Why it matters
Your team is already using AI: the only question is whether guided or improvised. Improvised means client data in personal accounts, unreviewed output shipping, and inconsistent answers about it. A policy converts quiet risk into open, managed practice.
How it works
A useful policy fits a page: approved tools and accounts; red-line data (client confidential, personal, credentials); mandatory review for external work; disclosure rules; who to ask. Written to enable ("here's how we use it well") not a ban that drives usage underground.
What to do about it
Draft the one-pager this month, then revisit quarterly as tools change. The businesses in trouble are rarely the ones using AI: they're the ones pretending they aren't.
