Blog / AI & Automation

A One-Page AI Policy for a Small Business (Template)

By Keyona Meeks, Founder, ReRev Labs · Oct 31, 2026 · 8 min read

The short answer: A small business can start with a one-page AI policy. It names the tools staff may use, the data that must never go into them, the checks before AI work leaves the building, who owns the rule, and when it is reviewed. The template below has blanks for you to fill in. This is not legal advice. The rules for privacy, employment and client contracts differ by place and by contract, so have an attorney read your final page. This is the stance in practice: AI writes the code, plain automation runs it, and an LLM shows up only where the input is messy and a person checks the result.

By the end of this post, you'll be able to:

  • Decide the five questions a policy has to answer.
  • Fill in a one-page template.
  • Know what to ask an attorney before you adopt it.
  • Set a date to review it.

We sell AI and automation training for teams, so weigh this post with that in mind.

This is not legal advice. I am not an attorney. This post is a starting point for a conversation with one.

Why does a small business need an AI policy?

Because people are already using AI tools, with or without a rule. A short rule tells them what is allowed, so they do not guess. The biggest risk for a small team is usually the same one: someone pastes private information into a tool without thinking. Our post on the new cybersecurity threat from AI covers how AI is also changing the attacks aimed at your business, which is a separate reason to write things down.

Is there an official framework to look at?

Yes, for larger organizations. The U.S. National Institute of Standards and Technology (NIST) published its AI Risk Management Framework. NIST's January 26, 2023 news release calls it "a guidance document for voluntary use by organizations designing, developing, deploying or using AI systems" and says it is meant "to help manage the many risks of AI technologies." My tool returned excerpts of that page, not the full text. I could not read NIST's framework page itself, because my tool declined it, so I did not read the framework. A one-page policy is far smaller than that framework. Treat NIST's page as background, and read it yourself if you want the full approach.

What five questions must the policy answer?

  1. Which tools may staff use for work? Name them. Everything else needs approval.
  2. What must never go into an AI tool? You decide. Passwords and keys are an obvious start. Customer details, employee records and client contract terms need a decision from you.
  3. What is checked before AI work leaves the building? A person reads anything sent to a client or published.
  4. What do you tell clients? Some clients and contracts may ask about AI use. Decide your answer, and have an attorney check it against your contracts.
  5. Who owns the rule, and when is it reviewed? One named person, and a date.

What does the template look like?

Copy this into a document. Replace every part in [square brackets]. Delete anything that does not fit.

AI USE POLICY - [Company name]
Owner: [Name and role]     Last reviewed: [Date]     Next review: [Date]

1. WHY WE HAVE THIS
We use AI tools to help with work. This page says how we use them safely.

2. WHO IT COVERS
[Employees / contractors / everyone who does work for us.]

3. TOOLS WE MAY USE
[List the tools and the account type for each.]
Any other tool needs approval from [Name] first.

4. NEVER PUT INTO AN AI TOOL
- Passwords, keys and login details.
- [Customer personal details.]
- [Employee records.]
- [Client contract terms or anything marked confidential.]
- [Add or remove items. The owner decides.]

5. CHECK BEFORE IT LEAVES THE BUILDING
A person reads and approves anything AI helped write before it goes to a
client, is published or is used to decide something about a person.
We check names, dates, amounts and claims.

6. WHAT WE TELL CLIENTS
[Your answer, checked against your client contracts.]

7. IF SOMETHING GOES WRONG
Tell [Name] the same day. Examples: private data pasted into a tool, a wrong
fact sent to a client, a tool that behaves oddly.

8. QUESTIONS
Ask [Name].

How do you make the policy work in practice?

  • Keep it to one page. People do not read three.
  • Walk the team through it. Read it aloud once and answer questions.
  • Give it an owner. A rule with no owner goes stale.
  • Collect the misses. When something goes wrong, update the page.
  • Review it on the date you wrote. Tools and rules change.

What should you ask an attorney?

Ask the attorney to read the finished page. Questions worth asking: Do any of our client contracts limit AI use or the sharing of their information? Do privacy or employment rules in our place apply to what we put into these tools? Is our answer to clients in section 6 safe to give? Should staff sign the policy? I cannot answer these for you. They depend on your contracts and where you operate. If you have insurance, ask your insurer whether AI use changes anything.

Where does an LLM fit in this?

An LLM can help you write a first draft of the policy from your answers to the five questions. It can also read a long client contract and point to the lines that mention technology or confidentiality, so you know where to look. A person reads the contract itself, and an attorney reads the final policy, because a model can miss a clause or invent one and sound sure. The rules in the policy are plain rules. They do not need a model to apply them.

Where this has limits

  • This is not legal advice. Have an attorney read your final page.
  • The template is a starting point. It does not cover every industry. Regulated fields may need more.
  • I did not read NIST's framework. I read excerpts of a news release only.
  • A policy does not stop mistakes by itself. People need to know it and follow it.
  • I give no figures on how common AI misuse is. I have none.
  • No ReRev prices and no promises about results.

If you want your team trained on the rules you write, see our AI and automation training for teams or tell us what your team does with AI. Do not send passwords, keys, contracts or customer data.

Frequently asked questions

Does a small business need an AI policy?

A short written rule helps, because staff are likely to use AI tools anyway. Ask an attorney whether your contracts or local rules require more.

What should an AI policy include?

Allowed tools, data that must never go in, checks before work leaves the building, what you tell clients, and an owner with a review date.

No. It is a starting point. Have an attorney read your final page.

Can employees use ChatGPT or Claude for work?

That is your decision. Name the tools you allow in section 3 of the template, and say which account type to use.

What is the NIST AI Risk Management Framework?

NIST's news release calls it "a guidance document for voluntary use by organizations designing, developing, deploying or using AI systems." It is aimed at larger efforts than a one-page policy.

How often should we review the policy?

Set a date when you write it. Review sooner if a tool, a contract or a rule changes.

Read next: How to train a small team on AI is the training that makes the policy stick.