A one-page AI data policy is the single cheapest safeguard a small business can put in place before its team starts pasting client information into a chatbot. Most small businesses adopt AI tools before deciding what may be put into them. A single page, written once, prevents most of the problems that follow.
[eba_callout type=”answer” title=”Short answer”]Decide three things and write them down: which tools are approved, what categories of information may never be uploaded, and who to ask when it is unclear. One page. Everyone reads it. Revisit it twice a year.[/eba_callout]
What your one-page AI data policy has to answer
- Which tools are approved. A short list beats a ban nobody follows.
- What must never be uploaded. Client data covered by a confidentiality clause, personal data, credentials, unpublished financials.
- What is fine. Public information, your own marketing copy, anonymised examples.
- Who decides the grey cases. One named person.
- The review date. Terms change; so should the policy.
A one-page AI data policy doesn’t need legal review to be useful on day one, but it does need buy-in from whoever signs client contracts. Draft it, share it with that person for a five-minute sanity check, and publish it — waiting for a perfect version is how most small businesses end up with no policy at all for another year.
Check your client contracts first
Many service contracts restrict sharing client information with third-party processors. An AI vendor is a third-party processor. This is the clause that turns a productivity decision into a contractual problem, and it is usually easy to check.
Keep a copy of whatever answer each vendor gives about training use and retention, dated and attached to your one-page AI data policy. Vendor terms change quietly, and having last year’s answer on file makes it obvious when this year’s terms have quietly shifted in a direction you wouldn’t have approved.
Check the vendor terms too
The questions that matter: is input used for training, how long is it retained, and can you turn training use off? The answers differ between the free tier and the business tier of the same product, which is often the real reason to pay.
Keep it one page
A ten-page policy is a policy nobody reads, which is functionally the same as no policy. One page, plain language, on the wall.
How to actually get a one-page AI data policy adopted
Writing a one-page AI data policy is the easy half; getting your team to follow it is the part most businesses skip. Put it somewhere people already look — a pinned Slack message or the top of the employee handbook, not a buried PDF — and walk through it once in a team meeting rather than emailing it and hoping. If you’re still comparing which AI tools to approve in the first place, our guide on how to choose an AI tool covers the evaluation steps that pair naturally with this policy. For the broader regulatory context on business data practices, the FTC’s business guidance on privacy and security is a useful reference when you’re deciding what counts as sensitive.
Revisit the policy every time you adopt a new tool, not just on the twice-yearly review date — a policy that only gets updated on schedule tends to lag six months behind whatever your team actually started using last month.
[eba_faq]
Q: Do we need this if we only use free tools?
A: Especially then. Free consumer tiers are the most likely to use input for training.
Q: Who should write it?
A: Whoever owns client relationships, with input from whoever understands the tools. It is a commercial document, not a technical one.
[/eba_faq]
