Decide how AI will be used before you pick a tool.
By Chris McCarthy, Founder & Chief AI Officer, OB.1
Someone on your team wants to try an AI tool. Someone else may already be using one. Before that spreads, your leadership team should agree on the rules.
Maybe you searched for an AI policy for small business and landed here. I write for mid-sized operators. This guide is about your company: how your work runs, who owns each call and how to use AI.
Before you buy AI, write down how your company runs. The rules come out of that picture.
What an AI policy for your company should cover
An AI policy is a short set of decisions your leadership team makes once and keeps current. It should answer five questions.
- Which AI tools are approved, and who approves a new one?
- What data can a tool use, and what stays off limits?
- Who checks AI output before it reaches a customer or a supplier?
- Who owns each rule?
- When do the rules get reviewed?
That's the core of AI governance for a company your size. You can add detail later. Start with clear answers to these five.
Keep customer data, pricing and anything under contract in the off-limits column until someone owns the decision. That one line saves a lot of guesswork later.
Start with the tools already in use
Your team may already use AI tools. Start there. Ask each manager which AI tools their team uses, what they use them for and which data goes in. Write the answers on one list. Put an owner on each tool, someone who answers for how it gets used. Then run that list through the five questions above. You'll see where rules are needed most, and your first rules will match how your team works today.
Start from how the work runs today
Map one process first, like order to delivery or quoting, with the people who run it. I walk through how in how to map how work moves through your company.
Then mark the steps a tool may help with, and the ones it must stay out of.
Say someone in sales wants to paste a customer drawing into an AI tool to draft a quote faster. Your map shows who owns that step and what rules they follow. Your policy says whether customer drawings may go into that tool, and who decides. With both on paper, the answer takes a minute. Without them, it becomes a debate every time a new tool shows up. I walk through that quoting path in how your company builds a quote.
Who owns the rules
Every rule needs one named owner. Without an owner, a rule drifts, and nobody knows who to ask.
The owners usually split along lines your team already knows.
- Operations owns the rules about how work runs and which steps a tool may touch.
- Finance owns approvals and spend on new tools.
- Leadership owns the lines on customer data, quality and anything that reaches a customer.
The people who do the work help write these rules. They know where a tool would save time and where it would cause trouble. Ask them first, and use their words. When a question comes up that no rule covers, the owner decides and adds a line to the page.
A Blueprint Session is where we set owners and rules with your team.
Write it so people use it
A policy only works if people read it and follow it. Keep it to one page.
- Plain words, the way your team talks.
- A review date at the bottom.
Some teams also write a short procedure for each approved tool. It says what the tool is for, what data it may use and who checks its output. Some people search for this as an SOP for AI. A few lines per tool is enough.
Review the page whenever someone proposes a new tool. That keeps it current without a standing meeting.
Set the rules before you pick a tool
Decide how AI will be used before anyone picks a tool.
Tools come last. Once the rules are clear, choosing a tool gets easier. You know what it must do and what it must not touch.
Your team also knows what to expect. A new tool arrives with an owner, a purpose and limits already set.
What you'll know when you're done
You'll know how work moves through your company and what to fix first.
You'll also have a one-page set of rules for how AI gets used, with an owner on each one. For the first step before any of this, read where a manufacturing company should start with AI.
How OB.1 helps
We start by looking at how your company runs today.
The first step is an Operational Blueprint. It gives you a diagnosis of your platforms, process, and people, and a plan your team can act on.
We map how work moves through your company and who owns each rule, then rank what to fix first.
We'll tell you when AI is the wrong fix. Ongoing governance can come later, once the rules are working.
No rush on any of this. Whenever you're ready, let's talk.
Questions leaders ask about AI policy
What should an AI policy for a small business cover?
It should name approved tools, the data each may use, who checks output and who owns each rule. Keep it to one page and review it when a new tool comes up.
What does AI governance look like for a mid-sized company?
It's a short set of rules with a named owner on each. Operations, finance and leadership each own their part. The rules get reviewed when a tool is added.
Do we need an SOP for AI?
A few lines per approved tool helps. Say what the tool is for, what data it may use and who checks its output.
Should we automate a process before we fix it?
Fix it first. Walk the process, make each step and owner clear, then add automation. The tool works better on a step your team already agrees on.