Simple AI Use Policy for Small Business (One Page)

A simple AI use policy for small business needs five things on one page: which AI tools are approved, what data never goes into them, a rule that a person checks the output before it goes out, a line on recording and meeting consent, and one place for people to sign. That is the whole document. It does not need a legal team to draft, and it does not need to be forty pages to hold up. Most small teams put this off because the templates they find online read like something a compliance department wrote for a bank, when the actual job is writing down what your team is already doing so everyone does it the same way.

What "simple" actually means here

Simple does not mean vague. It means short, specific, and written in language a new hire can read in five minutes and act on immediately. A policy that lists "use AI responsibly" as its main instruction is not simple, it is empty, because nobody can point to a sentence and say whether they followed it.

A one-page policy works for most small businesses because most small businesses have the same handful of AI touchpoints: a chatbot for drafting emails or documents, an AI notetaker sitting in on meetings, maybe an image or presentation tool. The policy only has to cover what your team actually uses.

Where one page stops being enough is regulated work: healthcare records, financial advice under compliance rules, government contracts, or handling data covered by a specific privacy law. If that describes part of your business, treat the one-page version as a starting draft and get it reviewed by someone qualified before you rely on it for that part of the work.

The five sections a simple AI use policy for small business needs

Write these as five short blocks, not five separate documents. Each one answers a single question.

1. Which tools are approved. Name them. "Approved AI tools" is not a policy, "Approved AI tools: [chatbot], [meeting notetaker], [presentation tool]" is. If someone wants to add a tool, say who they ask and how long that takes. Without this line, people quietly adopt whatever tool solved their problem last week, and now company information is sitting in accounts nobody vetted.

2. What never gets typed or fed into a tool. Client financial details paired with a name, health information, passwords and credentials, unreleased pricing, anything under an NDA, and anyone's personnel file. Write the categories, not a theoretical worst case. People follow a short list of concrete "don't put this in" items far better than a paragraph about "sensitive data."

3. A person checks it before it goes out. AI-drafted emails, proposals, and summaries get reviewed by a human before a client sees them. This single line prevents the two most common failures: an AI tool stating something confidently that is wrong, and a tone nobody would have actually chosen.

4. Recording and meeting consent. If anyone on the team uses an AI notetaker in meetings, the policy states that participants get told before the recording starts, not after. This is the section most generic AI policy templates skip entirely, because they are written for AI use in general and treat meeting tools as just another app. For a small business, the notetaker is often the AI tool people touch daily, and it is also the one most likely to catch a client, a candidate, or a colleague off guard if nobody mentions it. Our guide on telling people you are recording covers what to actually say in different situations, which is worth linking directly from the policy rather than rewriting it there.

5. Sign-off and what happens if the policy is ignored. One signature line, one sentence on what happens if someone puts confidential data into an unapproved tool. It does not need to be severe to work. It needs to exist, because a policy nobody signed is a suggestion.

The data-handling line people get wrong

The instinct is to write "don't put sensitive data into AI tools" and move on. The problem is that most employees do not know which of the tools they already use are training their own systems on what gets typed in, versus which ones keep customer input separate. This varies by vendor and it can change when a vendor updates its terms, so a policy that names a specific promise from a specific tool risks going stale.

The safer instruction is procedural: before approving a new AI tool for the team, someone checks that vendor's current privacy or data-handling page and notes the answer next to the tool's name on the approved list. Otter's own privacy and security page, read 2026-09-18, states that customer data is not used to train its third-party AI service providers' models, a helpful example of exactly the kind of language to look for and record, though the specific answer varies tool to tool and is worth re-checking whenever a vendor updates its policy. Our breakdown of whether your meeting data trains the AI model walks through how to find this answer for any notetaker before you approve it.

Meeting recording needs its own line, and here is why

Recording consent is not just etiquette. In a number of states, every participant in a call has to consent before it can legally be recorded, not just the person running the meeting, and this can apply to a call even when the person recording is sitting somewhere with a looser rule, if a participant is joining from a stricter one. RecordingLaw's state-by-state consent guide, read 2026-09-18, is a reasonable starting reference for which states take the stricter position, though this is not legal advice and the specific rules for your situation are worth confirming with someone qualified if a particular call matters.

Your policy does not need to reproduce this legal detail. It needs one sentence: "Tell participants before recording starts, every time, regardless of location." That sentence is enforceable and it is the behavior that actually avoids the problem, whereas trying to summarize consent law inside an internal policy usually goes out of date and gives people false confidence that they have covered it.

Which tools actually need a line

Not every piece of software your team touches needs a named entry. Focus on tools that see company data, client conversations, or unreleased work: the chat assistant people draft with, the meeting notetaker, and any AI feature bundled into an existing app that people may not realize is AI at all. A grammar checker with a light AI suggestion feature is a lower-risk entry than a chatbot that people paste full documents into.

If your team has picked up several overlapping AI tools over time, the policy is also a natural moment to ask whether you need all of them, or whether a couple of teams have quietly bought tools that do the same job. That consolidation conversation is separate from the policy itself, but writing the approved-tools list tends to surface it on its own.

Rolling it out without losing a week

A one-page policy fails if it sits in a shared drive nobody opens. Send it in an email with a two-line summary, not as an attachment with no context. Walk through it in fifteen minutes at a regular team meeting rather than a special one, which signals it is a normal update, not a crackdown. Collect signatures the same week, while people remember the conversation.

If your team is bringing on an AI notetaker specifically as part of this rollout, our guide to rolling a notetaker out to a team covers the sequencing question that trips people up most: who tests it first, how you introduce it to the rest of the team, and what to do about the person who is uncomfortable with it from day one.

Keeping it current

Set a date to re-read the policy, six months out is reasonable for most small teams, rather than leaving it to expire silently. The tools change, a vendor's data-handling terms change, and someone will eventually ask to add a new tool that was not on your radar when you wrote the first version. A short policy is easy to update precisely because it is short. That is the actual argument for keeping it to one page: not that it looks tidy, but that someone will actually maintain it.

FAQ

Does a small business really need a written AI use policy?
If more than one person is using AI tools for work, yes, even informally. Without one, people make their own calls about what data is safe to paste into a chatbot, and those calls are inconsistent by default.

Do I need a lawyer to write a simple AI use policy for small business?
Not for the one-page version covering approved tools, data handling, review, and recording consent. Get a lawyer involved if your business handles regulated data, government contracts, or a specific compliance requirement that touches how you use AI tools.

What is the biggest mistake small businesses make with an AI policy?
Writing something vague enough that nobody can tell whether they followed it, or writing something so long that nobody reads it. Both fail for the same reason: the policy does not change behavior.

Should the policy name specific AI tools?
Yes. "Approved tools" only works as a real limit when it names the tools, so anything not on the list is an easy, unambiguous no.

How often should we update the AI use policy?
Review it roughly every six months, or sooner if you add a new tool, a vendor changes its data-handling terms, or a team member raises a situation the current version does not cover.