How to write a usable AI policy for a small team
What a one page AI policy for a small team has to cover, what it cannot do for you and why a ban usually increases your data exposure.
Your team is already using these tools
Before the policy exists someone in your business has already pasted a client brief into a chat assistant on a personal account. That is the situation you are writing for. The question is not whether AI enters your work. It is whether it enters through accounts you can see and tools whose terms somebody has read.
A policy is useful here for one narrow reason. It converts a hundred private judgement calls into a few shared rules so that a junior person does not have to decide alone whether a salary sheet can go into a free tool. Anything longer than a page will not be read and therefore will not do that job.
What a policy costs and what it cannot do
A policy provides no security. It does not block an upload, it does not encrypt anything and it does not satisfy a client audit on its own. Treat it as a decision record and not as a control.
Writing one costs a couple of focused hours plus a review with whoever handles your client contracts. Paid templates and a legal read-through carry fees with GST at 18% on service fees. The ongoing cost is the part people forget. Someone has to answer the questions a policy generates and has to decide on new tools as staff find them. Without that named person the document ages into fiction within a quarter.
Who does not need one and who must not write their own
A sole trader or a two person business does not need a written policy. You need a habit about what you paste and a note of which tools hold your data. Writing a formal document for an audience of one is work that produces nothing.
At the other end, do not draft your own if you hold data under client contracts with security schedules or if you handle financial, health or government data. Those contracts usually already say what may be processed and where, and your policy cannot grant permissions the contract withholds. That drafting needs professional review rather than a template.
Also do not write one you will not enforce. An unenforced policy is worse than silence in a dispute because it shows the business identified the risk and then did nothing about it. If nobody will own it then do not publish it.
The four things a one page policy has to settle
First the approved tools. Name them. Say who pays and whether work accounts are mandatory, because consumer and business tiers of the same product often differ in whether your content can be used for training. Name the person who approves an addition and promise a quick answer.
Second the data that never goes in. Be concrete rather than categorical. Customer contact details, salary and performance records, unreleased pricing, client documents marked confidential, anything covered by an NDA, identity document scans. A list staff can picture beats the phrase sensitive information.
Third the work that always needs a human sign-off before it leaves the building. Anything a client or a regulator reads, anything with a figure in it, anything that commits the business. State plainly that accountability sits with the person who sends the output and not with the tool. Fourth a review date and a line on client disclosure so nobody has to improvise when a customer asks whether AI was used.
How to tell whether the policy is live
The metric that matters is whether people ask before using something new. One unprompted question a month from a staff member about a tool you had not heard of means the policy is functioning as a route rather than a wall. Silence usually means private usage and not compliance.
The flattering metric is signatures collected. A fully signed policy tells you the document was circulated and nothing more. The second flattering metric is the absence of incidents, which is indistinguishable from the absence of visibility.
The mistake that makes things worse
The common error is a blanket ban. It is the easiest thing to write and it reliably produces the outcome you were trying to avoid. Work still gets done with these tools because they save the individual real time. It simply moves to personal phones and personal logins where there is no business account, no record and no recourse if data is exposed.
A ban also costs you the discussion. Staff who cannot ask will not tell you when a tool gets something badly wrong and you lose the only early warning available. Permit a short list and keep the exclusions sharp. That is both safer and cheaper to run than prohibition.
The regulatory thread to keep in view
India has a statutory framework for digital personal data in the Digital Personal Data Protection Act of 2023. The mechanism worth understanding is where responsibility lands. Obligations attach to the business that decides why personal data is processed and they do not transfer to a tool vendor because the vendor processed it. Pasting customer data into a third party tool is a processing decision your business made.
Employment terms interact with this too, since a policy generally has effect through the contract or handbook rather than by announcement. Implementation detail and what applies to your sector change with notified rules and with your own contracts. A qualified professional should confirm the position for your situation before you rely on it.
This guide explains how something works. It is not legal, tax or financial advice, and rules change. Confirm anything regulatory with a qualified professional before you act on it.