sensitive data such as health records, payment card data and credentials: never in general AI tools unless specifically approved with proper agreements.
Frameworks to borrow from
You do not need to adopt a formal standard to benefit from one. The NIST AI Risk Management Framework, published in 2023, organizes AI risk work into govern, map, measure and manage functions. ISO/IEC 42001, also published in 2023, defines requirements for an AI management system that larger organizations can certify against. Both offer useful checklists for right-sized policies.
Regulation to keep an eye on
Rules are evolving. The EU AI Act entered into force in 2024 with obligations phasing in over several years, affecting businesses that offer AI systems or use them in the EU. In the United States, several states have passed AI-related laws, and existing laws on privacy, consumer protection, discrimination and sector rules such as HIPAA already apply to AI use. Ask counsel which rules apply to your business.
Keeping it alive
- Name an owner and review the policy at least twice a year.
- Keep the approved tools list current and easy to find.
- Log significant AI uses, such as customer-facing agents and decision support.
- Collect incidents and near misses and learn from them.
We help companies set practical AI policies and build AI systems that follow them; see our AI solutions.
Frequently asked questions
How long should an AI policy be?
For most small businesses, a few pages is enough, as long as it is clear and actually followed.
Should we ban AI tools until we have a policy?
Banning often drives hidden use. A quick interim policy with approved tools and data rules is usually better.
Do we need ISO/IEC 42001 certification?
Most small businesses do not. The standard is useful as a reference; certification matters mainly when clients or regulators require it.
