Yes. Once anyone on your staff uses AI tools, a one-page written policy is worth having. It only needs to answer four questions: which tools are approved, what information never goes into them, who checks AI output before it reaches a customer, and who owns the policy.
That page is your AI policy for small business. It does not need legal language or a committee. It needs to be short enough that people read it and specific enough that they can follow it without asking.
Why a Written Policy Is Worth the Page
The New Zealand National Cyber Security Centre (NCSC) published an artificial intelligence guide for small businesses on January 14, 2026. It says that if AI has become part of business operations or is being considered, understanding the key cyber security risks is essential. It says these risks include data leaks and privacy breaches, reliability and manipulation of AI outputs, and supply chain vulnerabilities. The words "these include" mean the list is not complete.
This is New Zealand guidance, not US guidance and not law. The NCSC partnered with the Australian Signals Directorate and the Council of Small Business Organisations Australia on it, and says it provides a practical checklist for business owners.
Each of those risks lines up with a question your policy can answer. Data leaks and privacy breaches point to what never goes into a tool. Reliability of AI output points to who checks it. The tools you approve are part of your supply chain, so the approved list matters too.
What a Short AI Policy Should Cover
An AI acceptable use policy for a small team can fit on one page with four headings.
Approved Tools
List the AI tools staff may use for work, by name, and say who approves a new one. If people already use tools you have not listed, ask them to tell you which. The approved list should start from what is happening, not from what you hope is happening.
Information That Never Goes In
This is the part that covers keeping customer data out of AI tools. Name the categories plainly:
- Customer names, contact details, and account information - Anything covered by a confidentiality agreement - Passwords, keys, and login details - Financial records and employee records
Add a line for what to do when someone is unsure: ask the policy owner before pasting anything. This is a different question from whether your data is clean enough to automate, which our article on data readiness for AI covers. The policy deals with what staff may put into a tool today.
Who Checks the Output
A person reviews anything AI drafts before it reaches a customer. AI output can be wrong. Say who does the check, and say what counts as a customer-facing item: emails, quotes, web copy, replies, reports.
Two limits belong in this section. AI does not give legal, medical, accounting, lending, or other regulated advice, and your policy should not let it be used that way. Sensitive, high-risk, or complex situations go to a person.
A TIA Blog post on AI in logistics makes the same point from another industry: AI can help flag a suspicious request, and it asks who is reviewing what the technology tells us. Our Industry Spotlight on freight brokers walks through that example.
Who Owns the Policy
Name one person. That can be the owner or the operations lead. The owner answers questions, approves new tools, and decides when the page changes. A policy with no named owner becomes a document nobody opens.
AI supports your people. It does not replace them, and the policy can say so in one sentence.
A US Reference for Going Further
If you want a deeper reference, the NIST AI Risk Management Framework is a US starting point. NIST says the framework is intended for voluntary use and to improve the ability to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems. It was released on January 26, 2023.
On July 26, 2024, NIST released NIST-AI-600-1, the Generative Artificial Intelligence Profile, which can help organizations identify unique risks posed by generative AI. NIST's page also states that AI RMF 1.0 is being revised as part of the White House AI Action Plan.
The framework is voluntary. It is not law, and it is not written as a small-business standard. A one-page policy does not depend on it, but owners who want more depth can start there.
How to Write One Page Staff Will Follow
Use plain sentences and put the policy on a single page. A workable outline looks like this:
1. Purpose, in one sentence: people may use AI tools to help with work, within these rules. 2. Approved tools and who approves new ones. 3. Information that never goes into an AI tool. 4. Review: a person checks anything customer-facing before it goes out. 5. Limits: no regulated advice, and sensitive or complex situations go to a person. 6. Owner: the name of the person to ask, and the date the page was last reviewed.
Then walk your team through it in a meeting and invite questions. This is also where the adoption side comes in. Our article on preparing your team for AI covers the conversation about change and buy-in, which a policy page does not replace.
Choose a review date when you publish the page. Revisit it whenever you add a tool or a tool changes how it handles your information, and on the date you set.
If you want help turning this outline into a policy for your business, get your free AI assessment. We start with how your team already works.
Frequently Asked Questions
Does a small business really need a written AI policy?
Once anyone on staff uses AI tools, yes. A one-page policy gives people a clear answer on tools, information, review, and ownership before they have to guess.
What should a small business AI policy include?
Approved tools, information that never goes into them, who checks AI output before it reaches a customer, and a named owner. Add the two limits: no regulated advice from AI, and sensitive or complex situations go to a person.
Can employees put customer information into AI tools?
Your policy decides. A safe default is that customer names, contact details, and account information stay out unless the owner has approved a specific tool and use.
Who should own the AI policy in a small business?
One named person, such as the owner or the operations lead. They answer questions, approve new tools, and decide when the page changes.
How often should an AI policy be updated?
Set a review date when you publish it, and update it when you add a tool or a tool changes how it handles your information.
