A One-Page AI Policy for a Small Business: What Your Team May and May Not Paste Into a Chatbot

⏱ 7 min read|Published 19 October 2026|By Dibyendu Choudhury

In most small businesses I visit, somebody is already using an AI chatbot. The accountant uses it to draft a reply to a customer. The marketing person uses it to rewrite a brochure. The owner uses it to understand a notice from an authority. Nobody decided this. It simply began, because the tools are free or cheap, they are fast, and they are usually quite helpful. What almost no one has done is write down what is allowed.

That gap is where the trouble comes from. I do not think the answer is to ban these tools, which would be unrealistic and would also throw away real gains in time. I think the answer is a short written rule that a new employee can read in two minutes. This note offers the shape of such a rule, in the form of questions every owner should answer for their own business, and a template you can adapt in an afternoon.

Three things that go wrong without a rule

The first is leakage. When a person pastes a customer list, a contract or a salary sheet into an online AI tool to get a summary, that text leaves the company's control. Depending on the tool and the plan, it may be stored, may be reviewed by the provider's staff for safety, or may be used to improve the service. The paid business plans of most major providers say they do not train on your data by default, and the free consumer versions often work differently, so the same sentence typed into two versions of the same product can have two different outcomes. You should read the terms of whatever your team actually uses, because I cannot tell you from here what each plan does today.

The second is error. These tools produce fluent text that is sometimes wrong, including wrong in confident ways: a section number that does not exist, a rate that was true years ago, a case that was never decided. A person who does not know the subject cannot spot these, and a person in a hurry will not look. The cost lands on the business, not on the tool.

The third is invisibility. If nobody records where AI is used, nobody can answer a customer who asks whether a document was written by a person, nobody can learn which uses save time and which cause rework, and nobody can find the source of a mistake after the fact. A rule without a record is a rule you cannot check.

The five parts of a one-page policy

I suggest five short parts, each of which fits in a paragraph. Write them in plain words, not legal ones, because a policy that people cannot easily read is a policy that people do not follow.

The first part says which tools are approved. Name them. If the business has decided on one paid assistant for general writing and one for spreadsheets, list those, and state that anything else needs a word with the owner first. This is not about control for its own sake. It is about knowing which terms of service you have actually read.

The second part says what must never be pasted. A workable list includes customer personal details such as phone numbers, addresses and Aadhaar or PAN numbers; bank account and card information; passwords and access keys; unpublished financial results; contracts under confidentiality; and any employee records. A simple test helps: if it would hurt to see this text on a stranger's screen, it does not go into a chatbot. If a task genuinely needs the substance of a sensitive document, remove the names and numbers first, and replace them with labels such as Customer A and Amount X.

The third part says who checks the output. For anything that leaves the building, whether a customer reply, a quotation or a notice, a named human reads every line and takes responsibility for it. For anything involving a legal section, a tax rate or a regulatory deadline, the person checks the figure against the original source, not against a second chatbot. I would write this as a single sentence: the tool drafts, the person decides.

The fourth part says how use is recorded. This can be as simple as a shared sheet with four columns: date, person, purpose and whether the output was used as it came, edited, or discarded. It takes thirty seconds per entry, and after a quarter it tells you where the tools are paying their way.

The fifth part says when the rule is reviewed. Tools and their terms change quickly, and a policy written in October can be out of date by January. Put a review in the calendar every quarter, assign it to one person, and keep the old versions so that you can show what the rule said at any past date.

A worked example, a composite and not a real firm

Imagine a made-up firm of fourteen people that makes industrial fasteners and sells to dealers across three states. The sales coordinator, a diligent young woman, has started pasting dealer enquiry emails into a free chatbot to draft replies. The emails contain the dealers' names, phone numbers and the prices the firm quoted them. On a busy day she also pastes a price list marked for internal use only, to ask the tool for a clean table.

None of this was malicious, and the results were useful: replies went out faster and read better. But the owner, on learning of it, faced three questions. Had the quoted prices left the company? Could he say which dealers' details had been entered? And if a reply had contained a wrong figure, would anyone have noticed before the dealer did?

The one-page policy answers these in advance. The firm approves a single paid business assistant whose terms the owner has read. Dealer names and phone numbers are replaced with labels before pasting, and the internal price list is never pasted at all. The coordinator reads every reply before it goes and checks every figure against the live price list. A shared sheet records each use. A year later, when a dealer asks whether the firm uses AI to answer enquiries, the owner can answer truthfully, and show how it is controlled.

What good looks like for the people using it

A policy only works if the team trusts that it is there to help them. Introduce it in a short meeting, not an email. Say plainly that the tools are welcome and that the aim is to keep everyone safe, including the person who might otherwise make an honest mistake on a hurried afternoon. Invite people to say what they actually use these tools for, because you will learn uses you had not imagined, some of which will deserve to be spread across the team.

Make it easy to ask. If someone is unsure whether a document is safe to paste, there should be one named person they can ask in a minute, and the answer should never come with a lecture. A team that fears blame will hide its use, and hidden use is the one situation a policy cannot manage.

Beyond the one page

As you use these tools more, you will meet questions that a single page cannot settle: how to handle personal data under the Digital Personal Data Protection Act, 2023, when to inform customers that AI was involved, what your insurer expects, and how to treat tools built into software you already pay for. Take these one at a time, and take professional advice for the legal ones. The one-page policy is a floor, not a ceiling. Its job is to get you from no rule to a clear and workable rule this week, without waiting for a perfect one.

The old advice about tools is that a good craftsman knows both what a tool can do and what it should not be asked to do. A chisel is wonderful and has no business near a loaf of bread. These assistants are a remarkable instrument for drafting and thinking aloud, and a poor place to keep a secret or to find a fact you cannot check. Teach your team the second half as carefully as the first.

This week, write the five parts in your own words, keep them to a single page, and read them aloud to your team. If you would like more practical notes of this kind, you will find them on the blog index. If there is an AI question in your own unit that you would like me to take up, tell me and I will write about it.

Published 19 October 2026 · dibyenduchoudhury.com