AI policy for a small business: the basics

A small business AI policy can fit on one page: which AI tools staff may use, what information must never go into them, who checks AI-assisted work, and who to ask when unsure. Writing it down takes an afternoon and saves you from finding out about a problem after a client does.

This guide gives you a simple structure you can adapt. It is general information, not legal advice. If you handle sensitive personal information, confirm your obligations under POPIA with an attorney.

Key facts about training your team with us

Live cohorts on Zoom that start every Monday, with seats for any number of team members
Invoiced to your company
Safe use of company data (POPIA) built in
An attendance register and certificates for your skills records
No coding needed

Why does a small business need an AI policy?

Your staff are probably using AI tools already, whether or not you have said anything. Without a policy, each person decides alone what is safe to paste into a chatbot, which tools to trust, and whether to mention that a client document was drafted with AI.

A short policy turns those private guesses into a shared rule. It protects client and employee information, makes quality more consistent, and gives people permission to use AI properly instead of quietly.

What should a one-page AI policy include?

Use these seven headings. Each needs only a few lines.

Purpose. One sentence: we use AI tools to save time on routine work, and we use them safely.
Approved tools. Name them, for example ChatGPT, Claude or Gemini, and say which accounts to use: personal free accounts, or business accounts the company pays for.
Information that stays out. List it plainly (see the next section).
Checking. A person checks every AI-assisted piece of work before it goes to a client, a supplier or into a record.
Honesty with clients. When and how you tell clients that AI helped, if your industry or contracts expect it.
Who to ask. One named role for questions and for reporting a mistake.
Review date. When you will look at the policy again, at least once a year.

Training a team? Your team members can join our live cohorts, which start every Monday, invoiced to your company, with safe use of company data (POPIA) built in and an attendance register and certificates for your skills records. Send a team enquiry.

What information should the policy keep out of AI tools?

For a small business, a clear list beats a general principle. Unless a tool has been approved for that data, keep out:

ID numbers, bank details and tax numbers.
Client names together with their contact details, accounts or files.
Employee information such as salaries, leave, health and disciplinary records.
Anything covered by a confidentiality agreement or professional privilege.
Passwords, access codes and system details.

Then give the practical alternative: replace names with roles, remove numbers, and add the real details back in your own document. Our guide to POPIA and AI at work explains why this matters and how to train for it.

Should we use free or business versions of AI tools?

Free versions are fine for learning and for work that contains no personal or confidential information. If staff will regularly work with client material, business versions are usually worth considering, because they generally come with stronger terms on how your data is used. Check the current terms and settings on each provider's own website, and write your choice into the policy.

Whatever you choose, ask staff to use work accounts for work, so that the business keeps control when someone leaves.

How do we roll the policy out to staff?

Share it in a short team meeting, not only by email, and explain the reasons behind each rule.
Show one task done well with AI, with personal details stripped out, so people see it is allowed and useful.
Ask each person to confirm they have read it, and keep that confirmation with their records.
Add it to onboarding for new staff.
Collect questions for the first month and update the policy where it was unclear.

A policy without training tends to be ignored. People follow rules they understand and have practised.

What mistakes do small businesses make with AI policies?

Banning AI outright. Staff use it anyway, on personal phones, with no rules at all.
Copying a large company's policy. Twenty pages that nobody reads protect nobody.
Leaving out the checking rule. AI tools can state invented facts confidently. A person must check.
Never reviewing it. Tools and their terms change every few months.

How does training fit with the policy?

The policy says what is allowed. Training shows people how to do it well: how to write a prompt with context, how to check the answer, how to remove personal details quickly. The two together change behaviour. Our guide to AI for small business owners shows where AI saves the most time in a small team.

Is this legal advice?

No. This page is general information to help you write a first AI use policy. Your industry, contracts and the personal information you hold may need more. Confirm your obligations with an attorney.

Frequently asked questions

Does a small business need an AI policy?

Yes, if staff use AI tools at work. A one-page policy on approved tools, data to keep out, checking and who to ask protects client information and keeps quality consistent.

What should an AI use policy include?

Purpose, approved tools, information that stays out, a checking rule, honesty with clients, who to ask, and a review date.

Should we ban AI tools instead?

Usually not. Staff tend to use them anyway, without any rules. Clear rules and training work better than a ban.