A policy is not a document. It is a decision about who is accountable, written down so it survives the person who made it. Most small companies skip it because “policy” sounds like enterprise overhead, and then learn the hard way that the absence of a policy is itself a policy: it just means everyone improvises. They already are. In one 2026 survey, 49 percent of employees said they use AI tools their employer never sanctioned (BlackFog, self-reported, so read it as a signal of scale rather than a precise count). A ban does not stop that; it drives it into private accounts where you cannot see it. What follows is the opposite of a ban: a short outline that channels AI use into the open, marked up so you can see why each line is there and which rule it answers to. Copy the specimens, change the bracketed parts, and you have a first draft.
Purpose and scope
Purpose. This policy governs how [Company] uses AI tools in its work. It applies to every employee and contractor, on any device, when acting for [Company]. It exists to let us use AI safely and openly, not to forbid it.
Why it leads. State the intent in the first line, because a policy read as a prohibition gets routed around. Naming the scope (everyone, any device) closes the “but I used my personal account” gap that makes shadow AI invisible. This is the framing the rest of the document depends on: you are sanctioning use under conditions, not policing it.
Approved tools and data boundaries
Approved tools. Use only AI tools on the approved list ([link]). To add one, ask [owner]. Data rule. Never paste customer personal information, credentials, financial records, or confidential business data into a tool that is not on the approved list and covered by a written agreement.
Why it is the load-bearing clause. The real risk is rarely the model. It is data leaving your control and your obligations going with it. Under Canada’s PIPEDA, the Office of the Privacy Commissioner is explicit that organizations must be transparent about how personal information is used and obtain meaningful consent, which you cannot promise once that data is sitting in an unvetted vendor’s logs. The approved-list mechanism turns a vague “be careful” into a checkable rule, and the written-agreement requirement is what keeps a free tool’s training-on-your-data terms from quietly becoming your problem.
Human oversight and accountability
Human in the loop. A named human reviews and is responsible for any AI output that goes to a customer, makes a consequential decision, or commits [Company] to anything. AI drafts; a person signs. Owner. [Name/role] owns this policy and approves new tools and use cases.
Why both halves matter. Oversight without ownership evaporates. NIST’s AI Risk Management Framework names accountability as a core governance function: structures should make specific teams and individuals responsible and empowered to manage AI risk. The OECD’s AI Principles, which Canada and the US both endorse, call for a preserved capacity for human agency and oversight, especially for uses that drift outside what the tool was meant for. Translated for a ten-person company, that is one sentence: name a person, and keep a human between the model and anything that matters.
Disclosure and transparency
Tell people. When a customer is interacting with an AI system rather than a person, or receiving content materially generated by AI, say so plainly. Do not use AI to impersonate a real, named individual.
Why it is moving from courtesy to requirement. The European Union’s AI Act, Article 50, requires that people be informed when they are interacting with an AI system unless it is obvious, and that AI-generated or manipulated content be disclosed; those transparency duties apply from August 2, 2026, and they reach any provider serving the EU market. Even where no statute binds you yet, the disclosure expectation is arriving ahead of the law, and getting in front of it is cheap insurance against a trust problem later. And if AI writes your outreach, the old rules still apply unchanged. Canada’s anti-spam law requires consent, identification, and a working unsubscribe in every commercial message, no matter what drafted it. The tool is new; the duty to not deceive is not.
Compliance and record-keeping
Know what applies. [Owner] maintains a short list of the laws and standards that apply to our AI use and where each one bites. Keep the paper. For any AI system that makes a consequential decision about a person, record what it does, what data it uses, and who reviewed it.
Why the boring part is the durable part. Statutes shift and stall, but the duty to document has quietly become the stable layer underneath (the case the compliance-shaped hole makes at length). NIST’s framework puts it at the top of governance: legal and regulatory requirements involving AI should be understood, managed, and documented. The record is not for an auditor you will never meet. It is what lets you answer “what does this system do and who is responsible” without a fire drill, which is the question every regulator, customer, and incident eventually asks.
Keep it alive
Review. [Owner] reviews this policy every quarter and whenever a major tool or law changes. Version and date each revision.
Why a policy that is not reviewed is worse than none. A stale policy gives false comfort: it reads as control while describing a world that moved on. ISO/IEC 42001, the first international standard for managing AI, is built on exactly this idea, that AI is governed as a living management system with a review cycle, not a one-time memo. You do not need the full standard. You need its habit. Put the review on a recurring calendar invite, attached to whoever owns this document, and let the date on the policy tell the truth about how current it is. The value was never the document. It is that someone owns it, and that it still describes what you actually do.