Most small businesses already use AI. The owner drafts emails in ChatGPT, the bookkeeper pastes invoices into a summarizer, someone on the sales team uses Copilot. What almost none of them have is a written statement of what is allowed, what needs review, and who is accountable when the output is wrong.
That gap becomes expensive in three specific ways:
- Data exposure. Employee-pasted customer or financial data in a cloud AI tool may be retained for model training, depending on the provider’s settings. A policy fixes this by naming which tools are approved and what data may never enter them.
- Unreviewed output. An AI-drafted contract clause, an invoice categorization, or a customer reply that nobody checked is an error with no owner. A policy assigns review responsibility by task type.
- Dispute ambiguity. When a customer or employee complains about an AI-generated decision, “we didn’t have a policy” is not a defensible answer.
A good policy is one page. It does not need to be a 20-page governance document — it needs to answer eight questions.
The 8 rules every AI use policy should answer
1. Which tools are approved?
Name them. ChatGPT, Copilot, QuickBooks AI, and so on. Anything not on the list is not an automatic ban — it requires approval from a named person before use.
2. What data may never be entered into an AI tool?
Client financial records, employee personal information, banking credentials, health information, and anything covered by a confidentiality agreement. This is the single most consequential line in the policy.
3. Who reviews AI output before it leaves the building?
Anything sent to a customer, regulator, or vendor gets human review. Anything internal can be used directly. Name the reviewer by role, not by good intentions.
4. Is disclosure required?
Decide whether customer-facing AI-generated content is labeled. For most small businesses the honest answer is: disclose when it materially affects the customer (quotes, contracts, support resolutions), don’t perform it for a first draft of an internal email.
5. What happens when the AI is wrong?
A named escalation path: who to tell, how quickly, and what the fallback process is. Most resistance to automation comes from people not knowing what happens when it fails.
6. Can AI output be used in contracts or legal documents?
Default answer for small businesses: no, not without professional review. AI drafting is fine for a starting point; it is not a substitute for counsel.
7. What about the vendor’s own AI use?
If you buy software with AI features — your CRM, your accounting platform — the policy should require knowing whether that vendor trains on your data. This one line has prevented more compliance surprises than any other.
8. Who owns the policy and when is it updated?
One owner, one review date (quarterly or annually). A policy nobody maintains becomes fiction within six months.
Template outline you can adapt
A ready-to-adapt one-page policy follows this structure:
- Scope: which tools, which staff, which processes
- Approved tools list, with the person who approves additions
- Prohibited data categories
- Human review requirements by output type
- Disclosure rules for customer-facing content
- Failure and escalation procedure
- Vendor AI disclosure obligations
- Review cadence and policy owner
Adapt it to your actual systems. A policy written for a generic company will not survive contact with your invoicing workflow.
The part templates get wrong
Generic AI policy templates are written for enterprises with compliance departments. For a 15-person business, the failure mode is different: the policy is too long to read, too abstract to apply, and nobody enforces it. A small business policy should be short enough that every employee can read it in five minutes, and specific enough that “is this allowed?” has an answer without asking anyone.
The second mistake is treating AI use as a separate category from normal operations. It is not. An invoice processed by AI still has to be accurate; a customer reply written by AI still has to be correct. Write the policy around outputs, not around the technology.
Want this written for your actual workflows?
A one-size-fits-all template cannot reference the systems you actually run. Thryft Advisors builds AI use policies as part of an engagement with your specific processes — grounded in the tools your team already uses and the data your business actually handles. Our AI Readiness Assessment is a scoped, paid engagement: we name which processes are worth automating, which are not, and what guardrails each one needs. The fee is confirmed in writing before any work begins, and you keep the written output regardless of what you decide next.
Book an AI Readiness Assessment