How to Write an AI Use Policy for Your Small Business (and Why You Should Have One)

Updated October 18, 2026: We clarified, with sources, when telling customers about AI use can be a legal requirement, and added published research on how people react when someone discloses AI use.

For most small businesses, an AI use policy is not mainly a compliance document you write to satisfy a regulator. It is a way of scaling your own judgment — turning the decisions you have already made (which tools, which tasks, how much oversight, what you tell customers) into a record your whole operation can act from consistently. Most small-business owners are already running an informal policy. The question is whether those decisions live in your head alone, or somewhere that actually holds you accountable.

Why bother — the case in one paragraph

Every week you make micro-decisions about AI: do I let it draft this email? Do I review this output before it goes out? Do I tell this client the proposal started as an AI draft? Those decisions add up to a practice whether you document them or not. Documenting them has two benefits: it stops you and your team from spending energy re-deciding the same questions, and it gives you a clear, honest answer when a customer asks. A written policy also sets the cultural norm for what the time AI saves is supposed to go toward — back into the relationship (the follow-up call, the personalized detail), not just into more output volume.

The three sections every good policy has

You do not need a legal team or a template service to write this. Three sections cover everything a small business needs.

1. What we use AI for

This is the specific, approved list: the tasks and the tools. Not "writing assistance" in the abstract — that is vague enough to mean anything and commit to nothing. Be concrete: "First-pass drafts of common customer inquiries (Claude)" or "Social caption variations from an approved brief (ChatGPT)" or "Summarizing meeting transcripts into action items (ChatGPT)." Name each tool precisely, even the ones you would not think to mention to a customer — that specificity is what makes the section useful.

This section also tells new collaborators what is already in use — without a conversation. The policy does the onboarding.

2. What stays human

Every business that uses AI thoughtfully has work it does not hand to a tool — judgment calls that require real context, relationships where the human touch is the product, decisions that are hard to reverse, accountability that has to sit with a named person. For most service businesses that means: final decisions on pricing, conversations involving real complaints or conflict, and client-facing communication in emotionally sensitive situations. The point is not to be exhaustive — it is to be honest about where AI is not in the loop, and why.

3. How we stay accountable

This section has three parts: oversight (who reviews AI output before it reaches a customer, and how), transparency (how and when you disclose AI use), and consequence (what you do when something goes wrong).

On oversight: the practical standard for most small businesses is that any AI-generated content that leaves the building gets a human read first. Writing it down gives you a standard you can check yourself against.

On transparency: a simple, honest disclosure is usually enough, unless a law or platform rule in your industry asks for more. Something like "parts of this were drafted with AI assistance" in a footer, or "our first response is AI-assisted — a team member is available if you need them" in a chat window. Disclosure is not free: in 13 experiments in which participants judged people and organizations, from supervisors and professors to creatives and investment funds, those who disclosed their AI use were trusted less than those who did not. Trust fell even further, though, when someone else exposed the AI use (Schilke & Reimann, Organizational Behavior and Human Decision Processes, 2025). That is one argument for disclosing on your own terms instead of waiting to be found out. In those experiments, framing the disclosure differently did not remove the trust penalty, so keep it plain: say what a person still reviews and offer a clear path to a human.

On the law: as of October 2026 there is no general US federal rule requiring a small business to label all AI-assisted work, but some laws do apply. California bans using a bot to interact online with people in California while hiding that it is a bot, with the aim of knowingly deceiving them to drive a sale or influence a vote; clearly disclosing that it is a bot avoids liability under that law (Cal. Bus. & Prof. Code §17941, in force since July 1, 2019). In Utah, a business that uses generative AI to interact with a consumer in a transaction must say so when the consumer clearly asks whether they are dealing with AI, and licensed professionals must prominently disclose it in high-risk interactions, such as those that collect sensitive health or financial data to give personalized advice (Utah SB 226, 2025, summary by the Future of Privacy Forum). In the EU, Article 50 of the AI Act has applied since August 2, 2026. Among other things, it requires that people be told when they are interacting with an AI system, such as a chatbot, unless that is obvious, and that deepfakes be labeled, as well as AI-generated text published to inform the public on matters of public interest, unless a person reviewed it and holds editorial responsibility (AI Act, Art. 50). A July 2026 amendment gives providers of generative AI systems that were already on the market before August 2, 2026 until December 2, 2026 to mark their outputs in a machine-readable format (Regulation (EU) 2026/1744). And in September 2024, then-FTC Chair Lina Khan said that "there is no AI exemption from the laws on the books" (FTC, Sept. 25, 2024). Laws vary by state and country; check with an attorney if you use chatbots with customers, work in a licensed profession, or serve EU customers. This is a plain-language summary, not legal advice.

Gugubrand publishes its own AI use policy, organized in the same three sections described here: what we use AI for, what stays human, and how we stay accountable. You can read it as one example of how a small service business states its AI use.

On consequences: what is your process when AI output contains an error, or a customer objects to AI use they did not know about? Having a sentence on this is not pessimism — it is the difference between a policy and a wish list.

How to write yours — the four-step process

Reading about the framework is not the same as having a policy. Here is how to actually get there.

Step 1 — Reflect first. Before opening any AI tool, answer three questions in plain language: Which tasks do I confidently hand to AI — and with which specific tools? Which work will I always keep human, and why? What do my customers and team need to know? These notes are your raw material — more honest than anything a model will draft from a cold prompt.

Step 2 — Draft with AI using your notes. Paste your answers into the AI tool and ask it to organize them into the three sections. This is exactly the scaffolding task AI handles well. You will edit heavily.

Step 3 — Edit for truth and your own voice. Read every line: Is this actually true? Does this sound like how I run my business? Cut the aspirational, add what was missed. If a line says you always review outputs before they go out and that is not always true, change the practice or change the line.

Step 4 — Stress-test with one question. Imagine a customer asks, "Do you use AI?" Does your policy give you a clear, honest answer you could say out loud? If you hesitate, there is a gap. Keep the finished document to about one page.

Being the human in the loop

One thing worth saying plainly: being "the human in the loop" is not just about reviewing outputs before they ship. It is about deciding what problems AI should be solving in the first place.

AI handles the first-pass draft so you have more time to read it carefully and personalize it. AI handles the transcript summary so you can spend more time on what the client actually needs. The time it frees should go back into the human work — the handwritten note, the proactive check-in, the judgment call that requires knowing the customer. If AI is freeing up time that just fills with more AI output, the policy needs a section on that too.

The practical test is whether you can explain, in a sentence, what the AI is doing in any workflow. Not what model it is — but what the task is, and why you reviewed the result before it left your hands. If you can explain it, you are in the loop.

This approach draws on the AI Fluency Framework, developed by Prof. Rick Dakan (Ringling College of Art and Design) and Prof. Joseph Feller (University College Cork), with course materials produced together with Anthropic and released under a CC BY-NC-SA 4.0 license (framework summary, Anthropic, 2025).

For more on the framework behind deciding which tasks belong to AI and which stay human, see our post on the 4D framework for AI in your business.

What you can do today

1. 1Open a notes app and answer the three reflection questions: which tasks do you confidently hand to AI, which do you always keep human, and what do your customers need to know. Write in plain language, not policy language — that comes later.
2. 2Take those notes into an AI tool and ask it to draft a one-page policy organized into the three sections: what you use AI for, what stays human, and how you stay accountable. Edit every line for truth and voice before you save it.
3. 3Read Gugubrand's AI use policy as one example of how a small service business states its AI use — not to copy it, but to see what specific disclosure can look like.

Not sure which foundation needs attention before you put AI to work? Take the five-question check. It covers identity, strategy, content, website and systems, and promotion and improvement. If a foundation is missing, we propose a defined preparation scope before starting. No website is required.