Writing a Two Page AI Policy Your Team Will Read

Many small business owners think their company is too small to need a policy. They assume policies are for enterprises with hundreds of staff and complex governance structures. In reality, a one or two-page AI policy for a small business is not a compliance burden. It is a practical guide that keeps your team aligned and reduces the risk of costly mistakes. The key is to write a policy that is short enough to read in fifteen minutes and specific enough that your team knows what to do.

Your small business AI policy should answer four questions. First, what AI tools is the company authorised to use? Second, what types of data are not allowed in any AI tool? Third, what checks must happen before AI output is used in a business decision? Fourth, who do people ask if they are unsure? If you can answer these questions in two pages, using your own language and your own business examples, you have a compliant policy that your team will actually read and follow.

Start with authorised tools. List every AI tool your company actually uses. For a small business, this might be only two or three tools. Next to each tool, note what it is used for and whether it is free or paid. This list does so several things. It prevents staff from adopting random new tools without approval. It gives you a starting point for training. It tells you what tools you need to audit and update as the vendor’s terms change. It also helps when a new hire asks what tools are allowed. You point them to the list.

Next, define what data is off limits. You might write something like: “Customer contact information, payment details, salary data, and supplier contracts must never be pasted into any AI tool, even if it is a paid tool. For other business data, use only the paid versions of approved tools listed above. If in doubt, ask your manager.” This is clear. It is brief. It gives your team a rule they can follow without overthinking.

The third section covers quality checks. You might write: “All AI-generated content used in decisions or sent to customers or external parties must be reviewed by a human who understands the context. AI can make mistakes. Check facts against your own records. Check that the tone and message are appropriate for your business. If you are unsure, ask.” This ensures that someone is always accountable. It is not the AI. It is the person who used it.

The fourth section is about escalation. You might write: “If you use an AI tool in a way not covered by this policy, or if you have questions about whether something is safe to do, ask your manager or contact name at email address. Do not guess and do not assume what others have done is the right approach.” This creates a permission structure. Your team is not paralysed by doubt. They have a fast way to get clarity.

Your policy should also mention that all team members must complete basic AI literacy training, as required by Article 4 of the EU AI Act. This connects the policy to the legal requirement and makes it clear that literacy training is not optional. You might add a sentence like: “All staff will complete AI literacy training as part of their onboarding and refresh annually. This training covers the basics of how AI works, common limitations, and how to use AI safely at work.”

Write your policy in a style your team will understand. Use short paragraphs. Use your own examples. If your business is a marketing agency, give examples from marketing. If your business is a small accountancy, give examples from accounting. Avoid jargon unless your team already knows it. After you write the policy, give it to one person in your team outside the leadership group and ask them to read it and tell you if they understand it. If they do not, rewrite it. Then print it, post it, email it, and refer to it regularly. Review it once a year and update it if your tools or practices change.