{"course":{"slug":"ai-for-small-business","title":"AI for a Small Business","url":"https://addaly.com/learn/ai-for-small-business","level":"beginner","track":"work"},"lesson":{"slug":"one-page-ai-policy","title":"The one page your staff actually need","url":"https://addaly.com/learn/ai-for-small-business/one-page-ai-policy","position":81,"of":88,"minutes":8,"answer":"Staff will use AI whether or not you have a policy, so the useful document names the approved tool and the three things that must never be pasted.","keyIdea":"Staff will use AI whether or not you have a policy, so the useful document names the approved tool and the three things that must never be pasted, rather than attempting a ban that only removes your visibility."},"body":{"format":"markdown","text":"## The situation you are actually in\n\nSurveys of workplace AI use consistently find a large gap between the number of employees using these tools and the number whose employer knows about it. Nobody should be surprised. The tools are free, they make a dull task faster, and asking permission invites a no.\n\nThe consequence is that a business with no policy does not have staff who are not using AI. It has staff using it on personal accounts, with terms nobody read, and a strong incentive not to mention it when something goes wrong.\n\nThat last part is the real cost. The failure you want to hear about on the day is the one that gets hidden when the honest answer would be an admission of breaking a rule.\n\n## What the page contains\n\nOne page. Longer is not read, and a policy nobody has read is a document rather than a control.\n\n**The approved tool, named.** \"Use [tool]. The business pays for it; ask for an account.\" A named approved option is what actually reduces shadow use, far more than any prohibition.\n\n**The three things that never get pasted.** Keep the list short enough to remember: customer personal details, anything a client gave you in confidence, and anything covered by a confidentiality agreement. Three is memorable. Eleven is a document.\n\n**What must be checked before it leaves.** Any figure, date, price, name or legal statement. Written as a habit rather than a rule: nothing goes to a customer unread.\n\n**Who to tell when it goes wrong, and that nobody is in trouble for telling.** Put this in writing and mean it. The first time somebody reports a mistake and is thanked, the policy becomes real.\n\n**One line on customers.** Whether staff may let a customer believe they are talking to a person. The answer is no, and the next lesson explains what to say instead.\n\n## Give them the safe version of the thing they wanted\n\nA ban removes the tool and leaves the need. A policy that works replaces it.\n\nThe three tasks staff reach for AI on, in nearly every small business, are drafting a reply to a difficult message, summarising something long, and tidying up their own writing. All three are safe once the data rule is followed, and all three are faster with the facts sheet from module two attached.\n\nSo hand them the facts sheet, the prompt library, and an account. The policy then reads as help with boundaries rather than suspicion with paperwork, and people follow it because it is the easier path rather than the permitted one.\n\n## The part people get wrong\n\nWriting rules about which tasks AI may be used for.\n\nThese age within weeks, they generate arguments about categories, and they are unenforceable. \"You may use it for first drafts but not final copy\" sounds sensible and collapses on contact with anybody's actual working day.\n\nWrite about **data** and **checking** instead. Those two stay true regardless of which tool appears next quarter, and they are the two things that actually cause harm.\n\n## Teaching it, in twenty minutes\n\nA policy read alone is forgotten. A policy demonstrated is not.\n\nSit the team down once. Show the approved tool doing a real task from your business. Then (this is the part that sticks) show it being confidently wrong about something they all know the answer to. A wrong price, an invented opening time, a made-up detail about the business.\n\nThat demonstration does more than any paragraph about limitations, because it replaces an abstract warning with something they watched happen.\n\nThen show them the facts sheet from module two and explain that it exists because of what they just saw.\n\n## The awkward cases to settle in advance\n\nThree questions come up in every business and are better answered before somebody has to guess.\n\n**Can staff use AI to write something about a colleague**: an appraisal, a reference, a complaint response? Treat this as you would hiring in module six: it is about a person, so a human writes the judgement, even if a tool tidies the sentences.\n\n**Can they use their own account for work if they prefer that tool?** The honest answer is that the business needs the account, for the reasons in the next lesson. Offer to buy the tool they prefer instead; it is cheaper than the argument.\n\n**What happens to the customer message they pasted last month?** Somebody will ask. Knowing where it went and whether it can be deleted is exactly the visibility the policy exists to create.\n\n## Review it when something changes\n\nNot annually, which nobody does. When you adopt a new tool, when somebody joins or leaves, or when something goes wrong.\n\nKeep the version and date on the page. If your policy has not changed in a year in this field, the most likely explanation is that nobody has looked at it."},"check":{"question":"A practice manager writes a policy forbidding all AI use until the partners approve a tool. Six weeks later a member of staff pastes a client email into a free chat product to draft a reply. What is the most likely consequence of the ban?","options":[{"text":"The partners will treat the incident as gross misconduct because the policy was explicit, creating a dispute that damages the team more than the data exposure itself.","correct":false,"tempting":"Possible in a badly run practice, and the disciplinary response is a choice rather than a consequence of the ban."},{"text":"Other staff will assume the rule is unenforced and begin using AI openly, which at least restores the visibility the ban was intended to remove.","correct":false,"tempting":"A drift towards openness is plausible over a long period, and it is the opposite of what a live ban usually produces."},{"text":"The practice will have no record of which tool was used or what was sent, so it cannot assess the exposure or notify anyone if notification is required.","correct":false,"tempting":"Names a real and serious gap, which follows from the incident being hidden rather than from the ban itself."},{"text":"The staff member will not report it, so the practice learns about the exposure late or never.","correct":true}]},"prev":{"slug":"customer-data-and-the-law","title":"Your Customers' Data, and the Law Where You Are","url":"https://addaly.com/learn/ai-for-small-business/customer-data-and-the-law"},"next":{"slug":"security-got-harder","title":"Why fraud against small businesses got better","url":"https://addaly.com/learn/ai-for-small-business/security-got-harder"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'The one page your staff actually need', in AI for a Small Business. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/ai-for-small-business/one-page-ai-policy (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"The one page your staff actually need","courseTitle":"AI for a Small Business","module":{"index":9,"slug":"cost-risk-and-the-long-run","title":"What it costs, what it risks, and what happens in a year"},"answer":null,"keyIdea":"Staff will use AI whether or not you have a policy, so the useful document names the approved tool and the three things that must never be pasted, rather than attempting a ban that only removes your visibility.","hero":{"kind":"plate","image":null,"alt":null,"caption":null},"blocks":[{"t":"h2","id":"the-situation-you-are-actually-in","runs":[{"text":"The situation you are actually in"}]},{"t":"p","runs":[{"text":"Surveys of workplace AI use consistently find a large gap between the number of employees using these tools and the number whose employer knows about it. Nobody should be surprised. The tools are free, they make a dull task faster, and asking permission invites a no."}]},{"t":"p","runs":[{"text":"The consequence is that a business with no policy does not have staff who are not using AI. It has staff using it on personal accounts, with terms nobody read, and a strong incentive not to mention it when something goes wrong."}]},{"t":"p","runs":[{"text":"That last part is the real cost. The failure you want to hear about on the day is the one that gets hidden when the honest answer would be an admission of breaking a rule."}]},{"t":"h2","id":"what-the-page-contains","runs":[{"text":"What the page contains"}]},{"t":"p","runs":[{"text":"One page. Longer is not read, and a policy nobody has read is a document rather than a control."}]},{"t":"p","runs":[{"text":"The approved tool, named.","b":true},{"text":" “Use [tool]. The business pays for it; ask for an account.” A named approved option is what actually reduces shadow use, far more than any prohibition."}]},{"t":"p","runs":[{"text":"The three things that never get pasted.","b":true},{"text":" Keep the list short enough to remember: customer personal details, anything a client gave you in confidence, and anything covered by a confidentiality agreement. Three is memorable. Eleven is a document."}]},{"t":"p","runs":[{"text":"What must be checked before it leaves.","b":true},{"text":" Any figure, date, price, name or legal statement. Written as a habit rather than a rule: nothing goes to a customer unread."}]},{"t":"p","runs":[{"text":"Who to tell when it goes wrong, and that nobody is in trouble for telling.","b":true},{"text":" Put this in writing and mean it. The first time somebody reports a mistake and is thanked, the policy becomes real."}]},{"t":"p","runs":[{"text":"One line on customers.","b":true},{"text":" Whether staff may let a customer believe they are talking to a person. The answer is no, and the next lesson explains what to say instead."}]},{"t":"h2","id":"give-them-the-safe-version-of-the-thing-they-wanted","runs":[{"text":"Give them the safe version of the thing they wanted"}]},{"t":"p","runs":[{"text":"A ban removes the tool and leaves the need. A policy that works replaces it."}]},{"t":"p","runs":[{"text":"The three tasks staff reach for AI on, in nearly every small business, are drafting a reply to a difficult message, summarising something long, and tidying up their own writing. All three are safe once the data rule is followed, and all three are faster with the facts sheet from module two attached."}]},{"t":"p","runs":[{"text":"So hand them the facts sheet, the prompt library, and an account. The policy then reads as help with boundaries rather than suspicion with paperwork, and people follow it because it is the easier path rather than the permitted one."}]},{"t":"h2","id":"the-part-people-get-wrong","runs":[{"text":"The part people get wrong"}]},{"t":"p","runs":[{"text":"Writing rules about which tasks AI may be used for."}]},{"t":"p","runs":[{"text":"These age within weeks, they generate arguments about categories, and they are unenforceable. “You may use it for first drafts but not final copy” sounds sensible and collapses on contact with anybody’s actual working day."}]},{"t":"p","runs":[{"text":"Write about "},{"text":"data","b":true},{"text":" and "},{"text":"checking","b":true},{"text":" instead. Those two stay true regardless of which tool appears next quarter, and they are the two things that actually cause harm."}]},{"t":"h2","id":"teaching-it-in-twenty-minutes","runs":[{"text":"Teaching it, in twenty minutes"}]},{"t":"p","runs":[{"text":"A policy read alone is forgotten. A policy demonstrated is not."}]},{"t":"p","runs":[{"text":"Sit the team down once. Show the approved tool doing a real task from your business. Then (this is the part that sticks) show it being confidently wrong about something they all know the answer to. A wrong price, an invented opening time, a made-up detail about the business."}]},{"t":"p","runs":[{"text":"That demonstration does more than any paragraph about limitations, because it replaces an abstract warning with something they watched happen."}]},{"t":"p","runs":[{"text":"Then show them the facts sheet from module two and explain that it exists because of what they just saw."}]},{"t":"h2","id":"the-awkward-cases-to-settle-in-advance","runs":[{"text":"The awkward cases to settle in advance"}]},{"t":"p","runs":[{"text":"Three questions come up in every business and are better answered before somebody has to guess."}]},{"t":"p","runs":[{"text":"Can staff use AI to write something about a colleague","b":true},{"text":": an appraisal, a reference, a complaint response? Treat this as you would hiring in module six: it is about a person, so a human writes the judgement, even if a tool tidies the sentences."}]},{"t":"p","runs":[{"text":"Can they use their own account for work if they prefer that tool?","b":true},{"text":" The honest answer is that the business needs the account, for the reasons in the next lesson. Offer to buy the tool they prefer instead; it is cheaper than the argument."}]},{"t":"p","runs":[{"text":"What happens to the customer message they pasted last month?","b":true},{"text":" Somebody will ask. Knowing where it went and whether it can be deleted is exactly the visibility the policy exists to create."}]},{"t":"h2","id":"review-it-when-something-changes","runs":[{"text":"Review it when something changes"}]},{"t":"p","runs":[{"text":"Not annually, which nobody does. When you adopt a new tool, when somebody joins or leaves, or when something goes wrong."}]},{"t":"p","runs":[{"text":"Keep the version and date on the page. If your policy has not changed in a year in this field, the most likely explanation is that nobody has looked at it."}]}],"check":{"question":[{"text":"A practice manager writes a policy forbidding all AI use until the partners approve a tool. Six weeks later a member of staff pastes a client email into a free chat product to draft a reply. What is the most likely consequence of the ban?"}],"options":[{"text":[{"text":"The partners will treat the incident as gross misconduct because the policy was explicit, creating a dispute that damages the team more than the data exposure itself."}],"correct":false,"tempting":[{"text":"Possible in a badly run practice, and the disciplinary response is a choice rather than a consequence of the ban."}]},{"text":[{"text":"Other staff will assume the rule is unenforced and begin using AI openly, which at least restores the visibility the ban was intended to remove."}],"correct":false,"tempting":[{"text":"A drift towards openness is plausible over a long period, and it is the opposite of what a live ban usually produces."}]},{"text":[{"text":"The practice will have no record of which tool was used or what was sent, so it cannot assess the exposure or notify anyone if notification is required."}],"correct":false,"tempting":[{"text":"Names a real and serious gap, which follows from the incident being hidden rather than from the ban itself."}]},{"text":[{"text":"The staff member will not report it, so the practice learns about the exposure late or never."}],"correct":true,"tempting":null}],"order":[1,0,3,2],"why":null},"prev":{"slug":"customer-data-and-the-law","title":"Your Customers’ Data, and the Law Where You Are","minutes":9},"next":{"slug":"security-got-harder","title":"Why fraud against small businesses got better","minutes":9}}}