How Do You Write an AI Policy? A One-Page Approach
Last Updated: September 2026
An AI policy for business is a short written rule that tells your team which AI tools they may use, what work data they may put into them, and who to ask when a case does not fit. It is a working page, not a legal shield. The ones that get used fit on a single sheet, and anyone can find their answer in under a minute.
AI Smart Ventures has guided growing businesses through AI adoption since long before governance reached the boardroom. Client work keeps surfacing one pattern: owners stall because they picture a long formal document, so they write nothing while their team carries on pasting.
Every week without a written rule, someone makes a private call about what is safe to share. Those calls are hidden from you and cannot be undone. The damage is rarely one dramatic leak. It is a slow drift where nobody can say what left the firm, or when.
Key Takeaways
- Write for one page, not for an audit: a rule that fits on a single screen gets read, while a long file nobody opens changes nobody’s habits.
- Answer three questions and stop: what your team may paste, into what, and who to ask when a case falls outside the rule.
- Draft from what people already do: in a July 2026 survey of 500 US workers, 23% had pasted internal emails, memos, or files into a private AI account.
- Name the account, not only the tool: the same AI tool acts one way on a work login and another way on a private one, and your rules reach only the first.
- Give the question an owner: put one name and one channel on the page, because a rule that ends with “check with the boss” ends nowhere.
Those five points describe a page that competes with the work itself. Your team will read it in the ten seconds before they hit paste, or not at all. That is a hard design limit, and it rules out most of what a template hands you.
How Do You Write an AI Policy in One Afternoon?
Write it in four passes: watch, decide, draft, send round. Spend an hour asking each team which AI tools they open and what goes in. Decide which you will approve, and which data must stay out. Draft the rule in plain words, then invite pushback before you publish. Most owners finish a first version in an afternoon, because the hard part is choosing, not writing.
The order matters more than the wording. Owners who draft first describe a workplace that does not exist, then spend weeks defending clauses nobody needed. Watching first gives you the real list: the three tools people already open, and the two kinds of files they already paste. Every line you write after that points at habits you have actually seen, which is also what keeps the page short and true.
- Watch before you write: ask each team which AI tools they open in a normal week, and what they put into them.
- Decide the hard calls first: pick the approved accounts and name the data that must never leave systems you control.
- Draft in your team’s words: write “client contracts” and “payroll files”, not “confidential materials of a sensitive nature”.
- Invite pushback: the people doing the work will tell you which rule blocks a real task with no safe option.
Why Should Your AI Policy Fit on One Page?
A policy only works in the moment before someone pastes. One page can be read then. Twenty pages cannot. INTOO, in a Harris Poll study of 1,158 US workers in early 2026, found 20% of staff unclear on what is allowed when using AI at work. Its advice was plain guidance and real examples rather than long policy files.
Length also hides your decisions. A short page forces you to say which accounts are approved and which data is out, because there is no room to hedge. Long drafts do the reverse. They cover every case and settle none, so the reader comes away with a vague sense of caution and no clear answer. That is where most staff already are, and a longer document leaves them exactly there.
There is a second cost. Tool-first AI agencies hand over a long template, but a template is not a decision. Only you can say which accounts you trust.
What Should the Paste Rule Actually Say?
Name the data, not the abstraction. Your paste rule lists the four or five kinds of work files that must never go into an AI tool you do not control, in your team’s words. A July 2026 Kolmogorov Law survey of 500 US workers found 23% had pasted internal files into a private AI account, 11.8% customer records, and 11.4% contracts..
Those kinds tell you what to write. The most common leak is not a database export. It is a file someone was working on, pasted in to be tidied up. A line saying “do not share confidential data” misses it, because the person pasting a half-built proposal does not think of it as confidential. A line naming client files, contracts, and payroll data does, because it matches the words already in their head.
What follows a breach varies by market, so write that part locally. The Kolmogorov Law write-up is built around California trade secret law, and your duties may differ. Name the kinds of data and take advice on the rest.
Which Accounts Should Your Policy Approve?
Approve accounts, not brand names. The same tool acts differently depending on the login signed in. A managed account keeps your data out of model training and leaves a record; a private login usually does neither. The Netskope Cloud and Threat Report 2026 found 47% of AI users still working through private apps in January 2026, down from 78% a year earlier.
Terms differ by vendor and by plan, so check the current wording rather than a summary you read last year. Cyberhaven’s 2026 AI Adoption and Risk Report put 32.3% of ChatGPT use and 24.9% of Gemini use on private accounts. Your page can settle this in one sentence: name the approved sign-in, say plainly that private logins stay for private work, and give the list a named owner who keeps it current.
| The question | What your page has to say |
|---|---|
| What may I paste? | The banned kinds of data, in your team’s own words |
| Into what? | The approved accounts, by name, and who keeps the list |
| Who do I ask? | One person, one channel, and how fast they answer |
Choosing which accounts to trust is where owners want a second view. AI Smart Ventures offers AI Advisory for growing businesses weighing tools against their workflows.
Who Should Your Team Ask When They Are Unsure?
One named person, reachable the same day. A policy ending with “check with the boss” ends nowhere, because nobody wants to interrupt an owner over a spreadsheet. Put a name and a channel on the page, and make asking easy. In the same Kolmogorov Law survey, only 19% said they would ask their employer about work chats left in a private account.
Asking is harder than it sounds. The INTOO study found 42% of workers would be embarrassed to ask a colleague for help with new tools, and 25% would not admit using AI on a task. So the named owner has to answer without turning the question into a confession. AI literacy grows fastest where questions are welcome, answers come the same week, and nobody is made to feel slow for asking.
How Do You Test the Page Before You Send It?
Walk it through three real tasks from last week. Read the page against a real job and see whether it gives one clear answer in a minute. If two people reach different conclusions, the rule is not finished. Then hand it to your newest team member. Their reading counts most, because they have the least context to fill your gaps with.
Put the review date on the page itself. Tool lists age fast, and the Netskope report recorded Gemini use climbing from 46% to 69% of firms in a year. A quarterly look at the approved accounts, the banned data, and the named owner takes twenty minutes. That small habit keeps the page worth trusting, and a page people trust is the one they actually keep using at the moment it matters.
Frequently Asked Questions
How do you write an AI policy for a company as a PDF?
Draft the page in a word processor, then export it to PDF so the version everyone holds is the same. Put the version number and review date in the footer, and add a sign-off line if you want a record. Keep the editable file as the master, because you will update the approved account list more often than you expect.
How do you automate a business with AI?
Start with one repeated task a person does by hand weekly, such as drafting a first-pass reply or writing up a call. Run it through an approved account for a month, then compare the output with what you did before. Workflow optimization comes from narrowing the task, not buying more tools. Write your policy first, so early tests happen inside a boundary.
What are the benefits of AI in business?
The measurable gains show up as shorter cycle times on routine drafting, faster reading of long files, and more attention left for judgement work. Those gains hold only where output is checked by someone who knows the subject. Operational efficiency from AI adoption is real but uneven, and it arrives task by task rather than across a whole team at once.
How long should an AI policy be?
One page for the working rules. If a duty in your market needs more detail, put that in a short annex and leave the page itself clean. The test is not length in words but time to an answer: someone with a question should reach a call in under a minute. Anything that does not help them decide belongs somewhere else.
What should an AI policy say about client data?
Name it directly. Say that client files, contracts, and anything covered by an NDA must not go into an AI tool your firm does not control. Many client deals already limit where data may be handled, so check your contracts before writing the line. Where a client has agreed to AI use in writing, note that exception on the page as well.
Do you need a lawyer to write an AI policy?
Not for the first version. An owner can write the working rules, because they turn on your own calls about tools and data rather than on statute. Legal review is worth having before you attach penalties to a breach, or promise clients anything about how their files are handled. Duties differ by market and by sector, so take advice where you operate.
How often should you update a one-page AI policy?
Quarterly is enough for most growing businesses, with an extra look whenever you approve a new tool or a vendor changes its data terms. Three lines carry almost all the drift: the approved accounts, the banned data, and the named owner. Every twenty minutes, check those three, and reissue the page with a new date so people can see it is current.
Should staff sign the AI policy?
A signed line is useful as a record, but on its own it changes very little. What changes habits is a short walkthrough with real examples of an allowed task and a banned one. Pair the two: run the session, then collect the sign-off. Change management works better as a talk people joined than a form they returned to HR.
Can you use an AI policy template you found online?
Use one as a checklist, not as your policy. A template cannot know which accounts your firm has approved, which client deals restrict data handling, or who your team should ask. Strip it to the three questions that matter, fill those in with your own answers, and delete the rest. What survives is usually about a page, which is the point.
What does it take to get an AI policy written and adopted?
Plan two short blocks of work: an hour asking each team which tools they use, and an afternoon drafting the page and inviting pushback. Adoption takes a third block, which is a walkthrough with real examples. Scope drives the effort, so name your deliverables up front. Schedule a consultation if you want a second view on the account and data lines.
Executive Summary
A usable AI policy fits on one page and answers three questions: what your team may paste, into what, and who to ask. Write it in four passes, starting with an hour watching what people do. Name the kinds of data in your team’s own words, approve accounts rather than brand names, and put one owner on the page. Test it against three real tasks, set a quarterly review, and keep it short enough that someone reads it while deciding.
What Should You Do Next?
Block an hour this week to ask each team which AI tools they open and what goes into them. Draft your page from those answers, then walk three real tasks through it.
AI Smart Ventures offers AI Advisory for growing businesses deciding which AI tools and accounts to approve. Schedule a consultation to pressure-test your policy page against how your team really works.
People Also Read
- Are AI Certifications Worth the Investment? A Business Owner’s Honest Evaluation
- What Is an AI Operating Model for Businesses Under 100 Employees?
About the Author
Nicole A. Donnelly is the Founder of AI Smart Ventures and an AI Adoption Specialist with 20 years of experience as a founder and CEO and over a decade leading AI adoption initiatives. She helps businesses integrate artificial intelligence with clarity and confidence, driving innovation and sustainable growth. Nicole has trained over 20,217 professionals in Applied AI, delivered 624 workshops, and worked with close to 1,000 organizations across diverse industries.
Expertise: AI Transformation, AI Strategy, AI Implementation, AI Adoption, Applied AI, Marketing, Business Operations
Disclaimer: This content is for informational purposes only and does not constitute professional business or technology advice. Results vary based on industry, existing systems, and implementation commitment. Contact AI Smart Ventures for a consultation regarding your specific situation.
