AI governance for a small company: a one-page policy
A small company needs one page of AI rules covering five things: logins, what data goes into AI tools, which tools are approved, what customers see, and who keeps the page current. Start with logins, because the gap I find most often isn't really about AI at all. It's a team sharing one password to save on seats.
There's a template below you can copy and make your own in a morning. Not legal advice, just what I'd put in place. Hope this helps.
Founder, Handled. Greenville, SC. Updated October 2026, 6 min read.
The five things worth a rule
Everything else can be common sense.
1. Logins. Everyone gets their own account, with two-factor turned on (that's the code from your phone on top of the password). Shared logins mean you can't see who did what, and you can't lock out someone who leaves. With AI tools there's a bonus problem: everybody on a shared account can read everybody else's chats.
2. Data. Decide what can go into an AI tool and what can't. Customer details, payment info and anything a client told you in confidence are the obvious ones. Also check which plan you're on. Anthropic, for example, runs its Free, Pro and Max plans under consumer terms with a setting for whether chats can be used for model training, while its business plans run under separate commercial terms. Other vendors draw similar lines, so read the terms for your plan.
3. Approved tools. Keep a short list of tools people can use for work. Anything new gets a quick yes from whoever owns the list before company info goes into it. One tool per job, not five.
4. Customer-facing AI. If customers talk to anything automated, they can always reach a person, and you say plainly that it's automated. A person makes any decision that really affects a customer or an employee.
5. Upkeep. One person owns the page. They update it when a new tool comes in and check it once a quarter.
Copy this and make it yours
Swap in your names and tools. Delete anything that doesn't apply.
AI policy for [Company name], effective [date]
Logins. Every person has their own account on every work tool. No shared passwords. Two-factor is on wherever the tool offers it. Passwords live in a password manager, never in a text, email or chat. When someone leaves, their access is turned off that day.
Data. No customer personal details, payment info or confidential client material goes into an AI tool unless that tool is on the approved list for that kind of info. Work happens on company accounts, not personal ones.
Approved tools. [Owner] keeps the list of approved tools and what each one is for. Want to try something new? Ask [Owner] first. If nobody is using a tool after a month, we cancel it.
Customers. Anything automated that customers interact with says so, and always offers a way to reach a person. A person makes the final call on anything that affects a customer's account or an employee's job.
Upkeep. [Owner] updates this page whenever a new tool is added and reviews it every [month]. Anyone can flag something that's missing.
Signed off by: [Owner] and [Owner], [date]
Where AI policies go wrong
1. A policy so strict people hide what they use. If the rules make work harder, people use AI anyway and stop telling you. Keep the rules few and clear.
2. Writing it and never talking about it. Walk the team through it in person and explain the why. People follow rules they understand.
3. Copying a big-company policy. A 40-page document written for a giant company won't get read at yours. If you want to go deeper later, NIST's AI Risk Management Framework is the free, thorough version.
Questions people ask me
Got one that isn't here? Ask me on a free call →
Does a small company really need a written AI policy?
A short one, yes. Not because a lawyer said so, but because writing it down forces you to notice how your team is already using AI. Most of the time people are already pasting things into chat tools, and nobody decided whether that's okay.
What's the most important rule to start with?
Everybody gets their own login. Shared passwords to save on seat costs are one of the most common things I find in small businesses, and they mean you can't tell who did what, can't turn on two-factor properly, and can't cut off someone who leaves.
Is it okay for my team to use free or personal AI accounts for work?
I'd keep client and customer info out of personal accounts. Consumer plans and business plans often run under different terms for things like whether your chats can be used to train models. Read the terms for the plan you're on, or put work on a business plan where the terms are written for companies.
Do I need a lawyer to review this?
If you handle health, financial or legal information, yes, have your lawyer look at it. For everyone else, a one-page policy your team actually reads beats a long one nobody opens. This page isn't legal advice.
How often should we update it?
Every time you add a new tool, and once a quarter to check that what the policy says still matches what people actually do.
When you don't need me
Honestly, most small companies can do this one alone.
You can fill in the template. Copy it, fill in the blanks, talk it through with your team. Done.
You handle regulated information. Health, financial or legal data? You need your lawyer or compliance person, not me.
Everyone already has their own login. Then you're ahead of most businesses I talk to. Keep the list current and you're in good shape.
What changed
- October 2026: rewritten top to bottom. Added logins and shared passwords as the first rule, and a note on consumer versus business AI plans. Removed the made-up time-savings rule for keeping tools and the lawyer-review time estimate. Simplified the template.
- May 2026: first published.
Sources
Every price and outside fact on this page comes from the sources below, checked October 3, 2026. Prices change often, so check before you buy.
More from the resource library
Start with what you have. Build what's missing.
If you want help figuring out which tools your team actually needs seats for, and which ones could be replaced by something simpler, tell me how a normal day goes. I'll give you my honest read.
Book a free call15 minutes. No sales pitch.
Get the free missed-money checklist.
Seven places a service business quietly leaks revenue, with the actual text message for each one. None of them are about working harder, and none of them involve firing anybody. Steal the templates and change the words so they sound like you.
Sent. Check your inbox in a minute, and your spam folder if it's being weird.
Email's being stubborn on our end. Grab the PDF directly.
Related reading.
Your First 90 Days of AI: A Plan That Actually Works
A 90-day AI plan for a small business: learn what you already have, fix one repeated task with the right tool, then build what's missing. Plus how to measure it.
What Is a Chief AI Officer? The Honest Definition
What a Chief AI Officer is, what they do, how the role differs from a CTO, what it pays, and whether a small business needs one.
AI Roadmap for Small Companies: The Operator Playbook
An AI roadmap for a small company: learn what you already have, pick a tool if one fits, build what's missing. What each step looks like, what it costs, and the mistakes that stall it.
The AI Readiness Audit: A Framework for Small Companies
A free AI readiness self-check for a small business: five questions about your daily routine, your tools, where your info lives, logins and your team, and what to do next based on your answers.
AI Strategy for B2B Services Companies: Where to Start
AI strategy for a small B2B services company: start with intake, proposals, onboarding and status updates, keep the client work human, and avoid the usual rollout mistakes.