Do I need an AI policy for my company?

Yes. If your employees can reach ChatGPT, Copilot or any AI tool from a work device, you need a written AI policy. It can be one page. It should say what tools are approved, what data can never be pasted in, and who to ask.

Not because a regulator will fine you tomorrow. Because your people are already using these tools — industry surveys consistently put employee AI use far ahead of official adoption — and without a written position, every one of them is making up their own rules about what customer data, contract terms, and financials are fine to paste into a chatbot.

What a good small-company AI policy covers

• Approved tools. Which AI products are fine to use, and on what plan. Free consumer versions and paid business versions handle your data very differently.
• Data lines. The short list of what never goes into an AI tool: customer records, credentials, unreleased financials, anything under NDA.
• Review. What AI output needs a human check before it reaches a customer, a court, or a contract.
• A name. One person to ask when the answer is not obvious. That single line prevents most quiet mistakes.

We run a half-day session that ends with your policy drafted, reviewed, and ready to publish internally: Write Your AI Ground Rules, $1,200 per company. Or draft it yourself — the outline above is genuinely enough to start.