Almost every business I audit has the same finding. People are already using AI, often well, but nobody has written down how. So each person has made up their own rules, on their own accounts, and the owner finds out last. A short policy fixes most of that in an afternoon.
Why it matters even for a small team
Australia’s privacy regulator, the OAIC, says the Privacy Act applies to any use of AI involving personal information, and recommends that organisations do not put personal information, especially sensitive information, into publicly available AI chatbots. If you have staff using free accounts with client details, a policy is how you show you have dealt with it.
There is a second, less obvious reason. The policy is how the good ideas spread. When one person works out a reliable way to draft a quote or summarise a site meeting, the policy is where “this is how we do it here” gets written down.
Two pages, not a binder
Long AI policies do not get read. I write them as two pages a new staff member could absorb in five minutes. They cover:
- Which tool and which accounts. One approved AI tool, on a business plan, company logins only. Personal AI accounts stay out of work.
- What may go in. Everyday business documents, emails, notes and your own templates, inside the approved tool.
- What never goes in. Passwords and keys, identity documents, and in health or legal work the most sensitive material unless the setup has been designed for it.
- Who checks before anything goes out. AI drafts; a person reads and approves anything sent to a client, supplier or regulator. AI never moves money.
- Whose number is official. If AI produces a figure, which system is the source of truth, so two people do not quote two answers.
- Who to ask, and when it is reviewed. One named person, and a review date.
What to leave out
Leave out the history of AI, the list of risks copied from a large corporate template, and anything nobody will check. If it cannot be followed by a busy person on a Tuesday, it does not belong in a small-business policy.
Make it easy to follow
A policy works when the approved way is also the easy way. That means the approved tool is already set up for everyone, connected to the email and files people actually use, with a short session showing how. Rules without a setup just produce quiet workarounds.
Where to start
Write version one this week: the six headings above, a paragraph each. Put everyone on the approved account, show them how it works on their real work, and set a review date. That is most of what governance means for a business your size.