Over the past few weeks, we’ve talked about a lot of issues surrounding AI. What information are you giving it? Can you rely on what it creates? Who owns AI-generated work? How are your employees, contractors, and vendors using it?
At some point, all those questions lead to one fairly obvious conclusion:
Your business likely needs some rules for AI.
Please don’t interpret that as “Cheri thinks I need another giant policy.” I don’t. For most small businesses, AI rules can be surprisingly simple.
Start With the AI Tools You Actually Use
You don’t need a policy governing every conceivable form of artificial intelligence.
Start with your actual business and the tools you already use.
Maybe you use ChatGPT to brainstorm and draft content. Your VA uses an AI writing assistant. Zoom offers AI meeting summaries. Your email platform has added AI features. Make a list of whatever it is that you and your employees/contractors have in play.
Then decide whether you’re comfortable with those tools and the way they’re being used.
Define What Information Is Off Limits
This may be the single most important rule.
What information should never be entered into an AI system unless the tool has specifically been approved for handling it?
Depending on your business, that might include:
- Client or customer confidential information
- Personal identifying information
- Financial information
- Health information
- Employee records
- Passwords and security credentials
- Trade secrets
- Proprietary business information
Your exact list will depend on what your business does. The point is to spell it out before someone copies and pastes something they shouldn’t.
Decide What Requires Human Review
Next, decide what AI can help create and what degree of review is required before anyone relies upon the AI-generated output or sends it into the world.
- Marketing content should be checked for accuracy.
- Legal, tax, medical, financial, and other consequential information should be independently verified.
- Customer communications should accurately reflect your business’s policies and promises.
Important decisions about people shouldn’t simply be handed over to an algorithm. While AI can do a lot of the work, a human still needs to own the result.
Determine When AI Use Should Be Disclosed
There are situations where the fact that AI is being used matters. Recording or transcribing a meeting is an obvious example. People should know that their conversation is being captured. Especially in states where party consent is required for recording. If a client is specifically paying for original creative work, the use of generative AI may also be something the parties need to address.
There simply isn’t a single disclosure rule that applies to every use of AI. That’s precisely why your business should determine when disclosure is appropriate rather than leaving every employee or contractor to make that judgment independently.
Designate Who May Add New AI Tools
This one matters more as your business grows. Can an employee connect any AI application she wants to your Google Drive? Is it okay if your VA authorizes an AI application to access your email? Should your contractor be allowed to upload your client database into a new AI analysis platform?
Maybe.
But someone should make that decision intentionally.
Before approving an AI tool, look at what information it collects, what it can access, how information is stored, whether information is used for model training, what security protections are provided, and whether you can delete your information when you’re finished.
You don’t need to become a cybersecurity expert. You do need to make an assessment before you connect.
Draft an AI Acceptable Use Policy
Even a very small business can benefit from a written AI policy. And no, it doesn’t need to be a 37-page “Artificial Intelligence Governance Framework.”
A useful small-business AI policy can answer a handful of practical questions:
- Which AI tools can we utilize?
- What information can’t we give them?
- When is human review required?
- What decisions cannot be delegated to AI?
- When must AI use be disclosed?
- Who approves new AI tools?
If you work alone, these are operating rules for yourself. But if you have employees, these rules establish clear expectations. And if you work with independent contractors, relevant requirements can be incorporated into your contracts.
AI Doesn’t Need to Be Scary to Need Guardrails
Businesses have done this with technology for a long time. We have password rules because we use computers. Companies dictate privacy policies because we collect personal information. Our document retention policies exist because our businesses create records.
Having rules around AI doesn’t mean AI is uniquely frightening. It means it has become a sufficiently normal part of doing business that it’s time to stop treating its use as completely informal.
Use AI.
Experiment with it. Let it save you time. Use it to help you brainstorm.
But decide in advance what your boundaries are.
Good technology doesn’t replace good business judgment.
©2025 Cheri D. Andrews, Esq. This material is informational only and does not constitute legal advice. This material does not create an attorney-client relationship between Cheri D. Andrew, Esq and the reader. Recipient should consult with counsel before taking any actions based on the information contained within this material.
