How to write a one-page AI policy for your Ohio business in an afternoon
A fill-in outline covering the three sections every version needs, plus your realistic options for getting it done: yourself, a peer, a consultant, or an AI tool.
- One page is enough: what data never goes in, which tools are approved, who to ask
- An owner can write it in one afternoon using a short outline
- Four realistic ways to get it done: DIY, a peer, a consultant, an AI drafting tool
- Review it every few months, and revisit it the day after it is written
An employee pastes a customer's name, phone number and billing question into a public chatbot to save ten minutes. The owner finds out later, usually by accident, and realizes the company never wrote down any ground rules. Nobody broke a rule, because there was no rule to break. If that moment has happened in your shop, clinic or office, the fix is smaller than you think.
A one-page AI policy is a short document that says what data never goes into AI tools, which tools the company approves, and who staff should ask when they are unsure. You can write one this afternoon, without a lawyer, and it will cover the situations that actually come up in a small business.
What the policy has to cover
Every usable version, whatever the business, answers the same three questions. First, what data is off limits. This is the section that stops the billing-question paste. Second, which tools are approved. Staff will use something, so name the something. Third, who to ask. When someone is unsure whether a task is fine, they need one named person or role, not a policy document they have to interpret.
The off-limits list should be concrete and specific to your business. For a contractor it might be customer addresses and payment details. For a medical or wellness practice it is anything about a patient. For a restaurant it could be staff personal information and vendor pricing. Write the list in plain words your team already uses, not legal words. If a nineteen-year-old server can read a line and know what it means, the line works.
The approved-tools section does not need to be long. Two or three named tools is plenty for most small businesses. What matters is that staff know the difference between a tool the company has vetted and a random app they found on their phone. The who-to-ask section is one line: a role, an email, or a phone number, whichever your team will actually use.
The fill-in outline
Copy this outline into a document and fill in the blanks. It fits on one page. Write it the way you would explain it out loud, because that is how staff will read it.
- 01Name the policy and date it
Open with one line: what this is, and the date you wrote it.
- 02Fill in the never-goes-in list
List the specific data your business will not paste into AI tools: customer names with details, payment information, patient or client records, staff personal data.
- 03Name the approved tools
List the two or three AI tools staff may use, and say anything not on the list needs a quick check first.
- 04Name who to ask
One role or person, and how to reach them. When unsure, ask before pasting.
- 05Add what happens if someone slips
One line saying staff should report mistakes without fear, so problems surface fast.
- 06Add a review date
Pick a date three to six months out to reread it, and write it on the page.
- 07Read it aloud and cut
If any sentence needs a second read, shorten it. Then share it with the team.
Four ways to get it done
Writing it yourself is the fastest and cheapest route, and it has a real advantage: you know your business, so the off-limits list will match reality. The trade-off is that you will not catch every edge case, and you may miss something a second set of eyes would see. For most owner-led businesses, a self-written page beats a perfect policy that never gets written.
Copying a peer's approach is the second option. Ask another owner in your town or trade what their policy says. Local business groups and trade associations are good places to find one. The trade-off is that their business is not yours, so their off-limits list may protect the wrong things. Borrow the structure, then rewrite the contents for your own data.
Hiring a consultant gets you a document reviewed by someone who has written these before, and probably a conversation about risks you had not considered. The trade-off is cost and time, and the consultant still needs your input on what data your business actually handles. A consultant who does not ask you what your team does all day is not going to produce something your staff will follow.
Using an AI tool to draft it is the fourth option, and a reasonable one. Give the tool a clear description of your business and what data you handle, then ask for a one-page policy in the three sections above. The trade-off is the same as with any AI output: it will sound plausible and may still include generic lines that do not fit your business. Read every line, cut what does not apply, and fill in the specifics only you know.
A middle path
There is also a hybrid: draft it yourself, then get outside help reviewing it. Ohio AI Lab, an Ohio company that works with owner-led businesses across the state, starts with a free 25-minute fit call on Zoom. Their team runs their own companies on AI and works with owners on exactly this kind of practical ground rule. If you want a second set of eyes on your one-pager, that call is one way to get it.
The day after
A policy nobody has read is a page, not a policy. The day after you write it, walk your team through it in ten minutes. Read the off-limits list out loud, name the approved tools, and say who to ask. Then put it where the work happens: pinned in the group chat, taped near the register, or linked in the shared drive. Revisit it on the review date you wrote on the page.
