On this pageJump to a section
"Quick question before we renew: do you use AI on our account, and what does it see?"
If a client sent you that email tomorrow, could you answer in a minute, with confidence, in writing? I suspect plenty of us could not. The tools arrived one at a time, each one useful, and no one wrote down the rules. A policy fixes that, and it does not need to be long. One page is enough, as long as it says what the tools may see, what they may say and what they may do.
Why does a one-person company need an AI policy?
Because the risk does not shrink with the headcount.
You hold client information. You publish claims. You connect tools to your inbox and your accounts. The standard for connecting AI applications to outside systems has become a shared one: when Anthropic donated the Model Context Protocol to the Agentic AI Foundation on December 9, 2025, it cited more than 10,000 active public MCP servers and adoption in products including ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code.1 More connection means more places for data to go and more things a tool can do for you, or to you.
The law has not made an exception
The Federal Trade Commission has been plain about this. Announcing a set of AI-related cases in September 2024, it quoted Chair Lina Khan: "Using AI tools to trick, mislead, or defraud people is illegal."2 And in a January 2024 post about AI companies and customer data, the FTC's Office of Technology wrote, "There is no AI exemption from the laws on the books."3 If you publish a claim written by a machine, it is your claim.
There is no AI exemption from the laws on the books.
What is the NIST framework, and how do you use it at small scale?
NIST released AI RMF 1.0 on January 26, 2023, and describes it as intended for voluntary use.4 It is written for organizations of every size, which means it is wordy for a company of one. You only need its shape.
Its core is four functions. GOVERN builds a culture and structures for managing AI risk and is described as cross-cutting. MAP sets the context so risks can be framed. MEASURE uses methods to analyze, assess and monitor risk. MANAGE directs resources to the risks you have found and plans responses to incidents.5 A solo operator can translate those into four plain questions.
| NIST function | The question for a company of one |
|---|---|
| Govern | Who decides what AI may do in my business? (You do. Write it down.) |
| Map | Where does AI touch client data, claims or money? |
| Measure | How do I check that its output is right? |
| Manage | What do I do when something goes wrong? |
What goes into the one-page policy?
Here is the draft I would use. Edit it to your business.
1. Purpose and owner
State that you own the policy, the date it was written and the quarterly review date. That sentence is the "Govern" function in miniature.
2. Data tiers
- Red, never enter: passwords, payment details, government identifiers, health information about clients or patients, and anything covered by a confidentiality agreement unless the contract allows it.
- Yellow, approved tools only: internal documents and client work product, entered only into business-grade tools whose terms you have read, with training on your data off where that option exists.
- Green, public: content already published.
3. Client confidentiality
Do not enter a client's name or information into any tool unless your agreement permits it or the client has said yes. (Getting your data ready for AI is the place to start sorting.) If a client asks, tell them honestly which tools you use.
4. Claims and facts
AI may draft. You verify every number, quote, source and testimonial before it goes out. Never publish an invented result, credential or review. The cost of getting this wrong is real, as AI Customer Support Without the Air Canada Mistake shows. If you cannot trace a claim to evidence, cut it.
5. Actions and permissions
A tool may draft messages but may not send, publish, spend money, delete or change access without your approval. When you connect a tool to an account, start with read-only access and add permissions one at a time (Claude Integrations shows what "connected" means in practice).
6. Human review
List what must be reviewed by a person before it leaves the building: anything client-facing, anything with a number, anything that makes a promise.
7. Records and incidents
Keep a simple list of tools in use, what data tier each is cleared for and the date of your last review. If something wrong goes out, correct it, tell whoever was affected and write down what you changed.
- Tool draftsMessage, post or report
- You verifyNumbers, quotes, sources and testimonials
- You approveBefore anything is sent, published or spent
- You log itTools list, data tier, review date
How do you keep the policy alive?
A policy that sits in a folder is a document, not a control.
- Print the one-page version or pin it where you work.
- Add a "policy check" to your weekly review: any new tool, any new connection, any near miss.
- Review the full policy every quarter, and any time you adopt a tool that touches client data.
- Update the tools list the same day you change a tool.
- Share the relevant parts with clients and contractors, so they follow the same rules on your behalf.
Contractors count
If someone works for you, their use of AI tools on your client's material is your use. Put the same rules in writing for them, and ask what they use.
Where this fits
Seventeen years of working for myself, the last stretch with no staff at all, taught me this: the less staff you have, the more your tools act as colleagues, and colleagues need rules. A policy is how you stay responsible for your own business, even when a machine did the typing. Writing the rules down is also part of the systems I build for clients, and it pairs with SOPs written for agents.
If a tool can act in my name, it needs a rule about what it may do without asking.
None of this replaces legal advice for your situation, especially if you handle health or financial information. It gives you something specific to bring to that conversation.
Keep building.Ekai
Questions people ask
Does a small business need an AI policy?
If you use AI tools with client or customer information, yes. A short written policy sets what data the tools may see, what they may do without approval and how output is checked. It also gives you a clear answer when a client asks how you use AI.
What is the NIST AI Risk Management Framework?
It is a voluntary framework from the U.S. National Institute of Standards and Technology, released on January 26, 2023, to help organizations manage AI risks. Its core is organized into four functions: Govern, Map, Measure and Manage.
What should an AI policy say about client data?
Sort data into what may never be entered into AI tools, what may be entered only into approved business-grade tools, and what is public. Add a rule that client information requires contract or consent clearance first.
Can I use AI to write marketing claims?
You can use it to draft. You remain responsible for every claim. The FTC has said there is no AI exemption from existing law, so each statement must be true and supportable before it is published.
Sources
- 1
- 2
- 3
- 4
- 5
