How to write an AI policy for your staff in one afternoon

Someone on your team pasted a customer complaint into ChatGPT last week to get help with the reply. It was probably a good reply. You just don't know which account they used, what else was in the paste, or whether anyone checked the answer before it went out.

That is the case for an AI policy. Not a binder. One page, written in an afternoon, that tells staff what they can use, what they must never paste, and who checks the work.

Who this is for and what you need

This is for owners and managers of businesses with roughly 5 to 100 people, where staff write emails, quotes, posts or reports and nobody has said anything official about AI yet. If you have an HR department and a legal team, they will want something longer. Most small businesses don't need longer.

You need about three hours, a list of the software you already pay for, and one honest conversation with your team. The cost is that time. You do not need a consultant or a new tool to do this.

It is worth doing now because the use is already there. KPMG's 2025 survey of 2,239 Canadian employees found that 51% use generative AI at work, up from 22% in 2023. Generative AI means tools like ChatGPT, Gemini and Copilot that write text or make images from a typed request.

Ask your staff what they already use

Start with a short, no-blame question at your next team meeting or in a message: which AI tools do you use for work, on which accounts, and for what? Make it clear nobody is in trouble.

The answers will surprise you. A 2023 Salesforce survey of 1,020 Canadian workers, reported by HRD Canada, found that 58% of those using generative AI at work did so without their employer's approval, and a third didn't know whether their company had a policy. A survey from three years ago is not today's number, but the pattern is what matters: the use comes first and the rules come later, if at all.

Write down every tool named. Note whether people use personal logins or a company account. That list is the raw material for the next step.

The usual mistake here is skipping this and writing rules from your own assumptions. A policy that bans a tool half your team relies on gets ignored by Friday.

Pick the tools you approve

From that list, choose one or two tools the business will support, and say plainly that work happens there and nowhere else.

Start with what you already pay for. If you run on Google Workspace, Gemini is likely in your plan, and Google says that in Workspace your interactions with Gemini stay within your organization, are not reviewed by humans, and are not used to train its models outside your domain without permission. Microsoft 365 businesses should look at Copilot under their existing licence before buying anything else.

The point of a business account is control. When staff use personal logins, the data and training settings are theirs to choose, the chat history leaves with them when they quit, and you cannot see or delete any of it. Read the data terms of whatever you approve, and write the tool names into the policy.

The usual mistake: approving a tool because it is popular, without checking where its data goes. Ask the vendor before you approve it.

Sort your information into three groups

This is the heart of the policy. Most AI risk for a small business is not the tool. It is what gets pasted into it.

Canada's privacy commissioners, in their principles for generative AI, suggest not entering personal information into a prompt unless it is necessary, and entering sensitive or confidential information only when authorized. They also say the organization, not the tool, stays accountable. PIPEDA, the federal privacy law for businesses, treats customer and staff details as personal information you are responsible for. So give staff three simple groups:

Adjust the examples to your business. A clinic's "never" list is longer than a café's. The usual mistake is writing "don't share confidential information" and stopping there. Staff need examples, not a category.

Say who checks the output

AI writes fluent, confident text that is sometimes wrong. KPMG found 58% of Canadian employees are extremely or very concerned about hallucinations, which is the industry's word for answers the AI invents. They are right to be.

The rule to write down is short: a person reads and approves anything AI helped write before it reaches a customer, a supplier or the public. Prices, dates, policies and promises get checked against the source every time.

The business owns the result either way. In 2024, a BC tribunal found Air Canada liable for wrong bereavement-fare advice given by the chatbot on its website, and rejected the airline's argument that the chatbot was responsible for its own actions. That was a website bot, not an employee's draft, but the principle carries over: what goes out under your name is yours.

"The AI wrote it" is not a defence. Whatever goes out under your name is yours.

Check the hiring rule if you have 25 or more staff

One Ontario rule now touches AI directly. Since January 1, 2026, employers with 25 or more employees must state in publicly advertised job postings whether they use AI to screen, assess or select applicants, according to the law firm Osler. Internal postings and roles performed outside Ontario are excluded.

The definition of AI in the regulation is broad, and as of Osler's February 2026 analysis the Ministry had not issued guidance on what counts. So add one line to your policy: anyone who uses an AI tool on applications, including a résumé-sorting feature inside a job board, tells the person who writes the postings. If you are near the 25-employee line, ask your employment lawyer how to word the disclosure.

Put it on one page and give it an owner

Now write it. Here is a structure that fits on a single page:

1. Purpose. One sentence: we use AI to save time, and we stay responsible for the result.
2. Approved tools. The one or two you picked, on company accounts.
3. The three groups. Your table, with your own examples.
4. Checking. A person approves anything external before it goes.
5. Being upfront. When a customer is talking to an AI tool, such as a chat bot on your site, say so.
6. Hiring. The disclosure line, if it applies.
7. Questions and mistakes. Who to ask, and that reporting a slip early is never punished.
8. Review date. Six months from today.

Name one person who owns it. In a small business that is usually the owner or an office manager. Go through it at a team meeting, give everyone a copy, and ask them to say what is unclear. KPMG found only 48% of employees felt their employer had given them the training and guidance they needed. Ten minutes of explanation closes much of that gap.

Common mistakes

• Banning everything. Use moves to personal phones, where you can't see it.
• Copying a big company's policy. Ten pages nobody reads protect nobody. Keep it to one.
• No examples. "Confidential information" means different things to different people. List the actual things.
• No owner and no date. Tools change every few months. A policy nobody reviews is out of date by spring.
• Punishing honesty. If the first person who admits a mistake gets in trouble, nobody admits the second.

When should you not bother? If you are a sole proprietor with no staff, you don't need a written policy. You still need the three groups in your own head.

Where to start

1. This week, ask your team which AI tools they use and on which accounts. No blame.
2. Draft the three-group table with real examples from your business, and check the data terms of the one or two tools you plan to approve.
3. Put the eight headings on one page, fill them in, and go through it at your next team meeting.

If you would like a second pair of eyes on the draft or help setting up approved tools, you can book a call with Trimotech.