When this workflow helps
If you are searching for how to write a small business AI data policy, first decide who owns the result and where it will be used. A good draft saves preparation time only when the underlying facts are available and a person can inspect the output. This guide is for that specific deliverable; the AI Governance and ROI for Small Business hub collects adjacent tasks.
Gather the source material
Existing confidentiality terms, data categories, approved tools, retention rules, and escalation contacts. Use the current approved version. Remove details that the team is not permitted to place in an AI tool, or use a workspace and access controls approved for that data. Keep a link to the original material so reviewers can trace the result.
Build the first draft
Define permitted, restricted, and prohibited data; approved use cases; sharing and retention rules; and incident reporting in employee-friendly language. Start on one representative example, not the entire backlog. If a required fact is missing, ask for a marked gap rather than a plausible completion. Save the output as a draft with the source date and an assigned reviewer.
Starting prompt
Draft a one-page AI use policy from these approved requirements. Specify what staff can input, what needs approval, how outputs are reviewed, and who handles suspected exposure. Mark legal gaps.
Replace the example input with your own approved documents and specify the output format your team actually uses. Ask for a short list of uncertainties alongside the draft. Keep the source and output together during review so a polished sentence does not hide a missing fact.
Review before use
Leadership, legal, and security owners approve the policy and confirm vendor settings before distribution. Check names, dates, figures, citations, and commitments against the originals. If a consequential decision or external communication is involved, the designated human owner makes the final call and follows the normal approval path.
Measure whether it worked
Track Policy exceptions and staff questions that reveal unclear categories. Compare a small set of completed examples with the previous process. Record corrections, not only time saved; a faster draft that creates rework is not an improvement. Revise the prompt when the same error appears twice.
Next steps
Return to AI Governance and ROI for Small Business for related tasks, or use the AI business strategy pillar to decide where this workflow belongs in the wider business.