An AI Policy for Small Businesses: Five Rules That Fit on One Page

Most small businesses did not decide to adopt AI. Someone on the team started using ChatGPT for emails, someone else for proposals, and now client names, prices and contracts pass through tools nobody chose and nobody checks.

That is not a reason to ban it. It is a reason to write down a few rules. Large companies call this an AI governance framework and give it a committee. A business of five or fifty needs one page.

What goes wrong without rules

• Client data goes into a free tool whose terms may allow it to be used to train the model.
• A draft goes out under your name with a wrong figure, a wrong name or a promise nobody made.
• Three people use three tools, so nothing is shared and nothing is remembered.
• When something goes wrong, nobody knows who checked it, or whether anyone did.

Five rules that fit on one page

The NIST AI Risk Management Framework, the reference most larger organisations work from, splits governance into four jobs: govern, map, measure and manage. At small-business scale they become five rules.

• List the tools (map). Write down every AI tool in use, who uses it, and what it touches: email, client files, finances. It is usually more than you think.
• Decide what may go in (govern). Name the tools approved for client data, on business plans whose terms you have read, and say plainly what never goes into anything else.
• A person checks before it reaches a client (measure). AI drafts; someone reads it before anything is sent, priced or promised. Nothing goes out on its own.
• One owner (govern). One named person decides which tools are allowed and answers when something goes wrong. In a small business, that is usually the owner.
• Log what goes wrong, and fix the rule (manage). When an AI output is wrong, note it, then change the rule or the instruction so it does not happen twice.

Where the brain fits

Rules work better when the AI has one place to read from. If your client history, your decisions and the way you write live in one structured record that you own, the tools stop guessing, and you can see what they used.

That is how we set up AI for small businesses, and how SHA/RP runs itself: nothing is sent for you, and the record stays in your own accounts.

Start with the page of rules. The tools will change every few months. The rules should not.