AI Policy for Small Business: A Checklist

Your team is already using AI. The question is whether they are using it the same way, with the same limits, and whether you would know if something went wrong. An AI policy for small business does not need to be long. It needs to answer the questions your staff are already guessing at, in plain language, on one or two pages.

This post gives you the structure, the decisions to make, and a checklist to copy. It is general information, not legal advice; if you handle health, financial or tax data, have your compliance adviser or attorney review the final version.

Why a small business needs an AI policy now

Three things tend to happen without one:

• Client data ends up in personal accounts. A staff member pastes a client's details into a free tool on their own login, where the business has no control over retention or training settings. Our post on using AI with client data covers where that data goes.
• AI output goes out unchecked. A drafted email quotes a wrong deadline. A summary leaves out the one exception that mattered.
• Nobody knows what is in use. When a client asks "do you use AI on my file?", you cannot answer.

A policy fixes all three by making decisions once instead of leaving each person to make them alone.

Borrow the structure from NIST

The US National Institute of Standards and Technology published its AI Risk Management Framework (AI RMF 1.0) on January 26, 2023. It is intended for voluntary use and is organized around four functions: Govern, Map, Measure and Manage. NIST notes the framework is being revised, so check its page for the current version. The four functions translate well to a small business:

• Govern: who owns AI decisions and who approves new tools.
• Map: which tasks use AI and what data each touches.
• Measure: how you check whether outputs are accurate.
• Manage: what you do when something goes wrong, and how often you review.

In July 2024 NIST added a Generative AI Profile (NIST AI 600-1) that lists twelve risks that are new or made worse by generative AI. Five apply directly to everyday office use:

• Confabulation: NIST's term for confidently stated but erroneous or false content, often called hallucinations.
• Data privacy: leakage and unauthorized use or disclosure of personally identifiable or sensitive data.
• Information security: lowered barriers for attacks, including hacking, malware and phishing.
• Intellectual property: easier production or replication of copyrighted, trademarked or licensed content without authorization.
• Human-AI configuration: how people and AI systems interact, including automation bias and over-reliance.

Your policy should have at least one rule that answers each of those. In the checklist below, items 2 and 3 answer data privacy, items 4 and 5 answer confabulation and over-reliance, item 8 answers information security, and the accuracy check in item 5 should also cover whether AI-written text or images copy someone else's work.

The AI policy checklist

Work through these in order. Each one becomes a short section of your policy.

1. Owner. Name one person responsible for the policy and for approving tools. In a ten-person firm this is often the owner or office manager.
2. Approved tools and accounts. List the specific tools and plans staff may use, on business accounts the company controls. Ban work use of personal AI accounts.
3. Data rules in three tiers. Allowed: public information, internal templates, general research, drafting with no client details. Allowed with care: client names or figures on an approved business plan with training turned off. Never without a specific approved setup: medical records, Social Security numbers, bank and card details, tax returns, passwords.
4. Human review. Every AI output that goes to a client, a patient, a regulator or the public is read and approved by a named person who is accountable for it as if they wrote it.
5. Accuracy checks. Figures, dates, citations, laws and quotes produced by AI are checked against the original source before use. This is your answer to confabulation.
6. Decisions about people. AI does not make final decisions on hiring, firing, credit, eligibility for care or pricing for an individual. A person decides, and can explain why.
7. Disclosure. Decide when you tell clients that AI was involved, for example in chat assistants on your website or in recorded call summaries. Write the wording once.
8. Security. Staff should treat unusually polished messages asking for payments or credentials with extra suspicion, and verify by phone.
9. Incidents. If client data goes into an unapproved tool or a wrong AI output reaches a client, staff report it to the owner the same day. Spell out that reporting is expected and will not be punished.
10. Review date. Revisit the policy every six months, or when you adopt a new tool.

Industry notes to add

• Healthcare and home care: under the HIPAA Privacy Rule, a covered entity may let a business associate receive or maintain protected health information on its behalf only with satisfactory assurances, documented in a written contract, that the information will be safeguarded. In practice that is a Business Associate Agreement with any AI vendor that will see patient data. List which tools have one.
• CPA and tax firms: if your firm keeps a written information security plan, add the approved AI tools to it and note which client records each one can touch.
• Clients in the UK or EU: the UK Information Commissioner's Office publishes guidance on AI and data protection that covers data protection impact assessments, transparency, fairness and automated decision-making. The ICO notes the guidance is under review following the Data (Use and Access) Act, so check the current version.
• Real estate: keep AI-written listing descriptions within fair housing rules, and have an agent review every one.

What a good one-page policy looks like

It fits on one page plus an appendix listing approved tools. It uses examples from your own work ("you may use the approved assistant to draft a first version of an engagement letter; you may not paste in the client's return"). Every staff member signs that they have read it. It has a date at the top and a named owner at the bottom.

A bad policy is a long document copied from a large company, full of terms nobody in your office uses, that bans "AI" outright and is ignored by Friday.

Test the policy with three scenarios

Before anyone signs, read these three hypothetical situations aloud at a staff meeting and ask what the policy says to do. If people disagree, the wording needs work.

1. A scheduler wants to paste a client's care notes into a free chatbot to tidy the grammar. The answer should be obvious from items 2 and 3: wrong account, wrong data tier.
2. An AI-drafted email to a client quotes a filing deadline. Item 5 applies. Who checks the date, and against what source?
3. A staff member realizes on Friday that they uploaded a spreadsheet of client bank details to an unapproved tool on Tuesday. Item 9 applies. Who do they tell, and what happens next?

If each scenario gets the same answer from everyone in under a minute, the policy is doing its job.

How Pinn.Media helps

We build AI tools for home care agencies, CPA firms and other businesses that hold sensitive data, and we start every project by mapping what data the tool will touch and who reviews its output. You can read more about how we work. If you want help turning this checklist into a policy and an approved tool setup for your team, book a discovery call.