5 min read
Nine in ten small businesses now use or experiment with AI, yet only 23% have a documented AI policy. That gap comes from Pax8’s latest SMB AI Pulse survey, reported by SiliconANGLE on October 19. The same research found that nearly half of respondents had discovered unsanctioned AI use in their business in the past six months.
If you work alone, you might think a policy is something for companies with an HR department. It is not. A one-page AI policy is simply a set of rules you write down once so you stop making the same judgment calls every day, and so a client, a contractor, or a future hire knows exactly how you handle their information. The good news: you can write yours in about an hour. Here are nine quick wins to put on that page.
Why a Written Policy Helps Even a Team of One
Three reasons, briefly. First, clients are starting to ask, especially in consulting, design, bookkeeping, and anything touching health or legal work. A ready answer builds trust. Second, the moment you bring in a freelancer or virtual assistant, they will use AI too, and you want them using it your way. Third, a written rule beats a tired 10 p.m. decision about whether to paste a client contract into a chatbot.
Intuit’s 2026 AI Impact Report points the same way: across tens of thousands of small business owners, trust, not cost, has become the biggest worry holding back wider AI use. A policy is how you earn that trust from the people you work with.
9 Quick Wins for Your One-Page AI Policy
1. List the tools you approve, by name
Write down the exact AI tools you use for business, for example “ChatGPT Plus, Canva AI, Gemini in Google Workspace.” Anything not on the list needs a second thought before it touches business data. This one line is your best defense against shadow AI, which simply means AI tools used without anyone deciding they are allowed.
2. Sort your information into three buckets
Keep it simple: public (your website copy, published prices), internal (your own notes, draft marketing), and confidential (client names, contracts, health or financial details, passwords). Then add one rule per bucket. Public: any approved tool. Internal: approved tools only. Confidential: never pasted into a chatbot unless the tool is set up for it, or run privately. Our guide to running a private AI model on your own laptop covers that last option.
3. Turn off training on your data where you can
Many AI tools have a setting that lets the company use your conversations to improve its models. Write a rule to switch that off in every approved tool, and note where the setting lives. It takes two minutes per tool and removes a lot of worry.
4. Require a human read before anything goes out
Make it a written rule: no AI-written email, proposal, invoice, or post goes to a customer without you reading it in full. AI is fast and fluent, which is exactly why mistakes slip through. The same rule applies to translated web pages, contracts, and anything with a price on it.
5. Decide when you tell clients AI was involved
There is no single right answer, so pick yours and write it down. A common, sensible rule: you disclose when AI produced a substantial part of a deliverable the client is paying for, such as a report draft or a logo concept, and you do not bother for spelling checks or scheduling help. Some new state laws are starting to require disclosure in specific cases, so skim our plain-English guide to the new state AI laws too.
6. Set a rule for browser extensions and connected apps
AI tools that read your browser tabs, email, or files are powerful, and they can see a lot. Write a rule that you review the permissions screen before connecting any of them and connect only the accounts that tool truly needs. Our ChatGPT browser extension review shows which permissions to watch for.
7. Write down who owns AI-assisted work
If you sell creative or written work, add one sentence on ownership, such as “Deliverables created with AI assistance are reviewed and edited by me, and ownership transfers to the client on final payment as in our contract.” Ownership of AI output is murkier than most people think, and stating your position early avoids awkward conversations later.
8. Name one person who can approve a new tool
For a solo business that person is you, but write it down anyway. When you hire a contractor, the rule already says they ask you before adding a new AI tool to client work. Pax8 found that among small businesses that build their own AI tools, only 31% have a formal review or approval process. One line on paper puts you ahead of most.
9. Put a review date at the bottom
AI tools change monthly. Add “Review this policy every quarter” and an actual date. When you review it, check the tool list, the training settings, and whether any new client asked a question your policy does not answer.
A Simple Template to Copy
If you want a starting point, here is the skeleton of a one-page policy. Fill in the brackets and save it as a shared document or a page on your website.
- Approved AI tools: [tool names and plan]
- What never goes into AI tools: [client names, contracts, passwords, health or payment details]
- Training on our data: switched off in every approved tool, checked [date]
- Human review: every customer-facing output is read in full by [name] before it is sent
- Disclosure: clients are told when AI produced a substantial part of a paid deliverable
- Connected apps: permissions reviewed before connecting, minimum access only
- Ownership: [one sentence matching your contract]
- New tools approved by: [name]
- Next review: [date]
Your First Step Today
Do not aim for perfect. Open a blank document, set a 30-minute timer, and write quick wins 1, 2, and 4. Those three rules alone cover most of the real risk for a solo business. Add the rest over the next week, and the next time a client asks “Do you use AI on my work?”, you will have a calm, written answer instead of a nervous one.
Do you already have an AI rule you never break? Share it in the comments so other solo owners can borrow it.
