Here is a question worth asking at your next team meeting: who here has used ChatGPT or a similar tool for work this month? In most small businesses we talk to, the honest answer is more people than the owner expected.
That is not a bad thing. People reach for AI because it helps them write the email, tidy the quote or summarise the long document. The risk is not that staff are using it. The risk is that nobody has said what is okay and what is not, so everyone is quietly guessing.
A short, plain-English AI policy fixes that. One page, written in your own words, is usually enough to start.
Why a policy helps rather than slows you down
Without any guidance, small teams tend to drift into one of two places. Either people avoid AI entirely because they are not sure it is allowed, or they use it for everything, including pasting in things that should never leave the business.
A clear policy gives people permission and boundaries at the same time. It tells your team, "Yes, use these tools, and here is how to do it safely."
What to put on the page
Keep it to five short sections.
1. Which tools are approved. Name them. If you pay for a business plan of a particular tool, say that is the one to use. Free personal accounts often have different data settings, so it is worth being specific.
2. What never goes into an AI tool. This is the most important section. A sensible starting list:
- Customer names, phone numbers, emails and addresses
- Financial details, bank details or anything from your accounting software
- Health, tenancy or other sensitive personal information
- Passwords, login details or internal system access
- Anything a customer gave you in confidence
If staff need AI help with a customer email, they can remove the identifying details first and add them back afterwards.
3. A human checks before anything goes out. AI tools can sound confident and still be wrong. Anything sent to a customer, posted publicly or used to make a decision gets read by a person first. That person owns the result, not the tool.
4. Be honest about AI use where it matters. You do not need to label every internal summary. But if a customer asks, or if AI is talking to customers directly, be upfront about it.
5. Who to ask. Name one person who answers "is this okay?" questions. In a small business that is often the owner or office manager. Make it easy to ask, so people ask rather than guess.
Check your privacy obligations
Depending on the size and type of your business, the Australian Privacy Principles may apply to how you handle personal information, and the Office of the Australian Information Commissioner publishes guidance on using AI products. If you are not sure where you stand, it is worth a conversation with your adviser. Our plain-English privacy checklist covers the questions we ask before connecting anything to customer data.
What a policy will not do
A policy is a starting point, not a safety net. It will not stop every mistake, and a page nobody reads is just paperwork. Walk through it with the team and revisit it every few months as tools change.
It also does not replace proper setup. If AI is going to touch your customer data or run part of a process, the system itself needs the right controls built in. That is the gap we wrote about in the hidden risks of DIY AI.
A simple way to start this week
Draft the five sections in a shared document, ask two team members what they actually use AI for, and adjust the list to match reality. Then share it, and ask everyone to tell you what is unclear.
If you would like help working out where AI is genuinely useful in your business, and where the risks sit, that is exactly what an AI Opportunity Audit covers.
At Cloud Inn we design, build and run practical AI systems for local businesses without an IT department, on fixed fees and with a human in the loop. If you want a second opinion on how your team is using AI today, book a 30-minute call and we will give you an honest read.