Yes. If your team has laptops and internet access, some of them are already using ChatGPT, Gemini, or Claude to draft emails, summarise contracts, or build reports — whether or not you’ve approved it. A one-page usage policy costs you an afternoon. Waiting for a “proper AI strategy” first means months of ungoverned use, and that’s where the real damage happens: client data pasted into public tools, inconsistent outputs going out under your brand, and no one accountable when something goes wrong.
This pattern is common: founders delay any AI decision because they’re waiting to pick the “right” tools or build the “right” roadmap. Meanwhile, the informal use never stopped. It just went underground.
The gap between AI strategy and AI reality
Recent industry coverage supports this pattern. JPMorganChase’s analysis of small business AI use points to a clear trend: adoption among small businesses is rising steadily, but it’s happening person by person, tool by tool, not as a managed rollout. Vendors have noticed too — Anthropic’s launch of Claude for Small Business is a signal that major AI providers now see SMEs as a distinct, sizeable market segment, not an afterthought to enterprise deals.
That’s the strategic layer — which tools, which workflows, what return on spend. It matters, and we’ve written about it in detail in Which AI Tools Should Your SME Actually Adopt in 2026?. But strategy answers “what should we build?” A usage policy answers a narrower, more urgent question: “what are people allowed to do right now, with the tools they already have open in another browser tab?”
Those are different problems, on different timelines, and conflating them is why so many SMEs end up with neither.
What happens without a policy
Founders commonly discover, mid-project, that:
- A staff member pasted a signed client contract into a public AI tool to “summarise the key terms” — meaning confidential commercial terms are now sitting on a third-party server, outside any agreement you have with that client.
- Marketing copy, proposals, or even board summaries were AI-generated wholesale, with factual errors nobody caught because no one was told to check.
- Three different departments are paying for three different AI subscriptions out of personal expense claims, with no visibility at finance level.
- A junior employee assumed AI output was “final,” skipping the judgment step that used to catch mistakes before they reached a client.
None of this required bad intent. It required the absence of a simple, visible rule. This is the same failure pattern we described in What’s Going Wrong When SMEs Rush AI Adoption, and How Do You Avoid It? — except rushing isn’t even the trigger here. Doing nothing is enough.
Policy vs. strategy vs. gap analysis: know which one you need first
Founders often set out to “build an AI strategy” when what they actually need, urgently, is a policy. Here’s how we distinguish the three:
| AI usage policy | AI gap analysis | AI strategy | |
|---|---|---|---|
| Answers | What can staff do today, and what’s off-limits? | Where are we wasting time/money that AI could fix? | Which tools, workflows, and budget over 12 months? |
| Timeframe | Days | 2–4 weeks | 1–3 months |
| Owner | Founder/ops lead | Ops lead + external advisor | Leadership team |
| Cost | Near-zero | Moderate (advisory time) | Highest (tools + change management) |
| Risk if skipped | Data leakage, brand inconsistency, no accountability | Wasted spend on tools solving the wrong problem | Fragmented, ad-hoc adoption with no ROI tracking |
| Should come | First | Second | Third |
If you’re not sure whether you need a gap analysis before spending on tools, we’ve laid out that decision in detail in Do You Need an AI Gap Analysis Before You Spend on AI Tools?. But that conversation assumes a baseline of control already exists. The policy is what creates that baseline.
What a minimum viable AI policy actually covers
You don’t need a legal department to write this. A working policy for an SME with under 50 staff typically fits on one page and covers five things:
1. What data can never go into a public AI tool. Client contracts, personal data, financials, anything under an NDA. Name the categories explicitly — “confidential information” is too vague for someone deciding at 6pm whether to paste a spreadsheet into a chatbot.
2. Which tools are sanctioned, and which aren’t. If you’ve evaluated Claude, ChatGPT, or Gemini and settled on one for company use, say so. Unsanctioned tools aren’t necessarily banned outright — but staff should know which one carries institutional support (paid tier, data handling terms reviewed) versus which one is “use at your own risk.”
3. A human-review rule for anything client-facing. AI drafts, humans approve. No AI-generated output — proposal, email, report — leaves the business without someone reading it first and taking responsibility for it.
4. Who owns the subscription budget. One line item, one approver. This alone usually surfaces three or four tools already being expensed informally that nobody upstream knew about.
5. What happens if something goes wrong. Not punitive — practical. If confidential data was pasted somewhere it shouldn’t have been, who does the employee tell, and how fast?
That’s the whole document. It won’t survive contact with every edge case, and it shouldn’t try to. Refine it quarterly as actual use cases emerge.
Sequencing: policy, then training, then strategy
Once the policy exists, the next reasonable question is how you get staff actually using AI well, not just safely. That’s a training question, and we’ve covered the decision of whether to train before or alongside tool rollout in Should You Train Your Team on AI Before You Roll Out New Tools?. Training without a policy in place just accelerates the exact risks a policy is meant to catch — so the order matters more than the intensity of either step.
Only after the policy is holding and staff have basic competence does a full AI strategy — tool selection, workflow redesign, budget allocation — become worth the investment. Skipping ahead to strategy while the policy gap is still open is how businesses end up funding sophisticated AI rollouts on top of an ungoverned base.
The honest cost of waiting
We understand the instinct to wait for a comprehensive plan before making any AI-related decision. It feels more responsible. In practice, it’s the opposite: every week without a policy is a week of accumulating undocumented, unmanaged AI use across your business, by people making individual judgment calls with no guidance. The fix is not expensive or slow. It’s a page, a meeting, and a review date three months out.
Frequently asked questions
Do we need a lawyer to write an AI usage policy?
Not for a first version. A one-page internal policy covering data handling, sanctioned tools, and review rules doesn’t require legal drafting — it needs clarity and staff buy-in. If your business handles regulated data (health, financial services, legal), it’s worth a lawyer’s review once the draft exists, but don’t let that gate you from starting.
Our staff are already using AI tools informally — should we ban it while we write the policy?
No. An outright ban usually just pushes use further underground, onto personal devices and personal accounts, where you have even less visibility. It’s more effective to issue a short interim rule immediately — “no confidential data into any AI tool, full stop” — while you finish the fuller policy.
How is this different from an AI gap analysis?
A gap analysis identifies where AI could actually improve your operations and where spend would be wasted; it’s a strategic exercise usually done with an advisor. A usage policy is a governance exercise you can do internally in a day. Most businesses need the policy first because staff are already using AI regardless of whether a formal strategy exists.
How often should we update the policy?
Review it quarterly for the first year. AI tools and their data-handling terms change faster than most internal policies are used to; a policy written in January can be outdated by the time new features or new sanctioned tools appear mid-year.
If you’re not sure whether your business needs a policy, a gap analysis, or a full AI strategy first, that’s exactly the kind of sequencing conversation we have with founders every week. Book a free strategy call and we’ll help you work out where to start.