When I talk about AI on FOX 5 New York, the most common question from business owners afterward is not about which tool to buy. It is "my people are already using this, what do I tell them?" The honest answer is that a policy is the cheapest piece of AI infrastructure you will ever build, and most mid-market companies still do not have one. Here is how to write it in an afternoon.
Why does the policy need to fit on one page?
Because a policy nobody reads is the same as no policy. Large companies publish 30-page AI governance frameworks and then discover that the sales team has been pasting proposals into a free chatbot for a year. A single page gets read, gets printed, and gets remembered. Everything else, including procedures, approved-tool reviews and training, can live in supporting documents that the policy points to.
One page also forces clear decisions. If you cannot say in a sentence which data is off limits, you have not decided yet.
What are the six decisions behind the policy?
- Approved tools. Name them. Business accounts of one or two major assistants are enough to start. Personal accounts and free tiers are out, because their data terms are different and you cannot manage them.
- Prohibited data. Client and customer personal information, employee and payroll data, anything under NDA or privilege, non-public financials, credentials, source code and trade secrets. Write the list in words your newest hire understands.
- Encouraged uses. Drafting, summarizing, research, first-pass analysis, meeting notes, code assistance. If you do not say what is encouraged, people assume everything is suspect and the policy becomes a brake.
- Uses that need a human check. Anything sent to a client, anything legal or financial, anything that makes a decision about a person (hiring, credit, claims), and anything published under the company name. The rule is simple: AI drafts, a named human owns.
- Owner and exceptions. One person, by name, approves new tools and new uses. Exceptions are requested in writing and answered within two business days.
- What happens when something goes wrong. Report it the same day, no penalty for reporting. The failure you hear about on day one is manageable. The one you hear about in discovery is not.
What does the one-page template look like?
Copy this, replace the bracketed text, and remove anything that does not apply. It is intentionally short.
[Company] AI Usage Policy
Effective: [date] Owner: [name, title] Review: quarterly
1. Purpose
We use AI tools to do better work faster. This page says how we do that while protecting our clients, our employees and our company.
2. Approved tools
You may use the company accounts for [Tool A] and [Tool B]. Personal accounts, free versions and any tool not on this list are not approved for company work. To request a new tool, email [owner].
3. Never enter this data into any AI tool
Client or customer names and personal details; employee personal, health or payroll information; anything covered by an NDA or legal privilege; financial results that are not public; passwords, keys or login details; source code and trade secrets. When unsure, ask [owner] first.
4. Encouraged uses
Drafting and editing, summarizing documents and meetings, research and brainstorming, first-pass analysis of non-sensitive data, writing and checking code, learning new skills.
5. A named person must review before use
Anything sent to a client or published under our name; legal, tax or financial content; any decision about a person, such as hiring, promotion, credit or claims; anything that will be acted on without further checking. AI drafts. A human owns the result.
6. Be accurate and honest
Check facts, numbers and citations before relying on them. Do not present AI output as your own original research when a client asks. Do not use AI to create content that impersonates a real person or misleads anyone.
7. If something goes wrong
If you believe sensitive data was entered into a tool, or AI output caused an error, tell [owner] the same day. Reporting quickly is always the right call and carries no penalty.
8. Exceptions
Request in writing to [owner]. You will get an answer within two business days.
Acknowledged by: ____________________ Date: __________
How do you roll it out in a week?
Day one, the owner fills in the brackets and the executive team reads it once. Day two, IT confirms the approved tools are on business accounts with data-sharing settings set the way you want. Day three, send the page to everyone with a two-paragraph note from the CEO that says, in effect, we want you using these tools, here is how. Day four, a 20-minute all-hands question session. Day five, collect signed acknowledgements and file them.
That is the whole rollout. Companies that treat it as a six-month project are usually trying to answer every question before they publish, and the questions keep coming. Publish the page, then improve it.
What do regulated firms need to add?
Law firms, wealth managers and insurance agencies should add two lines. First, a sentence stating that the firm's existing confidentiality, privacy and record-keeping obligations apply to AI use in full. Second, a short list of the specific records that must be retained when AI is used in client work, so the policy matches what the regulator or bar association expects. Law firms using AI for client acquisition have a particular reason to get this right, because marketing content and intake data are both covered.
The policy does not replace a compliance review. It makes the review faster, because the decisions are already written down.
How does the policy connect to revenue?
This is the part most companies miss. A usage policy is usually framed as risk management. In practice it is also permission. The teams that generate real returns from AI are the ones whose people use it every day without wondering whether they are allowed to. When I helped a five-person team produce $32 million in revenue, the advantage was not a secret tool. It was that every person on the team knew exactly which systems to use, for what, and what the review step was. A policy gives a company of 200 people that same clarity. It belongs in the same conversation as your revenue engine, not only in the compliance binder.
If you want this done with you rather than for you to figure out, the AI Clarity Sprint includes the policy, the approved-tool review and the rollout plan. Details are on the engagements and FAQ page. For the prompts and procedures that sit underneath a policy like this, see ChatGPT for Profit, Volumes 1 and 2.
Frequently asked questions
- Does a mid-market company really need an AI usage policy?
Yes, because employees are already using AI tools whether or not a policy exists. A one-page policy turns unmanaged use into managed use: it names the approved tools, draws a clear line around client and employee data, and tells people who to ask. Without it, every employee makes those decisions alone and the company has no record of what was decided.
- Should we ban ChatGPT and similar tools until we have a policy?
No. Bans push usage onto personal phones and accounts, where the company has no visibility at all. A better sequence is to publish the one-page policy this week with a short approved list (business accounts of one or two major tools), then expand the list as you evaluate others. Approve and direct rather than prohibit.
- What data should never go into an AI tool?
At minimum: client or customer personal information, employee personal and payroll data, anything under NDA or attorney-client privilege, financial results before they are public, credentials and access keys, and source code or trade secrets. The policy should list these in plain words so there is no judgment call at the keyboard.
- Who should own the AI usage policy?
One named person, usually the COO, CFO, or head of operations, with IT and legal consulted. The owner approves exceptions, keeps the approved-tool list current, and reviews the page every quarter. A committee can advise, but a single owner is what keeps the document alive.
- How often should the policy change?
Review it quarterly and update it whenever you approve a new tool or a new use. Keep the page at one page. If it grows past that, move detail into a separate procedure document and keep the policy itself short enough that every employee reads it.
Want the policy, the tool review and the rollout done in three weeks?
The AI Clarity Sprint gives mid-market companies, law firms, wealth managers and insurance agencies a usage policy, an approved-tool list and a 90-day plan.