Many small businesses begin using artificial intelligence in the same way they begin using any new tool: one person tries it, another copies the idea, and before long nobody is quite sure what information can be shared, who checks the result, or which decisions still need a human. The problem is not enthusiasm. It is the absence of a simple shared rulebook.

An AI policy for a small business in New Zealand does not need to be a long legal document. It needs to help people make consistent decisions when they use an AI assistant to draft, summarise, classify, analyse, or automate work. A good policy protects customers and staff while leaving room for useful experimentation.

Why a small business needs an AI policy

AI systems can produce useful work quickly, but they can also be confidently wrong, expose information, or make a recommendation that is unsuitable for a particular customer. A policy creates a common baseline for privacy, accuracy, security, accountability, and review.

It also reduces a quieter risk: uneven adoption. If every person develops a different way of using AI, the business may have inconsistent customer messages, duplicated effort, and no clear record of how an important document was produced. A short policy turns individual experimentation into an agreed business process.

Start with the purpose, not the technology

Begin by describing what the business wants AI to help with. Common low-risk uses include brainstorming, turning notes into a first draft, creating checklists, summarising internal material that contains no sensitive information, and preparing questions for a meeting. The purpose statement should make clear that AI supports people and does not remove responsibility from the person approving the work.

Next, list the tasks that need extra care. These may include handling personal information, employment decisions, financial recommendations, health-related information, safety matters, legal documents, complaints, and anything that could materially affect a customer. The higher the impact, the stronger the review and approval requirements should be.

Set a simple information boundary

The most useful part of a small-business policy is often a three-level information rule. Public information can be used for general drafting and research. Internal information may be used only in an approved business environment and only when the person understands how it is stored and handled. Confidential or personal information must not be entered into an AI service unless the business has completed the necessary privacy, security, and contractual checks.

Staff should also know that removing a name does not always make information anonymous. A combination of dates, job details, locations, transaction values, or unusual circumstances can identify a person. When in doubt, leave the information out and use a fictional example or a short description of the task instead.

Keep humans accountable

An AI policy should name the person responsible for checking an output before it is sent, published, or used in a decision. Review is more than proofreading. The reviewer needs to check facts, calculations, tone, context, missing caveats, and whether the answer actually addresses the customer or business need.

For high-impact work, require a second person or a subject-matter specialist to approve the result. A human approval step is particularly important when the output could affect someone’s money, employment, access to a service, health, safety, privacy, or legal position.

Address accuracy and fabricated detail

AI can generate a fluent answer without having reliable evidence for every sentence. The policy should tell users to verify important facts against the original records and to treat generated references, figures, quotations, and summaries as unconfirmed until checked.

For repeatable work, create a short quality checklist. It might ask: Is the source material current? Are names and numbers correct? Has the output introduced an assumption? Does it reveal private information? Is the language fair and appropriate? Has the final decision been made by an authorised person?

Make security practical

Security guidance works best when it is specific. Require strong account protection, restrict access to people who need it, keep business devices updated, and avoid copying passwords, access tokens, private keys, or security weaknesses into an AI conversation. Staff should know how to report a suspected disclosure quickly, without trying to hide the mistake.

The policy should also cover third-party tools and browser extensions. Before connecting a service to business data, someone should confirm what information it can access, where that information is processed, how long it is retained, and how access can be withdrawn.

Give staff an approved way to experiment

A policy that only says no will encourage shadow use. Provide a safe starting list of approved tasks, a place to ask questions, and a process for requesting a new use case. Ask staff to record the task, the information used, the human checks performed, and the result. This creates a small internal library of lessons that can improve over time.

Training should use examples from the business. Show how to turn a vague request into a clear instruction, how to ask for uncertainty to be identified, and how to compare an AI draft with the source record. The goal is not to make everyone a technical specialist. It is to make careful use easier than careless use.

Review the policy regularly

AI tools, contracts, settings, and business processes change. Set a review date at least twice a year and review the policy sooner after an incident, a new high-impact use case, or a material change to the business. Keep a short record of what changed and why.

Measure whether the policy is helping. Useful signals include fewer repeated tasks, faster first drafts, fewer corrections, clear approval ownership, and staff confidence about what they can safely do. Productivity is only a benefit when quality, privacy, and trust remain intact.

A policy should create confidence

The best AI policy for a small business is understandable enough to use on a busy day. It explains the purpose, sets information boundaries, requires human review, defines high-risk work, and gives people a route to ask for help. It does not promise that AI is always accurate or that every task should be automated.

For a New Zealand business, responsible adoption is a practical discipline. Start with low-risk tasks, keep people accountable, protect personal information, and expand only when the evidence shows that the process is safe and useful.

Frequently asked questions

1. What is an AI policy for a small business?

It is a set of practical rules explaining how staff may use AI, what information must be protected, which tasks need review, and who remains accountable for the final result.

2. Does a small business need a long legal document?

No. A short, clear policy is usually more useful than a complex document that staff cannot apply. Higher-risk businesses may need additional specialist advice.

3. Can staff enter customer information into an AI tool?

Only after the business has checked the privacy, security, retention, and contractual position of the specific tool. Personal information should be excluded by default when there is uncertainty.

4. Who is responsible for checking AI output?

The person who approves or uses the output remains responsible. A second reviewer should be required for work with significant financial, legal, employment, health, safety, or privacy impact.

5. How can a business reduce inaccurate AI answers?

Use trusted source material, ask the system to identify uncertainty, verify important claims against original records, and use a repeatable review checklist before approval.

6. Should an AI policy ban all AI use?

A total ban may encourage unapproved use. It is usually more effective to define safe uses, restricted information, approval requirements, and a process for testing new applications.

7. How often should the policy be reviewed?

Review it at least twice a year and whenever the business adopts a significant new tool, discovers an incident, or introduces a higher-impact use case.

8. What is the first step in creating an AI policy?

List the tasks people already want AI to help with, separate low-risk and high-impact uses, and agree on the information boundary and human approval process.