How to Write an AI Policy for Your Team (Before Someone Pastes Client Data Into a Chatbot)

Someone on your team pasted a client contract into a free chatbot last week. You did not know. They were not being reckless. Nobody ever told them the rules, because the rules do not exist yet.

Want help turning this into a real operating system instead of a document that sits in a folder? Start with a look at how AI systems built for your business handle governance and automation together.

Why Every Business Needs an AI Policy for Small Business Right Now

You need an AI policy for small business because your team is already using these tools without guardrails. The risk is not robots. The risk is client data leaving your control and unreviewed AI output going out with your name on it.

I coach owners through this every week. The conversation always starts the same way. They think they have time.

They do not. The tools are free, the browser is open, and the deadline is today.

I ran DirectLender with 280 offices and 3,000 employees. Here is what scale taught me. Policy gaps never announce themselves in advance. They show up as incidents.

You do not find the missing rule during a planning meeting. You find it when something has already gone wrong and you are explaining it to a client who trusted you.

A one page AI policy costs you 90 minutes. Not having one costs you a relationship you spent years building.

The Shadow AI Problem Nobody Talks About

Shadow AI is when employees use AI tools on personal accounts, free tiers, and unapproved apps with zero oversight. It is happening in your company right now, and your best people are the most likely users.

Think about who does it. The person under pressure. The person who wants to hit the deadline. The person who found a shortcut and felt smart.

They are not sabotaging you. They are trying to move faster because you asked them to move faster.

Here is what shadow AI usually looks like:

• A team member pastes a client email thread into a free tool to draft a reply.
• Someone uploads a signed agreement to get a plain language summary.
• An assistant drops a spreadsheet of client contacts in to clean up formatting.
• A junior hire generates a market stat and puts it in a client deck without checking it.

Every one of those has an easy safe version. Nobody taught them the safe version.

Silence from leadership reads as permission. If you have never said anything about AI, your team assumes anything goes. That assumption is on you, not them.

Why Your AI Policy Should Fit on One Page

Long policies do not get read. Keep your AI policy to one page, written plainly, signed by every person, and posted where people work. A document nobody opens protects nobody.

I have watched owners hire a lawyer, get back 14 pages of definitions and indemnification language, email it to the team, and consider the job done. Nothing changed. The team scanned the subject line and moved on.

Compare that to a one page sheet with five headings and five short lists. People read that in three minutes. They remember it.

Three rules for the document itself:

1. Plain language only. Write it so a new hire understands it on day one.
2. Specifics over principles. "Never paste client Social Security numbers" beats "handle data responsibly."
3. One page, one signature line, one review date. If it needs a second page, you are writing for lawyers instead of your team.

You can have a lawyer review the one page version. Do not let the lawyer write the version your team reads. Those are two different jobs.

This is the same principle behind Systems Over Hustle. A simple system people actually follow beats a sophisticated one they ignore.

Section 1: Approved Tools

List the exact AI tools your team may use, by name, in three tiers. Approved. Approved with limits. Not approved. If a tool is not on the list, the answer is no until someone asks.

Do not write "reputable AI tools are permitted." That means nothing. Name the products.

The reason tiers matter is data terms. Free consumer tiers often use your inputs differently than paid business plans do. Paid business and enterprise plans typically offer written commitments about training on your data and about retention, which you can see in the OpenAI enterprise privacy terms. Read the terms for the tools you use, and pay for the plan that gives you those commitments in writing.

That single line item is the cheapest risk reduction available to you.

Tier	What it means	Allowed use
Approved	Company paid business account, data terms reviewed	General drafting, research, summaries, internal documents
Approved with limits	Useful tool, weaker or unreviewed data terms	Public information only. No client data, no internal financials
Not approved	Personal accounts, free tiers, unknown apps, browser plugins	No work use. Request review before any use

Every person gets a company account on the approved tools. This is important. If you tell people to stop using their personal account but give them nothing to replace it, they will keep using their personal account.

Need help picking the short list? My breakdown of the best AI tools for coaches and service businesses covers what earns a spot and what does not.

Section 2: What Data Never Leaves the Building

Write a never paste list. These are the categories of information that never go into any AI tool, approved or not. Make it concrete enough that nobody has to interpret it.

Here is a starting never paste list. Adjust it for your industry.

• Client names paired with financial details, health details, or legal matters
• Social Security numbers, account numbers, dates of birth, addresses
• Signed contracts, term sheets, and executed agreements
• Passwords, API keys, and login credentials
• Unreleased pricing, offer terms, and internal margin data
• Employee records, reviews, complaints, and compensation
• Anything under a signed NDA

Then teach one rule people can apply on their own. I call it the stranger test.

Before you paste, ask: would I read this out loud to a stranger in a coffee shop? If the answer is no, it does not go in the tool.

That test works because it does not require anyone to memorize a list. It travels with them into situations you never anticipated.

Now give them the workaround, because a rule with no workaround gets broken. The workaround is redaction.

Teach the habit: replace real names with Client A, replace real numbers with round placeholders, strip the header and signature block, then paste. You still get the drafting help. The sensitive parts never leave.

Most of the AI use in your business is drafting and summarizing. Almost none of it actually requires the real identifiers.

Section 3: Where AI Output Needs a Human Signature

Anything a client relies on gets a named human reviewer before it ships. Not "the team reviewed it." A person, by name, who is accountable for what went out the door.

Set review tiers by stakes, not by tool.

1. Internal only. Meeting notes, brainstorms, first drafts for your own eyes. No formal review needed.
2. Client facing, low stakes. Scheduling emails, general education, social captions. One reviewer, quick pass.
3. Client facing, high stakes. Anything with numbers, deadlines, legal terms, pricing, or advice. Named reviewer, full checklist, initials on the file.

Give the reviewer an actual checklist. Vague instructions to "check it" produce nothing.

• Facts. Every claim verified against a source you can name.
• Numbers. Every figure traced to a real document, not to the model.
• Names. Spelling of people, companies, and properties confirmed.
• Tone. Sounds like your company, not like generic software.
• Compliance. Required disclosures, disclaimers, and license language present.

The number check matters most. Language models produce confident, wrong figures, a failure mode documented in plain terms in this IBM explainer on AI hallucinations. They will invent a statistic that reads perfectly and cite nothing. Your reviewer catches that or your client does.

One more line for the policy: AI drafts, humans decide. No AI output goes to a client, a lender, a regulator, or a court with nobody's name on it.

If you want a second set of eyes on your governance and your automation plan at the same time, book an executive coaching conversation and we will build both in one sitting.

Section 4: How You Disclose AI Use to Clients

Disclose based on stakes, not on tools. You do not owe a client a footnote because software helped format a calendar invite. You do owe transparency when AI shaped advice, analysis, or anything they will act on.

Draw the line in the policy so nobody has to guess.

No disclosure needed for internal drafting, scheduling, transcription of your own meetings, and formatting. Disclosure needed when AI generated analysis, projections, recommendations, or client facing content that a reasonable person would assume a human wrote from scratch.

Here is a plain language sentence your team can use:

"We use AI tools to speed up research and drafting. A member of our team reviews and approves everything before it reaches you, and we never put your personal or financial information into those tools."

That sentence does three jobs. It is honest, it names the safeguard, and it removes the fear the client actually has.

Regulated fields need more care. If you hold a license in real estate, lending, law, insurance, health, or financial advising, your licensing body and state rules govern you, not a blog post. Check with them directly before you set your disclosure standard.

On advertising and claims, the baseline applies to everyone. Anything you say about your services has to be truthful and substantiated. The FTC business guidance is worth reading, and the NIST AI Risk Management Framework gives you a free, credible structure if you want to go deeper than one page later.

Section 5: Who Owns the Decision When a New Tool Shows Up

Name one person who approves new AI tools. Give your team a request path and a response window. One owner, one route, one deadline. That is the whole section.

New tools appear constantly. Your team will find them. The question is whether they ask you or just start using them.

They ask when asking is fast. They go around you when asking is slow.

So build this into the policy:

1. The owner. One named person. In a small company that is you. Above roughly 20 people, delegate it.
2. The request. A short form or a single email. Tool name, what it does, what data it would touch.
3. The window. A yes or no within five business days. Hold yourself to it.
4. The review. Quarterly, the owner rereads the approved list, removes what nobody uses, and adds what earned a spot.

Do not form a committee. Committees turn a five day decision into a five week one, and your team stops asking. That is exactly how shadow AI comes back.

If you are the bottleneck on every decision in your business, that is a separate problem worth solving. My guide on how to delegate as an entrepreneur covers how to hand off decision rights without losing control.

The Rollout Conversation That Gets Adoption Instead of Resentment

Lead with permission, not punishment. If the meeting feels like an accusation, your team hides their AI use better. If it feels like an upgrade, they tell you everything.

Book 30 minutes. Run this script.

1. Open with what is approved. "Here are the tools we pay for and want you using." Start with the gift, not the restriction.
2. Show the time savings. Demo one real task from their actual week. Make it obvious this helps them, not just you.
3. Name the three hard lines. Client personal data, credentials, signed contracts. Say plainly that crossing those is a serious issue. Three lines people remember beats 20 they do not.
4. Give amnesty. "If you have used AI in ways this policy does not allow, that is on me for never writing it down. Nothing happens. Starting today we do it this way." This one line is why the whole meeting works.
5. Ask what they already use. Go around the room. Write it all down. You will learn more about your real risk in ten minutes than in a month of guessing.

That last step usually surprises owners. Your team has found tools you have never heard of, and some of them are good. The list you build in that meeting becomes the first draft of your approved list.

Then everyone signs the one page. In the room, that day.

Enforcement Without Turning Into the AI Police

Enforce with four light mechanisms: signatures, onboarding, no penalty near miss reports, and a calendared quarterly review. Monitoring keystrokes destroys trust and catches almost nothing.

Signatures matter because a signature converts a suggestion into a standard. Keep them in the personnel file.

Onboarding matters because every new hire arrives with habits from their last job. The policy goes in the first day packet next to the handbook.

The near miss report is the mechanism most owners skip, and it is the most valuable one. Tell your team: if you almost pasted something you should not have, or you think you already did, tell me and nothing happens to you. You want that information while it is still cheap.

A team that reports near misses gives you a real picture of your exposure. A team that fears you gives you silence.

Put the quarterly review on the calendar now, with a date. Tools change fast. A policy written today and never touched again becomes wrong within a year.

When there is a real violation, respond in this order:

1. Contain it. Delete the data where you can, revoke the account, document what happened.
2. Assess who was affected and whether you have a notification obligation. State breach notification duties vary, so check your requirements before you decide, and use the CISA Cyber Essentials guidance to build your response steps.
3. Ask whether the policy was unclear or ignored. Those get different responses.
4. Fix the gap in writing before the week ends.

Careless with client data twice, after training, is a firing. Confused once about a gray area is a coaching conversation. Treat those differently or your team stops telling you anything.

Policy Is the Guardrail, Systems Are the Road

A policy alone becomes a ban. If you restrict tools without building approved workflows, your team loses speed and quietly goes back to the shortcuts. Guardrails only work when there is a road.

So pair the policy with build out. For every task where you said no, give a supported yes.

You said no to pasting contracts. Build a redaction template. You said no to unreviewed client emails. Build an approved prompt library with your voice and your disclaimers baked in. You said no to random tools. Buy the business plan and hand out logins.

That is the part owners skip. They write rules, feel responsible, and never build the alternative.

Start where the repetition is. My guide to AI business systems that automate operations without losing control walks the build out, and the AI content engine post shows how to do it for marketing specifically.

Ten years in Nepal taught me something I use in every business conversation now. Constraints do not slow good work down. Unclear constraints do. People move fast when they know exactly where the edges are.

That is Systems Over Hustle applied to governance. Not more effort. Clearer structure, so the effort counts.

Your Next 90 Minutes: Write the Draft Today

You can draft this today. Block 90 minutes, close your email, and work through five timed blocks. You will end with a page worth signing.

1. 20 minutes: tool inventory. List every AI tool you know is in use, plus the ones you suspect. Sort into approved, approved with limits, and not approved.
2. 20 minutes: never paste list. Write six to eight specific data categories for your industry. Add the stranger test in one sentence.
3. 20 minutes: review tiers. Define internal, low stakes, and high stakes. Name the reviewer for high stakes work. Write the five point checklist.
4. 15 minutes: owner and disclosure. Name the tool approver, set the response window, and write your one sentence client disclosure.
5. 15 minutes: calendar the rollout. Book the 30 minute team meeting this week and set the quarterly review date for the next four quarters.

Do not polish it. A signed rough draft protects you. A perfect unwritten policy protects nobody.

Print it. Sign it first, yourself, so the team sees that it applies to you too.

Then run the meeting, collect the signatures, and start building the workflows that make the rules easy to follow.

If you want the policy and the automation built together, with someone who has managed 3,000 employees and coached owners through exactly this, reach out and tell me where your team stands. Bring your tool inventory to the conversation and we will turn it into a working system.