Your company either has no AI strategy or a 40-page document that nobody has read since the consultant delivered it. Both produce the same outcome: ungoverned AI use across the organization.
The fix is one page.
Section 1: What we use AI for and what we do not
Five to ten statements. Specific. Unambiguous.
"We use AI tools to draft internal reports and communications. All AI-drafted content must be reviewed by the responsible team member before distribution."
"We use AI tools to analyze internal data for operational improvements. Customer PII must not be entered into any AI tool without a signed data processing agreement."
"We do not use AI tools to make hiring decisions, customer credit decisions, or any decision that requires regulatory compliance documentation."
That is it. Not a vision statement. Not a roadmap. A list of what is allowed and what is not. Every employee can read this in two minutes and understand what they can and cannot do.
Section 2: Who is responsible
One person. Not a committee. Not an AI working group. Not "the IT department."
One name. One email. One person who approves new AI tools, reviews incidents, and updates this document quarterly.
A committee diffuses accountability. When something goes wrong, a committee produces a meeting. A named person produces a decision. Name the person.
Section 3: What happens when something goes wrong
Three steps. Step one: stop using the tool. Step two: notify the person named in Section 2. Step three: document what happened, what data was involved, and what the outcome was.
No incident response playbook. No escalation matrix. Three steps that anyone can follow immediately. The detailed incident response process can come later, after you have the basics working.
Why one page works
People read one page. People do not read forty pages. A strategy that gets read and followed beats a comprehensive one that sits in a shared drive untouched.
One page is also easier to keep current. Updating one page takes fifteen minutes. Updating a forty-page strategy takes a consultant and a project plan. The one-page document stays accurate. The forty-page document becomes stale.
What comes after
The one page expands naturally as the organization's AI capability grows. After three months, you might add a section on approved tools. After six months, a section on training requirements. After a year, data handling procedures specific to each department.
But it starts with one page. And the one page comes first. Not after the strategic review. Not after the consultant engagement. Now.
You can write this document in thirty minutes. Open a new document. Write the three sections. Send it to your leadership team. You now have an AI governance policy that is better than 90% of the organizations in your industry.
Book a governance sprint — a governance sprint starts with exactly this kind of document.
Get posts like this in your inbox
No spam. New articles on AI strategy, governance, and building with AI for small business.