How to write an AI policy for a small business

Why a short policy beats a long one

Most small firms already have staff using AI. Someone in accounting is cleaning up client emails in ChatGPT. An estimator is asking a chatbot to rewrite scope language. A paralegal tried a free transcription app. A policy is not about stopping that. It is about making sure the safe version is the easy version.

Long policies copied from enterprise templates tend to go unread. A one-page policy that a new hire can read in five minutes, and that matches the tools on their laptop, does more. You can keep a longer appendix for the IT details.

The seven clauses every small business AI policy needs

Here is a structure that works for a law office, a CPA firm, an HVAC company or an agency. Adjust the wording to your field.

• Purpose: one sentence. "We use AI tools to save time on drafting and admin, with people responsible for every result."
• Approved tools: a named list, such as Microsoft 365 Copilot under our company tenant, or ChatGPT Business and Claude Team under company accounts. Anything not listed needs approval first.
• Data rules: what may never go into any AI tool, and what may go only into approved business accounts.
• Review rule: who checks AI-assisted work before it is sent, filed, priced or published.
• Disclosure: when you tell clients that AI helped, if your profession or contracts require it.
• Prohibited uses: for example, using AI to make hiring, pricing or credit decisions about a person without a documented human decision.
• Ownership and incidents: the named owner, how to ask for a new tool, and what to do if something sensitive was pasted in by mistake.

Writing the data rule

This is the clause that prevents real harm, so make it concrete. Group data into three tiers your team can remember.

Never in any AI tool: passwords, bank and card numbers, Social Security numbers, full tax returns, patient health information unless the tool is covered by a business associate agreement, and anything a client contract says must stay in a specific system.

Approved business accounts only: client names, project details, internal financials, draft contracts and employee information. These go only into tools where the vendor states that business data is not used for training by default and where the company controls the account. Consumer plans differ, so personal accounts are not allowed for client work.

Fine anywhere: public information, generic writing tasks, and your own marketing copy before it is published.

Many firms also run AI features inside their core systems, such as Clio for legal matters, Karbon or Canopy for accounting work, or ServiceTitan for field service. Treat each of those features as its own line in the approved list, because the data terms for an add-on are not always the same as for the base product.

Writing the review rule

AI tools produce confident text that is sometimes wrong. The review rule makes sure a person who knows the work signs off. Tie it to roles, not to good intentions.

Example wording: "Any AI-assisted document that goes to a client, regulator or court is reviewed by the responsible professional before it is sent. Prices, legal conclusions, tax positions, medical guidance and contract terms are always confirmed by a person against the source."

If you work in a regulated field, connect this clause to your existing obligations. Law firms can point to ABA Formal Opinion 512, which says lawyers using generative AI must consider their duties of competence, confidentiality, communication and reasonable fees. Tax and accounting firms can tie the data rule to their written information security plan under the FTC Safeguards Rule and IRS Publication 4557.

Rolling it out without making it a compliance event

A policy only works if people use the approved tools. That means you need to pay for them. Budget for business seats for the people who will use AI weekly, then announce the policy alongside the tools, not before them.

Run a 30-minute session that shows the approved tools on real tasks, walks through the three data tiers with examples from your own work, and explains the review rule. Ask everyone to list any AI tools they have tried. Treat that list as useful information, not a confession.

• Week 1: owner drafts the policy and the approved tool list.
• Week 2: business accounts are set up and personal-account use for client work stops.
• Week 3: team session and signed acknowledgment.
• Month 6: review what tools people actually asked for and update the list.

Example clauses you can adapt

Owners often ask for actual wording. Here are short clauses that fit most service firms. Replace the bracketed parts and have counsel review anything with legal weight, particularly in regulated fields.

• Approved tools: "Staff may use [Microsoft 365 Copilot / ChatGPT Business / Claude Team] through company accounts only. Other AI tools, including browser extensions and meeting note-takers, require written approval from [owner]."
• Personal accounts: "Client, employee and company financial information may not be entered into personal AI accounts, including paid personal plans."
• Review: "The person who sends, files or signs a document is responsible for its accuracy, whether or not AI helped prepare it."
• Decisions about people: "AI tools may help organize information about applicants, tenants or clients, but may not score, rank or reject them without a documented decision by an authorized person."
• Meeting recordings: "AI note-takers may only join calls when all participants have been told, and never on calls where privileged, medical or personnel matters are discussed unless [owner] approves."
• Incidents: "If sensitive information is entered into an unapproved tool, tell [owner] the same day. Prompt reporting will not be treated as a disciplinary matter."
• Vendors: "New AI tools are approved only after the owner checks the vendor's data terms, retention settings and whether business data is used for training."

Keeping it current

AI products change their plans, data terms and features often. Put a six-month review on the calendar and keep a one-page log of each approved tool: plan name, who has seats, what the vendor says about training on your data, and when you last checked. Colorado firms should also note any tool that scores or ranks people, because SB 26-189 creates duties for those uses from January 1, 2027.

Track a few simple numbers so you know whether the policy is helping: number of approved seats in use, requests for new tools, and any incidents. If requests pile up, your approved list is too narrow.

If you would like a starting draft built around your actual software, InTheory includes an AI policy in a typical first 30 days. It is still your policy, and your counsel should review anything with legal weight.