AI policy for small business

Why write the policy before adding more AI

The problem is not that staff are curious about AI. The problem is that they may already be pasting customer emails, job notes, supplier quotes or internal spreadsheets into tools without knowing the risk. Australian guidance for small businesses highlights practical risks such as data leaks, privacy breaches, unreliable outputs and weak supplier controls. That does not mean you should ban AI; it means you need simple rules before it becomes normal work practice.

A useful small-business AI use policy is not a legal textbook. It is a short operating rule for everyday decisions: what staff can use AI for, what information is off limits, when a human must check the answer, and how issues are reported. Write the first version before you connect AI to customer enquiries, website chat, quoting, bookings or internal systems.

Sources: [1] [2]

Step 1: list every AI tool already being used

Start with a 30-minute stocktake. Ask your team what they are already using, including obvious AI tools and AI features inside email, documents, meeting apps, marketing software, customer systems and accounting tools. Owners often think the business has not adopted AI yet, but staff may be using it to rewrite emails, summarise notes, draft ads or clean up spreadsheet formulas.

Put the list into a simple AI register. For each tool, record the tool name, who uses it, what task it helps with, what information goes into it, whether customers are affected, and who owns the decision to keep using it. The purpose is not to create paperwork for its own sake. It is to make hidden AI use visible so you can manage privacy, accuracy, customer trust and supplier risk.

Sources: [2] [3]

Step 2: decide who can approve AI use

Next, nominate one accountable person. In a small business, that might be the owner, practice manager, operations manager or another senior person who understands the customer impact. This person does not need to be a programmer. Their job is to decide whether a tool fits the business, what data it may use, and what level of checking is needed before outputs are relied on.

Also decide who can approve new tools. A staff member should not sign up for a new AI tool with business data just because it has a free trial or looks handy. Before approval, check the vendor’s data handling, privacy and security practices, and whether the tool may use submitted information to train or improve its systems. If you cannot work out where sensitive information goes, treat that as a reason to pause.

Sources: [1] [2]

Step 3: sort business information into three data groups

The most important part of your AI use policy is the data rule. Sort your business information into three groups: safe to use, use only after removing identifying details, and never upload unless a specific approved process exists. This gives staff a clear decision tree instead of expecting them to understand every privacy and cyber risk on the spot.

Safe information might include your published service descriptions, public opening hours, general product categories and non-sensitive internal templates. Information that needs de-identifying might include a customer question rewritten without names, addresses, phone numbers, account numbers or unusual facts that identify the person. Information that should usually be banned includes customer records, staff records, health details, payment details, confidential contracts, passwords, financial records, private supplier terms and commercially sensitive plans.

Sources: [1]

Step 4: write allowed uses, banned uses and checking rules

Now turn the policy into plain instructions. Allowed uses might include drafting a first version of a social post, rewriting a public service description in simpler language, summarising non-sensitive meeting notes, creating an internal checklist, or suggesting questions to ask a supplier. These are drafting and thinking tasks, not final decisions.

Banned or restricted uses should be just as clear. Staff should not use AI to make final legal, financial, medical, hiring, safety, payment, quoting or customer eligibility decisions without an approved process and human review. AI-generated content can sound confident and still be wrong, so your policy should say that staff must verify facts, prices, service inclusions, compliance claims, customer advice and anything that affects a decision before it is sent or used.

A safe reusable prompt for low-risk drafting is: “Rewrite this public service description for a local Australian customer. Use plain English, keep the meaning the same, do not add prices, claims, guarantees or new services, and ask me to check any detail that may be missing. Text: We install and repair residential garden irrigation systems in the Brisbane northside area.” This example uses non-sensitive information and tells the tool not to invent details.

Sources: [1] [2]

Step 5: add customer transparency and handoff rules

If AI is used for customer support, website chat or enquiry triage, your policy should say when customers need to know they are dealing with AI and how they can reach a person. A bot can be useful for answering common questions and collecting the right details, but it should not pretend to be a staff member or hide the fact that a human will review important matters.

Be especially careful with bookings and payments. Taking bookings requires a compatible booking integration that can check availability, reserve a time and send the right confirmation. A chatbot alone cannot confirm availability just because it can chat about appointment times. Your policy should state which system is the source of truth for bookings, who handles exceptions, and when the AI must hand off rather than continue.

Sources: [2] [6]

One-page AI use policy checklist

Use this checklist to draft the first version of your policy. Keep it short enough that staff will actually read it, then review it when you add new tools, change systems or start using AI in customer-facing work.

• Approved AI tools are listed in one register, including built-in AI features in existing software.
• One accountable person owns AI use and approves new tools.
• Each tool has a named owner, purpose, risk level and review date.
• Staff know which information is safe to use in AI tools.
• Staff know which information must be de-identified before use.
• Staff know which information must never be uploaded unless a specific approved process exists.
• Permitted uses are listed, such as low-risk drafting, summaries and internal checklists.
• Restricted uses are listed, including final advice, sensitive decisions, quoting, payment handling and confidential customer matters.
• AI outputs must be checked for accuracy, relevance, invented claims, bias and inappropriate wording before use.
• Customers are told when they are dealing with AI where it matters, especially in support or enquiry handling.
• There is a handoff rule for complex, sensitive, urgent or unclear customer enquiries.
• Staff know how to report a mistake, suspected data leak or unexpected AI behaviour.

Sources: [1] [2] [3]

Hypothetical example: a local service business

Hypothetical example: a small electrical maintenance business has three staff answering enquiries. One staff member has been using an AI tool to draft replies to customers because it saves time. The owner is comfortable with drafting help, but not with customer addresses, switchboard photos, invoices or job notes being pasted into a public AI chat.

The owner writes a one-page policy. Staff may use AI to rewrite a general reply using non-sensitive wording, such as “We service residential and small commercial properties in our local area.” They must remove names, addresses, phone numbers, photos, fault details and invoice information. Every reply must be checked against the business’s approved services before it is sent. If the customer wants a booking, the staff member uses the approved booking process rather than letting the AI imply a time is confirmed. If the customer asks for safety advice, the enquiry is handed to a qualified person.

What to measure after the policy is live

Measure whether the policy is working, not whether the document looks impressive. Track how many AI tools are in the register, how many staff have been shown the rules, how often AI-drafted customer messages need correction, and whether any sensitive data is being removed before prompts are used. If you use AI in customer enquiries, also review handoffs: are customers getting to the right person with enough context?

Set a review date now. A practical first cycle is to review the policy after a few weeks of real use, then whenever you add a new AI tool, connect a new system, change a customer process or give staff broader access. If the register grows quickly, or if AI starts touching bookings, payments, private customer details or high-stakes advice, you likely need a more formal process and technical help.

Sources: [2] [3]

How Business Growth Clinic fits this work

Business Growth Clinic’s AI and automation work is practical rather than abstract. The documented service context includes tailored AI assistants for customer enquiries, website and phone integration scoped around your systems, approved business information, clear handoff to your team, and booking or follow-up connections where compatible. That kind of setup works best when the business has already agreed what AI may say, what it must not handle, and when a person steps in.

If your immediate bottleneck is messy internal AI use, start with the policy and register. If the bottleneck is repeated website enquiries, unclear customer handoffs, or staff spending time answering the same safe questions, it may be worth exploring an AI assistant built around approved information and clear boundaries. The useful next step is to bring your draft policy, current tools and enquiry examples so the automation can be scoped around real business rules rather than guesswork.

Sources: [6]