I talk to small business owners every week. Almost none of them have an AI policy. Almost all of them have employees using ChatGPT, Claude, or Copilot on the clock.

Here's the problem: without a policy, your team is making judgment calls about what's OK to paste into AI tools. Customer names, financial data, proprietary processes — it's all going in.

Three things you can do today (no policy template needed):

1. Ask. Send a one-line message to your team: "What AI tools are you currently using for work?" No judgment — just visibility.

2. Draw one line. Pick the single most sensitive category of data in your business (client financials, medical records, trade secrets) and tell everyone: this never goes into an AI tool. One rule is better than zero.

3. Start documenting. Write down which tools people are using and for what tasks. This becomes your baseline when you build a real policy.

Most businesses don't need a 40-page AI governance document. They need three clear rules and a team that knows them.

I built the AI Policy Kit to make this dead simple for small teams — templates you can customize in 15 minutes, not consultant-speak you'll never read. If you're a contractor, I also have a COI Compliance Kit because I know that's another paperwork nightmare nobody has time for.

Either way — start with step 1 today. You'll be surprised what you learn.