How to write an AI policy in 60 minutes: a template-led walkthrough
AI policies have a reputation for being long, expensive and ignored. None of those are necessary. A working AI policy for an Australian SMB fits on one page, takes 60 minutes to write if you follow a template, and gets followed because it is short enough to remember. Here is the template-led walkthrough.
Why one page and 60 minutes
The single biggest predictor of whether an SMB AI policy works is whether staff can summarise it in their own words after the training session. A one-page policy that fits in working memory gets followed. A 30-page enterprise template gets signed and forgotten.
Sixty minutes is the right time budget because beyond that, the marginal additions are usually theoretical edge cases that dilute the policy without adding real coverage. If you cannot write a working policy in an hour, you are probably adding things that should not be in it.
The six-section template
Section 1: Approved AI tools (10 minutes)
List the tools by name. Be specific:
- Claude.ai Teams (for general work)
- Claude Code (for engineering work)
- ChatGPT Plus (for the named seats only)
- Microsoft 365 Copilot (if you have it)
- The specific custom builds your team uses
Anything not on this list is not approved for work data without explicit sign-off. State that explicitly.
Section 2: Data categories (15 minutes)
Two columns:
- Green-light data: general business questions, public marketing copy, internal SOPs, public-domain reference material, drafts of communications.
- Red-light data: customer personal information, financial information about identifiable individuals, anything covered by NDAs, anything covered by client confidentiality, source code if engagement contracts restrict it, anything classified by your internal data scheme as restricted.
Binary list is easier to remember than a nuanced one. Skip the yellow column.
Section 3: Customer / client data and cross-border (10 minutes)
One paragraph stating the answer to: where is data being processed (Anthropic publishes this for Claude.ai Teams and Enterprise), is it used to train general-purpose models (it is not for Teams/Enterprise), and how long is it retained. State the answer once so staff do not have to ask IT every time.
If your business has specific APP 8 cross-border considerations, address them in one or two sentences.
Section 4: IP ownership (5 minutes)
One sentence: the company owns AI-generated content created by employees in the course of their work, the same way it owns non-AI work. Contractors should sign equivalent terms before getting access. Done.
Section 5: Training requirement (10 minutes)
State the training requirement explicitly. Mandatory 15-30 minutes covering this policy, the approved tools and the data handling rules. Build it into onboarding for new staff. Annual refresher for existing staff. Name the person who delivers and tracks the training.
Section 6: Breach reporting (10 minutes)
One paragraph. If a staff member suspects a breach (data put into the wrong tool, an AI output containing information that should not have been disclosed, a vendor incident), they report it to [named person] within [24 / 48] hours. Briefly describe what happens next - investigation, the relevant external reporting under the Notifiable Data Breaches scheme if applicable, remediation.
Sign-off and rollout
Three signatures: owner / CEO, IT lead, legal advisor (where applicable). For most SMBs that is two or three people - more is unnecessary and slows the work down.
Once signed, the policy goes out alongside the licence rollout. Mandatory 15-30 minute training before any first AI use on company data. Tick-box acknowledgement that staff have read and understood. The policy lives somewhere obvious (intranet, shared drive, etc.) where staff can re-read it any time.
Annual review
Same three signatories revisit the policy annually. Out-of-cycle updates when something material changes - a new approved tool, a new category of data, a regulatory change. Most SMB policies need real updates twice in their first two years and then once a year thereafter.
Common mistakes to avoid
- Copying an enterprise template. Long, generic, unmemorable. Write your own from the template above.
- Listing tools by category rather than by name. “Approved LLM products” is not specific enough; staff need to know which products specifically.
- Skipping training. The single highest-leverage governance investment is the 15-30 minute training, not the policy itself.
- Putting the policy out after rollout. Write and sign-off before licences land. Always.
- Theoretical edge cases. If a scenario has never happened and is unlikely, leave it out. The policy is shorter and stronger.
How XLev helps
For SMBs that want a working policy as part of an AI implementation engagement, we draft it during the strategy workshop and sign-off lands inside the first two weeks of the rollout. The template above is what we use. The policy is yours to own and maintain after we hand over.
Book a free 30-minute discovery call via the Contact page.
Frequently asked questions
- Why one page and 60 minutes?
- Because longer policies do not get read or followed. The single biggest predictor of whether an SMB AI policy works is whether the team can remember it. A one-page policy that staff can summarise in their own words after the training session is a working policy. A 30-page policy copied from an enterprise template, signed once and forgotten, is policy theatre.
- What are the six sections?
- First: which AI tools are approved for company use (named, specific). Second: what data can and cannot go into each tool (binary green-light/red-light list). Third: how customer or client data is handled, including cross-border. Fourth: who owns AI-generated IP. Fifth: what training is required before access (15-30 minutes minimum). Sixth: how to report a suspected breach or misuse.
- What should we leave out?
- Enterprise-flavoured generic language. References to frameworks you do not actually use (NIST AI RMF, ISO/IEC 42001 are useful as references but should not bulk out the policy). Long lists of theoretical risk categories the team will never encounter. Detailed escalation procedures for incidents that have never happened. The policy gets longer with every theoretical edge case; it should be designed around the cases that actually occur.
- Who needs to sign off?
- The owner / CEO always. The IT lead or external IT partner if you have one. The firm's legal advisor or external solicitor if you handle regulated or sensitive data. For most SMBs, that is two or three signatures - more is unnecessary and slows the work down. Larger organisations add a risk officer; regulated industries add the relevant compliance officer.
- How often should we update it?
- Annual review with the same three signatories. Out-of-cycle updates when something material changes - a new approved tool, a new category of data being handled, a regulatory change worth reflecting. Most SMB AI policies need real updates twice in their first two years and then once a year thereafter.
Where this fits
AI Strategy Workshops
Half-day or full-day workshops with leadership. Walk out with a 12-month plan, not a slide deck.