Does Your Small Business Need an AI Policy?

I ran a workshop for a group in Sylvania a few months back, and about ten minutes in a woman raised her hand and told me her office manager had been pasting client contracts into ChatGPT to summarize them. Nobody told her not to. Nobody told her to either. She just found it worked and started doing it, and it spread from her desk to two other people in the office before anyone upstairs even knew it was happening.

That's basically every small business I walk into right now. Someone finds a tool that saves them an hour a day, and it spreads through the office without anyone actually deciding it should. Nobody's being reckless. They just never had a reason to stop and think about it, because nobody ever brought it up.

The risk isn't really the AI

Most people picture the danger as the AI itself doing something malicious on its own. That's not really it. The risk is a person pasting a client's financials, someone's medical info, or a signed contract into a free tool without thinking about where that text goes after they hit enter. A lot of free tools use what you type to train future versions. Once it's in there, you don't get it back.

I'm not telling people to stop using AI. I use it every day and it's a real edge for a small business. I'm telling them to know what's safe to type in and what isn't, and right now almost nobody in Toledo has actually written that down anywhere.

"We're only five people, do we really need this?"

I get this question at almost every session I run, and the answer is yes, but it doesn't need to be complicated. It takes one person pasting the wrong thing into the wrong tool to create a real problem, whether you've got five employees or five hundred. What I have small businesses write down usually fits on one page. 1: which tools are approved and which ones aren't. 2: what never goes into any AI tool, client names, financials, anything under an NDA. 3: who to ask when someone finds a new tool they want to try. 4: what happens if someone slips up, because someone will, and it shouldn't be a firing offense the first time it happens.

That's it. You're not writing a legal document. You're writing something your team will actually read, because the version nobody reads protects nobody.

You can do this in an afternoon

Sit down with whoever runs day to day operations, walk through what your team actually uses AI for right now (you'll probably find out it's more than you think), and put those four points on paper. Send it in an email, pin it in whatever chat tool you use, bring it up at your next team meeting. The goal isn't a binder on a shelf. It's four sentences that live in people's heads.

Where I usually get called in is after that first pass, when a business owner realizes their team has questions the one-pager doesn't answer, or when they want someone to actually sit with the team and walk through it instead of just emailing a PDF and hoping it gets read. Both are fine ways to get there. Just don't skip it because you think you're too small to be a target. Every business with a computer and an employee is a target.