One page on AI at work: the policy a ten-person company actually needs
Most of your staff already use AI at work, many on personal accounts. The six decisions a small company makes (which accounts, what never goes in, a person checks what leaves, code, what customers are told, new tools and mistakes), a one-page policy to copy, and how to roll it out in a thirty-minute meeting and review it twice a year.
If you run a company of ten people, some of them are already using AI at work, and probably not on an account you pay for. Microsoft and LinkedIn's 2024 survey of 31,000 people found that 75% of knowledge workers used AI at work and 78% of those brought their own tools. That is the polite name for a free chatbot account on a personal email, with your customer's spreadsheet pasted into it.
Large companies answer this with a twenty-page policy that nobody reads. A small one usually answers with nothing. What actually works at ten people is one page: short enough to read in five minutes, specific enough to settle the questions staff really have, and reviewed twice a year because the tools change that fast. Below are the decisions behind the page, a template you can copy, and how to roll it out in one meeting.
Why not just ban it
In May 2023, Samsung banned generative AI tools on company devices after engineers pasted internal source code into ChatGPT. A large company can enforce that, at least on its own network. A small one can't: the ban moves the use to personal phones, where you can see even less. It also throws away the gains your competitors are getting. The useful question is not whether staff use AI, but on which accounts, with which data, and who checks the result.
The six decisions behind the page
1. Which tools, on which accounts. The single most useful rule. Consumer chatbot accounts can be used to train the vendor's models: Anthropic changed its consumer terms in 2025 so that chats on Claude Free, Pro and Max may be used for training if the user allows it (with retention extended to five years), and ChatGPT's consumer plans have a similar "improve the model for everyone" setting. Business and team plans from the same vendors are covered by commercial terms that do not train on your content by default, and they give you an admin console, so you can remove someone's access on the day they leave. For a small company the rule is: work goes on company accounts, on a business plan, signed in with the company email. Name the approved tools on the page.
2. What never goes in. Even on a business plan, some data should stay out unless you have checked the contract and the customer's own terms: passwords, API keys and other secrets; customer personal data beyond what a task needs; health, payment card and bank details; anything under a non-disclosure agreement that forbids sharing with third parties; staff HR matters. Write these as a short list with examples from your own business, not as categories from a law textbook.
3. A person checks anything that leaves the building. AI drafts, a person signs. In 2023 two New York lawyers were fined $5,000 for filing a brief with court cases ChatGPT had invented (Mata v. Avianca). Your version is smaller (a wrong price in a customer email, a made-up feature in a proposal), but the rule is the same: whoever sends it owns it.
4. Code. If anyone writes code, say which coding assistants are allowed, that generated code goes through the same review as any other (we wrote about who reads the AI's code), and that secrets and customer data stay out of prompts. If you build AI features that read customer email or documents, that is a separate risk, covered in prompt injection tests a small vendor runs before shipping.
5. What you tell customers. Decide once: if AI writes a meaningful part of what customers receive, or talks to them directly (a chat widget, a phone agent), you say so. In the EU it is becoming a legal duty: the AI Act's rules on telling people they are dealing with AI apply from August 2026, and its AI literacy rule (staff who use AI should understand it well enough) has applied since February 2025. We summarised both in the EU AI Act for a small software vendor. Outside the EU it is simply what customers expect.
6. New tools and mistakes. One named person approves new AI tools, after checking two things: is there a business plan, and does it train on your data. And one sentence on mistakes: if someone pasted something they shouldn't have, they tell that person the same day, without blame, so you can delete the chat and, if needed, tell the customer. A policy that punishes reporting gets no reports.
Work goes on company accounts. A person checks anything that leaves the building. Tell someone the same day if something went where it shouldn't.
The page
Copy this, replace the brackets with your own tools, names and examples, and cut anything that does not apply. It should still fit on one printed page.
Rolling it out in one meeting
Thirty minutes is enough. Hand out the page, read it together, and answer the questions people actually have: "can I use it to rewrite my emails?" (yes, on the company account), "can I upload the client's contract to summarise it?" (check the NDA, then yes on the company account), "what about the free version on my phone?" (not for work). Then do two practical things in the same meeting: everyone signs in to the company accounts, and anyone who used a personal account for work turns off model training in its settings and deletes chats that held customer data.
The money side is modest: business plans for chat assistants cost roughly what a mid-range SaaS seat does, per person per month. For ten people that is a few hundred dollars a month, which is usually less than the time it saves in the first week, and less than one awkward phone call to a customer about where their data went.
Review it twice a year
Tools, plans and terms change every few months: vendors add features, change what they train on, rename plans. Put the review date on the page and keep it. Each time, ask four questions: which tools are people actually using now, did any vendor change its terms, did anything go wrong, and is anything on the page being ignored (which usually means the rule is wrong, not the people). The broader picture of how companies are using AI and what they get back is in how businesses are coping with AI in 2026.
Make your own page: tick the AI tools you allow, the data that stays out, who approves new tools and when you review it, and get a one-page policy in plain words to copy or print. Free, in your browser; nothing you type leaves it.
Open the AI use policy builderSources
Microsoft, Microsoft and LinkedIn release the 2024 Work Trend Index on the state of AI at work (75% of knowledge workers use AI at work, 78% of AI users bring their own tools); CSO Online, Samsung bans staff AI use over data leak concerns (May 2023); Anthropic, Updates to our consumer terms (2025; Free, Pro and Max chats used for training if the user allows, five-year retention, commercial and API accounts excluded); OpenAI, Enterprise privacy (business plans not used for training by default); ABA Journal, Lawyers who 'doubled down' and defended ChatGPT's fake cases must pay $5K, judge says (Mata v. Avianca, 22 June 2023, $5,000); European Commission, AI Act (AI literacy from 2 February 2025, transparency duties from 2 August 2026). Pages read on 17 October 2026. The template is our own and is not legal advice; check the terms of the plans you choose.