Does Your Small Business Need an AI Policy Before Something Goes Wrong?

Someone on your team has a document to finish before the end of the day. They are running behind, so they open ChatGPT, paste in the information, and ask it to put everything together.

A few seconds later, they have a professional-looking document. It is well structured, reads nicely, and appears to cover everything the customer needs.

Their manager gives it a quick read, approves it, and sends it off.

Nobody thinks much more about it until the customer notices something wrong. Perhaps the document contains an incorrect claim, a service you do not provide, or information that should never have been shared in the first place.

Now you have a problem, and the first question is usually who approved it.

The employee says AI generated the information. The manager says they assumed it had been checked. The business owner had no idea AI was involved.

That is the risk small businesses need to understand. AI makes it easier to produce work, but it does not automatically make that work accurate, secure, or suitable for your customers.

And if your team is already using AI without clear rules, your business may be carrying risks you have not even thought about.

Your Team Is Probably Using AI More Than You Realise

Most business owners do not sit down one morning and decide to introduce AI into every part of their company.

It happens gradually.

Someone uses ChatGPT to improve an email. Another person uses Gemini to summarise a document. Your marketing assistant uses AI to create content ideas. Someone in operations discovers a tool that can turn meeting notes into tasks.

Before long, AI has become part of the business without anyone making a formal decision about it.

The problem is that employees often use whatever tool is easiest to access. They might have a personal account, a free subscription, or an application they discovered through a YouTube video.

They are not necessarily trying to do anything wrong. They are trying to get their work finished.

But the business may have no visibility into which tools are being used, what information is being uploaded, or whether anyone is checking the results.

This is sometimes called shadow AI, and it creates a similar problem to shadow IT, where staff introduce software that the business has not approved or properly managed.

The difference is that AI tools can receive large amounts of business information in a single prompt, document upload, or connected account.

That makes the consequences worth thinking about.

An AI Policy Is Not About Stopping People From Using AI

When business owners hear the word policy, they often imagine another complicated document that nobody wants to read.

That is not what you need.

A practical AI policy is simply an agreement about how your business will use AI, what information it can access, what it can help produce, and who is responsible for checking the results.

It should make your team’s work easier, not create another administrative headache.

Think about how you already manage other parts of the business.

You probably have rules about who can access your bank accounts, who can approve expenses, who can send contracts, and who is allowed to make commitments to customers.

AI should fit into those same responsibilities.

You would not give a new employee unrestricted access to every business system simply because they were enthusiastic about technology. You would decide what they needed, explain the rules, and make sure someone was accountable.

AI deserves the same consideration.

Start by Finding Out What AI Your Team Already Uses

Before writing any policy, have a conversation with your team.

Ask them which AI tools they are using and what they are using them for. Find out whether they use personal accounts, company accounts, or tools that connect directly to your business systems.

You may discover that AI is already helping with research, customer service, marketing, reporting, proposals, recruitment, or internal administration.

Some of those uses may be perfectly reasonable. Others may need tighter controls.

For example, using AI to improve the wording of a generic appointment reminder is very different from uploading a spreadsheet containing customer names, addresses, payment information, and private correspondence.

The task might feel similar to the employee because both involve asking AI to help with writing. The business risk is not similar at all.

This is why the conversation should start with understanding what is happening rather than immediately banning tools.

If employees think they will get into trouble for admitting they use AI, they may simply stop telling you.

You need visibility before you can make sensible decisions.

Not Every AI Task Carries the Same Risk

One mistake businesses make is treating all AI use as if it carries the same level of risk.

It does not.

Asking AI to suggest ten ideas for an internal team meeting is relatively low risk. Using it to draft a customer email introduces more responsibility because that message represents your business.

Using AI to prepare a financial report, interpret sensitive information, assess job applicants, or write contractual language requires considerably more care.

The important question is what happens if the AI gets something wrong.

If it suggests a poor headline, your marketing team can change it.

If it invents a service guarantee and that wording reaches a customer, you may have a much more expensive problem.

If it exposes confidential information through an inappropriate tool or connection, the consequences could extend beyond the original task.

Your AI policy should recognise these differences and set the level of review accordingly.

The NIST AI Risk Management Framework provides a useful reference for organisations thinking about AI risks. You do not need to implement an enterprise-level governance programme to benefit from the underlying principle: understand the risk, put appropriate controls in place, and keep reviewing how the technology is being used.

Decide What Information Your Team Can Share With AI

This is one of the first rules I would put in place.

Your team needs to understand that not every piece of business information belongs inside an AI tool.

Customer records, confidential contracts, staff information, passwords, financial details, proprietary processes, and private correspondence should not be uploaded to unapproved systems simply because doing so makes a task easier.

That does not mean AI can never work with sensitive business information. There may be legitimate uses in properly configured services with suitable contractual, privacy, security, and access controls.

But those decisions need to be made deliberately.

You should know which provider is processing the information, what the relevant data-handling terms say, how long information may be retained, what administrators can control, and whether the proposed use is appropriate for the data involved.

A paid subscription does not automatically make every use safe.

You also need to be careful when removing identifying details from documents. Deleting a customer’s name may not be enough if the remaining information could still identify them.

If your business does not have clear rules around customer information and access, SixFive’s Small Business Cyber Profile is a useful starting point for identifying weaknesses in your wider security practices.

Make Sure Business Work Happens in Business-Controlled Accounts

Imagine an employee has spent six months building useful AI prompts, workflows, templates, and project knowledge inside their personal account.

Then they leave.

The business may discover that important information is tied to an account it does not control. Even if the employee is happy to cooperate, extracting the useful material and rebuilding the workflow can become an unnecessary project.

That is why account ownership matters.

Where possible, business work should happen through approved accounts managed by the business. The company should know who has access, what permissions they have, and what happens when someone leaves.

This is particularly important when AI tools are connected to Google Drive, Gmail, calendars, CRMs, project management platforms, or other systems containing business data.

Before enabling those connections, understand what the AI can read and what actions it is allowed to perform.

Reading a document is different from editing it. Drafting an email is different from sending it. Suggesting a CRM update is different from changing customer records automatically.

Start with the smallest permissions necessary for the task, and expand access only when there is a clear reason.

Who Is Responsible for Checking AI-Generated Work?

This is where an AI policy becomes especially valuable.

AI can create work that looks finished long before it is ready to be used.

A report can be beautifully formatted and still contain incorrect figures. A proposal can sound persuasive and still misrepresent your service. A marketing article can read professionally and still include unsupported claims.

The danger is that people become comfortable accepting the output because it looks better than something they could have written quickly themselves.

In the AI Business Flywheel discussion, Christopher Melotti described using AI extensively in his marketing business while keeping people involved before and after the AI-assisted stage.

That is a sensible approach.

The employee provides the context and instructions. AI assists with the task. Then a person with the appropriate knowledge checks the result before it is approved or shared.

For a simple internal summary, that review might be quick.

For a customer proposal, financial document, policy, or technical recommendation, the review needs to be more substantial.

Someone must check the facts, figures, promises, sources, and assumptions. They should also confirm that the document reflects the actual situation rather than simply sounding convincing.

The business remains responsible for what it sends to customers, regardless of which tool helped create it.

The Most Expensive AI Mistakes May Look Perfectly Professional

Consider a business preparing a proposal for a potential customer.

AI has access to previous proposals, service descriptions, and pricing information. It produces a draft in minutes, saving the team a considerable amount of work.

That sounds useful, and it can be.

But what if the pricing information is outdated? What if a previous proposal included an exception that does not apply to the new customer? What if AI combines two services into a package the business has never offered?

The proposal may look excellent.

The problem only appears when someone tries to deliver what was promised.

This is why source information matters as much as the AI tool.

If you want reliable outputs, the business needs accurate service descriptions, approved pricing, current policies, clear templates, and documented processes.

Those documents should live somewhere the business controls and be updated when things change.

SixFive’s SOP Notion Template can help you start documenting repeatable business processes, including where AI assistance is permitted and where human approval is required.

Your AI Policy Should Protect the Customer Experience

AI governance is not only about cybersecurity and data protection.

It is also about how your business treats customers.

AI makes it easier to generate marketing emails, sales messages, website content, and customer responses at scale. But being able to send more messages does not mean customers want to receive them.

Imagine your business uses AI to produce hundreds of personalised outreach messages.

Technically, the system might work exactly as designed. But if the messages are irrelevant, intrusive, or sent too frequently, you could damage relationships with people who might otherwise have become customers.

The same applies to AI-generated website content.

Publishing more articles does not guarantee better search visibility. Google’s guidance on generative AI content explains that AI can support research and content structure, but generating large amounts of material without adding genuine value can violate its spam policies.

That distinction matters for small businesses.

AI should help you communicate more clearly and provide useful information. It should not become an excuse to fill the internet with content nobody needs.

A sensible AI policy should require customer-facing material to be accurate, relevant, consistent with your brand, and checked before publication.

Do Not Confuse Faster Work With Better Business Results

One of the most useful examples from the podcast was how AI changed the time required to prepare tender responses.

Christopher Melotti described building a reusable knowledge base from years of business information, allowing his team to prepare work that previously took several hours much more quickly.

That is a meaningful improvement because the business already had the expertise. AI helped organise and reuse it.

But there is another important point.

The value was not simply the reduction in time.

It was what the team could do with the time they recovered.

Instead of spending hours repeatedly assembling information, they could concentrate on reviewing the work, helping customers, developing ideas, and improving the service.

That is how I would encourage small businesses to think about AI.

Do not measure success only by how many tasks AI completes or how many hours a particular workflow saves.

Look at whether the business is delivering better work, responding more effectively, reducing errors, and giving employees more time for the responsibilities that actually need their experience.

If the output is faster but less accurate, the business has not necessarily improved.

Train Your Team to Question AI, Not Just Use It

There is a skill that becomes more important as AI becomes easier to use: knowing when the answer is wrong.

Employees need to understand that AI can produce inaccurate information, misinterpret instructions, overlook important context, and present assumptions as facts.

They should feel comfortable questioning the result rather than accepting it because it sounds authoritative.

This is especially important for younger or less experienced team members who may not yet have the subject knowledge needed to recognise an error.

If someone uses AI to prepare a technical explanation, they still need enough understanding to verify the explanation.

If someone uses it to analyse a marketing campaign, they need to understand what the numbers actually mean.

If someone uses it to draft a customer proposal, they need to know whether the proposed solution is realistic.

Training should therefore include more than prompting techniques.

Teach people how to check sources, challenge assumptions, identify missing information, recognise when specialist advice is needed, and decide when AI is not appropriate for a task.

A team that can question AI effectively will get considerably more value from it than a team that simply knows how to generate polished answers.

How to Create a Practical AI Policy for a Small Business

You do not need a fifty-page policy to get started.

For many small businesses, a short document covering the most important decisions is enough to establish sensible ground rules.

The policy should identify which AI tools are approved for business use and who is responsible for managing them. It should explain what types of information employees can share, which information is restricted, and what safeguards apply to connected systems.

It should also define how AI-generated work is reviewed. Customer-facing documents, financial information, public claims, and important decisions should have a named person responsible for checking the output.

Include guidance on disclosure where customers or other parties need to know AI is involved, particularly when AI is directly interacting with them or creating material that could otherwise be misleading.

Finally, explain what employees should do when something goes wrong. If confidential information is uploaded accidentally, an AI tool sends an incorrect message, or an automated workflow behaves unexpectedly, staff should know whom to contact and how to stop further damage.

The policy should be written in language your team actually understands.

And it should be reviewed as your tools, processes, and business needs change.

Make AI Governance Part of Everyday Operations

A policy that nobody