Writing an AI policy for a ten-person company

Most small teams I talk to are already using AI. Somebody drafts emails with it, somebody summarizes calls, somebody pastes a spreadsheet in to clean it up. Nobody decided any of that. It just happened.

That’s fine, honestly, BUT it means each person is making their own call on what’s okay to paste in and whether to check the output. A one-page policy fixes that. Here’s the outline I use with clients. It’s a starting point, not legal advice… your contracts and your industry may add to it.

1. Which tools are approved

List them by name. Keep the list short.

• The approved AI assistant(s), on a business account the company controls.
• Any AI features built into tools you already pay for, if you’ve checked their data terms.
• Any custom workflows we’ve built for you.

And say plainly: company work goes in company accounts, not personal ones. A business account means the company controls the data settings and can remove access when someone leaves.

2. What never goes in

This is the most important section. Be specific. Common lines:

• Anything a client contract says is confidential, or anything under a protective order.
• Health information.
• Full card numbers, bank account numbers, Social Security numbers.
• Passwords, API keys, or login links.
• Employee personnel matters.

Then check your client contracts. Some already say what you can and cannot do with their information, and that overrides anything in your policy.

3. What needs a person’s review

My default rule: anything AI wrote that leaves the building gets read by a person first. Emails to clients, proposals, social posts, invoices, anything with a number in it.

Internal notes and first drafts for your own use don’t need a formal review. They just need common sense.

This isn’t about AI being bad. It’s that your name is on what goes out, and a quick read catches the occasional wrong date or made-up detail. It’s also how we run our own client communication. The owner’s inbox goes into why.

4. Facts get checked

AI tools can state wrong things confidently, especially names, numbers, dates, quotes and citations. The rule: if a fact matters, check it against the source before you rely on it. If you can’t find a source, don’t use it.

5. Being upfront with clients

Decide how you’ll answer if a client asks whether you use AI. I’d suggest the honest, simple version: yes, for drafting and organizing, and a person reviews everything that goes to you. Some clients will want to know which tools and where their data goes. Have that answer ready.

6. Who owns this

Name one person. They keep the approved tool list current, answer “is this okay?” questions, and update the policy when something changes. In a ten-person company that’s usually the owner or the office manager.

7. When something goes wrong

Someone will paste something they shouldn’t have, eventually. Say what happens next, and make it safe to report:

• Tell the policy owner the same day.
• Delete the conversation if the tool allows it.
• The owner checks whether a client needs to be told, and whether the tool’s data terms affect what happens next.

If people are afraid to report a slip, you’ll never hear about it. That’s worse than the slip.

8. Review it twice a year

Tools change fast. Put a reminder on the calendar to reread the policy every six months and update the tool list.

Putting it to work

Write it, read it with the team in 15 minutes, and put it somewhere everyone can find. Then pick the first job to improve, which I laid out in the first 30 days. The policy is what makes the rest of the rollout feel safe.

If you’d like a template to start from, let me know and I can send one over. Thanks!