AI at Work: A One-Page AI Governance Plan for a 5 to 50 Person Office

If you run a small office, you probably have an AI policy already. You just have not written it down.

Someone on your team pastes a client spreadsheet into a free chatbot on a personal login. Someone else pays for an AI note-taker on a company card and records every client call. A draft email with a made-up deadline goes out because nobody read it closely. None of it is malicious. People are trying to get work done faster. The problem is that it happens in private, with tools nobody approved and settings nobody checked.

The answer is not to ban AI. People use it anyway and stop telling you. The answer is a short set of rules that say yes to AI with clear lines. In a 5 to 50 person office that fits on one page and takes an afternoon.

I put the pieces into a free starter kit and a course. Here is the short version. This is practical guidance, not legal advice, so if your work is regulated, have a lawyer or compliance person review your final policy.

The seven pieces

1. Data rules. What must never go into AI?
2. Approved tools. Which tools and accounts may we use?
3. Admin settings. Are the accounts set up safely?
4. Policy. Where are the rules written down?
5. Guardrails and training. Do staff and AI agents know the rules?
6. Human review. Who checks AI work before it counts?
7. Incident plan. What do we do when someone gets it wrong?

1. Start with data rules

Everything else depends on this one. The simplest rule that works is three levels:

• Public: text already on your website, published prices, general questions. Fine in any approved tool.
• Internal: draft memos, meeting notes, process documents. Approved tools on the company account only, with names and account numbers swapped for placeholders like [CLIENT].
• Confidential: passwords, bank and card numbers, Social Security and tax ID numbers, health details, HR records, and anything a client asked you to protect. Never goes in as is.

Put real examples from your own work on the sheet. A quick test: would you be fine if this text showed up in a stranger's chat?

2. Make the approved way the easy way

Shadow AI shrinks when the approved option is simple. Pick one main assistant on a business plan, write it down, and give people an easy way to ask for anything else.

Your approved tools list is just a table: the tool, the plan, who can use it, the highest data level allowed, an owner and a review date. Before anyone signs up for a new tool, ask whether the vendor trains on your data, how long it keeps it, and whether an admin can control sharing.

3. Check the settings on day one

Most leaks come from default settings on accounts nobody configured. Whatever tool you approve, look at these:

• Model training. On personal plans, switch off the setting that lets the vendor use your chats to improve its models. OpenAI says its Business and Enterprise plans do not train on business data by default.
• Shared links and memory. Anyone with a shared link can read that chat, and memory is risky on a login several people share.
• Who is on the account. One company workspace, no client work on personal logins, and remove people the day they leave.

4. Write the one-page policy

Keep it under a page, in plain words, with names. It should cover approved tools only, the never-paste list, what is fine to do (so people are not afraid to use AI at all), the settings the owner keeps in place, and a rule that a person checks every output before it reaches a client, a vendor or the public. Automations and agents that send, pay, delete or post need approval first.

Add two more things: an owner with a review date, and a same-day, no-blame rule for mistakes. That last one is the rule firms forget, and it is what lets you fix a problem while you still can. You make the decisions; AI can do the drafting. I use Claude to turn seven rules into a one-page policy, an announcement email from the boss and a five-question staff quiz.

5 and 6. Guardrails and human review

AI can draft fast and still be wrong with total confidence, so no output counts until a named person has checked it. Two habits make that practical.

First, review where it matters most. If people must approve everything, they stop reading and click yes. Set a threshold instead: every client-facing message, and any payment over a set amount. In one of my n8n practice lessons, AI reads each invoice PDF and logs it, and anything over $1,000 waits for the owner's Approve button.

Second, write your hardest rule into the agent in plain words, with a next step, and test the risky question before anyone else sees it.

7. Decide your incident plan now

It will happen, so decide ahead of time. Mine has five steps:

1. Stop and tell. The person tells the policy owner the same day. Nothing is deleted first, so you know what happened.
2. Record it. Which tool and account, what was pasted, when, and whether a shared link or connected app was involved.
3. Contain it. Delete the chat and any shared link, check training and memory settings, and remove any unapproved tool from the device.
4. Decide who else to tell. Check your client contract. If personal data was involved, ask a qualified adviser whether you must notify anyone.
5. Fix the cause. Update the cheat sheet, tools list or policy so it does not happen the same way twice.

Keep it alive

Send the policy with a read-by date, run the quiz in a team meeting, and review the tools list, settings and incidents every six months. AI tools change fast, and a policy that names last year's tools protects nobody.

Get the free kit

The page has three free downloads: a data classification cheat sheet, an approved AI tools list you can open in Google Sheets or Excel, and a one-page AI policy template with ten sections. Replace everything in the brackets and you have a first draft the same day. The free course, AI Governance for Small Business, takes a little over an hour, and you practice each piece in a safe copy of the real tool.

Read the full starter kit and grab the templates: AI Governance for Small Business