Forbes ran a piece on July 19 with a headline that could have been written about almost every small business we talk to: small companies adopted AI faster than they wrote rules for it. That is not a criticism. It is what happens when a tool is useful, free to try, and requires no purchase order. Your bookkeeper started drafting client emails with it. Someone in sales pasted a proposal into a chatbot to tighten the language. Nobody asked, because nobody thought they had to.

The risk is not that your people are using AI. The risk is that you have no idea which tools, with what data, producing what that goes out under your name.

A ban is the one option that definitely fails

Companies that prohibit AI outright do not stop the usage — they push it onto personal phones and personal accounts, where you have no visibility and no contract governing the data. Every business we have seen try this ended up with more exposure, not less. If your team can do the work faster with a tool, they will use the tool.

Write the page that answers four questions

You do not need a policy binder. You need one page that answers: Which tools are approved, and who pays for them? What information may never be pasted into a general AI tool — client financials, employee records, anything under an NDA, anything with a social security number? What output requires a human to review and sign before it leaves the building? And who does someone ask when the page does not cover their situation?

That last one matters more than the other three. Most policies fail because they describe the obvious cases and go silent on the judgment calls. Name a person.

Approve the tools you are already using

Start by asking your team what they use now. You will get an honest answer if you make clear this is not a disciplinary exercise. Then pick the one or two you will pay for, on a business plan — business tiers generally come with data-handling terms consumer accounts do not, and give you an admin view. Retire the rest.

The honest caveat

A one-page policy does not make you compliant with anything specific. Colorado's AI Act, which takes effect January 1, 2027, and the EU transparency rules that begin applying August 2, 2026, have their own requirements, and whether they touch you depends on what decisions your AI is involved in and where you sell. A policy is the foundation you will need either way, not a substitute for checking.

The takeaway

Block ninety minutes this month. Ask what people are using, write the four answers, name the person to ask, and send it around. You will have closed the gap that most businesses your size are still ignoring.