What should a small business AI policy say?

By Pamela, Founder & CEO at DigiVino · Updated October 1, 2026 · 3 min read

Picture Omar, managing director of a nine-person software consultancy. He has no AI policy. He does have a project coordinator pasting client emails into a free chatbot to tidy the grammar, a developer who likes it for research, and a bookkeeper who has never touched it. All three are doing something reasonable. Only one of them is doing something he would be comfortable explaining to a client.

This is part three of AI for Good, the Yield & Press series on using artificial intelligence (AI) in ways you would be happy to explain to a customer.

Why does a small business need an AI policy?

Because the team is already using AI, and a policy is how you decide what goes in and who checks what comes out. Without one, every person makes that decision alone, every day, with whatever tool is open.

It does not need to be long. A forty-page policy gets filed. A one-page policy gets read, and at Omar’s firm the reading is the point.

What goes on the one page?

1. Approved tools. Name them. Prefer business versions whose terms say your inputs are not used to train models, and say which free tools are off limits for work.
2. What never goes in. Customer and client personal information, anything confidential, passwords and access codes, unreleased numbers. Omar’s project coordinator can still tidy grammar, with the names and details taken out first.
3. A person checks anything a customer sees. Emails, web copy, quotes, answers from a chatbot. In the Air Canada chatbot case, the company was held responsible for a wrong answer its chatbot gave.
4. Tell people when it is AI. A chatbot should introduce itself as one. In the EU, the AI Act has required chatbots to be built to disclose this since 2 August 2026.
5. Never invent a customer. No AI-written reviews, testimonials or quotes. In the US the Federal Trade Commission (FTC) bans fake reviews, AI-generated ones included.
6. Who to tell when it goes wrong. One named person, and a promise that owning up early is never the problem.

Who should own the AI policy?

One named person, not a committee. They keep the approved-tools list current, answer the “can I use it for this?” questions, and look at the page again twice a year, because the tools and the rules both change faster than most policies do.

At Omar’s firm that is the operations manager. She is the person everybody already asks.

What does each kind of business add?

The one page is the same shape everywhere. The detail changes. A winery adds shipping and age-verification answers to the list of things a chatbot must never improvise. A law firm adds privileged client information, and checks its professional-conduct rules before anything else. A boutique lodge adds guest details and booking changes. A nonprofit adds donor information, and a rule about who may write in the director’s name.

What if you want to do more than follow the rules?

Some owners, once they start, want to understand the bigger questions about where AI is heading. Three places worth knowing:

• BlueDot Impact runs online courses on AI safety and governance, written for people from any background.
• 80,000 Hours publishes career advice for people who want their work to matter, including on AI.
• The Center for AI Safety, a San Francisco nonprofit, works on reducing large-scale risks from AI through research and field-building.

This is general information, not legal advice. A lawyer or an adviser who knows your industry can turn the one page into your one page.

Editorial. Sources: the EU AI Act, Article 50; Moffatt v. Air Canada, 2024 BCCRT 149; the FTC rule on consumer reviews and testimonials (2024). DigiVino, September 2026. General information, not legal advice.

← Back to Yield & Press