How to write an AI policy for a 20-person company

1 of 5

What should the policy cover?
Focus on the few rules your team will actually use every week
A small company does not need a 40-page policy: it needs clear decisions in the right areas.
Approved tools: List which AI apps are allowed, who may buy them, and what integrations need approval.
Restricted data: Define what may never be entered, uploaded, or shared, including private customer, employee, financial, and internal information.
Review & disclosure: Say when a human must review AI-assisted work and when the use of AI should be disclosed internally or to clients.
If the team knows which tools, which data, and which outputs need review, the policy is already doing its job.

Who should own the policy?
Clear ownership keeps a small company fast and accountable
Even in a 20-person company, policy works best when everyone knows their role.
Policy owner: Choose one person to maintain the policy, approve new tools, and answer team questions.
Managers: Team leads decide where AI helps, where human review is required, and how the rules apply in daily work.
Employees: Staff follow the rules, avoid unapproved tools, and flag risky prompts, outputs, or data use.
Ownership does not mean bureaucracy: it means there is always someone responsible.

What rules should go in it?
Keep the everyday rules short enough for people to remember
The best AI policies turn common risks into simple daily habits.
Verify important outputs: Never send contracts, pricing, hiring language, customer commitments, or financial summaries without human review.
Protect confidential info: Use approved tools, remove sensitive details when possible, and do not paste private data into public systems.
Save & report issues: Keep useful records when needed and report hallucinations, unsafe outputs, or policy violations quickly.
Simple rules are more likely to be followed than a policy nobody reads.

Small business takeaways
Start small, stay practical, and update the rules as you grow
A 20-person company does not need a perfect AI policy on day one: it needs a usable one.
Write for real work: Base the policy on how your team actually uses AI, not on generic filler.
Pick an owner: Choose one person to manage approvals, updates, and policy questions.
Review high-risk uses: Keep humans involved when money, customers, legal exposure, or reputation are on the line.
Update it regularly: Revisit the policy when tools, workflows, vendors, or regulations change.
A strong small-business AI policy keeps your team helpful, fast, and responsible.

Lesson done.

Up next

Recording calls with AI: what do you have to tell people?

Where does this fit your business? Get your AI plan

Swipe to see each slide.

The short answer

An AI policy is a short set of rules for how your team uses AI safely: which tools are approved, what data must never be pasted in, when a person must review the output, and who owns the policy. For a 20-person company, keep it to a few rules people will use, and update it as tools change.

Three things to remember

01Cover three things: approved tools, data that must never go in, and when a human must review the output.
02Name one policy owner, and keep the rules short enough that people remember them.
03Never send contracts, pricing, hiring language or customer commitments without human review.

Every slide, in words

01
How to write an AI policy for a 20-person company
Keep it clear, practical, and easy for a small team to follow
An AI policy is a simple set of rules for how your team uses AI safely, consistently, and responsibly.
Set the ground rules: Define what AI tools employees may use, what work they may help with, and what still needs human judgment.
Protect data & trust: Spell out what information must never be pasted into AI tools, including customer data, financial details, and sensitive internal files.
Assign responsibility: Make it clear who approves tools, who reviews high-risk outputs, and who owns the policy as the company grows.
A good AI policy helps a small company use AI with confidence, not confusion.
02
What should the policy cover?
Focus on the few rules your team will actually use every week
A small company does not need a 40-page policy: it needs clear decisions in the right areas.
Approved tools: List which AI apps are allowed, who may buy them, and what integrations need approval.
Restricted data: Define what may never be entered, uploaded, or shared, including private customer, employee, financial, and internal information.
Review & disclosure: Say when a human must review AI-assisted work and when the use of AI should be disclosed internally or to clients.
If the team knows which tools, which data, and which outputs need review, the policy is already doing its job.
03
Who should own the policy?
Clear ownership keeps a small company fast and accountable
Even in a 20-person company, policy works best when everyone knows their role.
Policy owner: Choose one person to maintain the policy, approve new tools, and answer team questions.
Managers: Team leads decide where AI helps, where human review is required, and how the rules apply in daily work.
Employees: Staff follow the rules, avoid unapproved tools, and flag risky prompts, outputs, or data use.
Ownership does not mean bureaucracy: it means there is always someone responsible.
04
What rules should go in it?
Keep the everyday rules short enough for people to remember
The best AI policies turn common risks into simple daily habits.
Verify important outputs: Never send contracts, pricing, hiring language, customer commitments, or financial summaries without human review.
Protect confidential info: Use approved tools, remove sensitive details when possible, and do not paste private data into public systems.
Save & report issues: Keep useful records when needed and report hallucinations, unsafe outputs, or policy violations quickly.
Simple rules are more likely to be followed than a policy nobody reads.
05
Small business takeaways
Start small, stay practical, and update the rules as you grow
A 20-person company does not need a perfect AI policy on day one: it needs a usable one.
Write for real work: Base the policy on how your team actually uses AI, not on generic filler.
Pick an owner: Choose one person to manage approvals, updates, and policy questions.
Review high-risk uses: Keep humans involved when money, customers, legal exposure, or reputation are on the line.
Update it regularly: Revisit the policy when tools, workflows, vendors, or regulations change.
A strong small-business AI policy keeps your team helpful, fast, and responsible.

More in part 3

Next step

Where does this fit your business?

Six quick questions about your business, then your AI plan: what to start with, what a person still checks, and the lessons that go with it. Or bring it straight to a free thirty-minute call.

Get your AI plan Book a free call