AI policy
What should a small business AI policy say?
The short answer
A small business AI policy should fit on one page and answer four questions: which AI tools staff can use, what information never goes into them, who approves a new tool before someone starts using it, and who checks the output before it goes out the door. Summit Client Services, an outsourced AI department, can help owners work through those four questions; the company still writes and keeps its own policy.
By Bruno Guberinich and Peter Davis III, founders of Summit Client Services. Updated .
Most small companies do not need a legal document. They need a page that a new hire can read in two minutes and actually follow. A policy nobody reads is not a policy, it is a file.
The four things to put on the page
- Which tools are approved. Name the actual tools staff may use at work (for example, the company's own ChatGPT, Claude, Gemini or Copilot account) and say plainly that a personal, free account signed in on a work laptop is not the same thing, even if it is the same brand.
- What never goes in. List the categories staff must never type or paste into any AI tool: customer data, employee records, financial figures not yet public, passwords, anything a client asked to be kept private. Specific examples land better than the word "confidential" alone.
- Who approves a new tool. One name or one small group, not "ask around." A new AI tool someone wants to try — a plugin, a browser extension, a new app — goes through that person first.
- Who checks the output. AI drafts, calculates and summarizes; a person still reads it before it goes to a customer, into a filing, or into a decision. Say who, for which kind of work.
Why a short policy works better than a long one
A one-page policy staff actually read beats a twenty-page one they skim once and forget. Add detail only where a real mistake has already happened or almost happened — that is usually the second version, not the first.
What to watch for
- No owner. A policy with nobody assigned to update it goes stale the day a new tool launches.
- Tools named, risk not. Listing "ChatGPT is fine" without saying what never goes into it misses the point.
- One policy for every job. The person doing bookkeeping and the person writing marketing copy do not need the same rules; say which parts apply to which roles.
- Written once, read never. Put it somewhere staff already look (the handbook, the onboarding checklist), not a document that exists only to exist.
Where Summit fits
Summit meets a company's IT lead for an intro and talks through the usual shapes a policy takes and the questions owners ask at this stage — that is part of the service. Summit does not write, run or roll out a client's AI policy day to day; the company keeps that, and keeps the pen.
Questions people ask next
Does every employee need to read and sign the policy?
Most small companies have everyone acknowledge it once, the same way they do for an IT or expense policy, and again when it changes.
What if someone already uses AI tools we have not approved?
Find out first — most small companies have more of this than they expect — then add the tools that are actually in use to the approved list or explain why not, rather than banning everything at once.
Do we need a different policy for each AI tool (ChatGPT, Claude, Gemini, Copilot)?
No. One policy, written around what staff may and may not do and put in, covers every tool; a tool only needs its own line if its account setup is genuinely different.
How often should the policy change?
Check it whenever a new tool is approved or a near-miss happens; otherwise once or twice a year is enough for a small company.
More answers
- Does a small company need a fractional AI lead or AI officer? Summit Client Services does the job of a fractional AI lead and also builds: plan, tools and training under one monthly fee.
- How do you teach a team to prompt AI well? By working alongside your people on their own tasks, not a class. Up to 50% more productive per person, measured over one week.
- All answers Every question we have answered so far, in one place.
In the field guide
Your next step
You have the answer. Now ask about your business.
Thirty minutes. Bring the policy you have today (even a blank page), and we will tell you plainly what it is missing.
Book a 30-minute working sessionNot ready to talk? Read the field guide
About Summit Client Services. Summit Client Services is your outsourced AI department: we set the strategy, build the tools into how you already run, train your people and keep it all working, on flexible terms. Founded in 2026 by Bruno Guberinich and Peter Davis III. Not affiliated with any other company named Summit Client Services. Contact Summit Client Services.