Your employees are using AI right now, whether you’ve sanctioned it or not.
Some are pasting customer data into ChatGPT to draft emails. Some are using AI-powered browser extensions on documents you’d rather not have shared with external systems. Some are running AI-generated code from personal accounts and submitting it as work product. A few are using AI to make hiring decisions or performance evaluations without disclosing it. All of it is happening. The only question is whether your business has decided how to feel about it.
The absence of a policy is a policy. It’s an implicit one, chosen by each individual employee for themselves. That’s the reality you’re operating in.
Getting explicit isn’t optional. It’s a question of timing.
Here’s what surprises most SMB leaders: writing an AI usage policy is much simpler than they fear. It doesn’t require a lawyer, doesn’t require a committee, doesn’t require months of drafting. A useful one-page policy can be written in an afternoon and improved over time. Its function is not to be legally airtight; its function is to give employees a clear answer to “what am I allowed to do.”
The policy answers a few practical questions. What kinds of data can be pasted into external AI tools? (Usually: nothing customer-related, nothing under NDA, nothing regulatory.) What AI tools does the business officially support? (Name them, with an approval path for new ones.) What has to be disclosed when AI was used? (Customer-facing communications, hiring processes, work you’re going to publish under your name.) Who do employees ask when they aren’t sure? (A person, not a form.)
That’s it. Publish it, communicate it, revisit it every six months. Don’t wait for the perfect version. The imperfect version you have is worth more than the perfect version you’re still drafting.
The businesses that skip this step almost universally regret it. Either an employee makes a decision that becomes a public embarrassment, or an executive discovers that critical work has been done using tools nobody approved and now nobody can audit. Both outcomes get you into a policy conversation on urgent timelines, which is the worst time to have one.
The right time to write an AI policy was six months ago. The second-best time is this month.
Diagnostic question 10 asks how consistent your employees’ answers would be if you polled them about your AI policy. Consistent answers mean you have one. Inconsistent means you don’t, whatever the intent was.