How to write a one-page AI use policy for your team
A long AI policy nobody reads protects nobody. Here is how to write one page your team will actually follow, section by section, with wording you can adapt today.
By Gary Kellett5 min read
For directors and office managers in firms that do not have a compliance team.
Most small firms either have no AI policy at all or have downloaded a twelve-page template that nobody has read. Neither helps. What your team needs is one page that answers three questions: what can I use, what must I never put into it, and who do I ask when I am not sure.
Here is how I help clients write that page. It takes an hour if you do it properly, and much less with the policy builder linked at the end.
Before you write: two short conversations
First, ask your team what they already use. Do it in a way that makes clear nobody is in trouble, because you want an honest answer. You will probably find two or three tools in regular use. Second, ask whoever handles your data protection, even if that is you, which kinds of data are most sensitive in your business. Those two answers shape everything else.
The seven sections of a one-page policy
Step 1: Purpose, in two sentences
Say why the policy exists: 'We want everyone to use AI to save time. This page explains how to do that without putting our customers, colleagues or contracts at risk.'
Step 2: Approved tools
List the tools staff may use for work, on business accounts. Say how to request a new one, and who decides.
Step 3: Never put this in
Be concrete. For example: customer personal details, employee records, health information, bank or card details, passwords, and anything marked confidential under a client contract.
Step 4: Always check before it goes out
Anything AI helped produce that goes to a customer, a supplier, a regulator or into a contract must be read and checked by the person sending it. They own it.
Step 5: Decisions about people
AI may help prepare information, but people make decisions about hiring, performance, pay, credit or pricing for individuals.
Step 6: Be open about it
Say when content is substantially AI-generated if a customer would reasonably expect to know, and never pass off AI output as someone's personal professional judgement without review.
Step 7: Owner and review date
Name the director who owns the policy, how to contact them, and the date it will next be reviewed.
1 page
is the target. If it runs onto a second page, cut the explanations, not the rules.
Wording that works
Write the rules as instructions, not principles. 'Do not paste customer names, addresses or order histories into any AI tool' is clear. 'Staff should exercise appropriate care with personal data' is not. Use 'you' and 'we'. Keep sentences short. If a rule needs an example to make sense, give one example, not five.
The test I use
Hand the draft to someone in the business who was not involved in writing it. Ask them to tell you, without looking, three things they may not do. If they cannot, the policy is too long or too vague.
What to leave out
- Long definitions of artificial intelligence. Your team knows what you mean.
- Legal citations. Keep them in a separate note for the policy owner if you need them.
- Lists of risks without a matching rule. Every risk on the page should map to something the reader must do or avoid.
- Tool-by-tool instructions. Put those in a short guide linked from the policy, so you can update them without reissuing the policy.
Rolling it out
Send the page with a short note from a director explaining why it matters. Go through it at a team meeting and take questions; the questions will tell you what needs rewording. Ask everyone to confirm they have read it. Then, crucially, make sure the approved tools are actually available, on business accounts, so the easy path is also the safe one.
Review it every six months. AI tools change quickly, and a policy that lists last year's products will quietly be ignored.
Keep a short record of the questions people ask after launch. If the same question comes up three times, the answer belongs in the policy or in the linked guide. That is the cheapest way to keep the page useful without letting it grow.
Where the policy sits in the bigger picture
A one-page policy is the first control, not the only one. It works best alongside an approved tools list with proper contracts behind it, a named director who owns AI risk, and a short record of where AI is used on personal data. My article on the AI governance risks a director has to own covers those in more detail.
If you would rather start from a draft than a blank page, the AI policy builder asks you a few questions about your business and the tools you use, then produces a one-page policy you can edit and share.
Questions directors ask
Does a small business need an AI policy?
If your staff use AI tools for work, and most do, a short policy protects you and them. It sets out which tools are approved, which data must never go into them, and who checks output before it leaves the business.
What should an AI use policy include?
A short purpose, the approved tools, the kinds of data that must never be entered, a rule that people check output before it goes out, a rule that people make decisions about people, a note on transparency, and a named owner with a review date.