What should a small team’s AI rules cover? Seven things: a named person accountable for every AI output, an accuracy check before anything is published or sent, no sensitive data in unapproved tools, consent before using anyone’s face or voice, honest disclosure when AI is involved, respect for other creators’ rights, and a fairness check wherever AI influences decisions about people. All of it fits on one page.
Large companies have ethics boards; a ten-person agency, a clinic or a school department does not. This guide sorts AI uses by risk, sets out the principles, shows how to write the policy in an afternoon, tests it against three realistic situations, lists common mistakes and flags when outside expertise is needed.
Why does a small team need AI rules at all?
In most small organisations, AI arrived without anyone deciding it should. Someone started using a chatbot for emails, a designer tried an image generator, the sales team found a tool that writes product descriptions. Within months, AI touches customer messages, marketing images and perhaps hiring, and nobody has agreed on what is acceptable.
That vacuum creates three kinds of risk. The first is error: AI systems produce fluent text that can be wrong, and a confident wrong answer sent to a customer is still your company’s answer. The second is leakage: staff paste client data into tools whose terms they have never read. The third is trust: customers, students or patients who discover undisclosed AI use, or realise that a “real customer” in an ad was generated, feel misled even when nothing illegal happened.
How rules protect staff and sharpen the team’s thinking
Rules also protect employees. Without them, each person makes judgement calls alone and carries the blame when something goes wrong. With a clear page of guidance, a junior staff member can say “the policy says we check this first” instead of quietly taking a risk to look efficient.
There is also a quieter benefit. Writing rules forces the team to discuss what AI is actually good for in its own work. Many small organisations discover that the biggest gains come from a few unglamorous uses, such as drafting routine replies or summarising long documents, and that the dramatic uses they worried about are rare. The policy conversation often turns out to be the most useful AI training the team ever receives.
None of this requires an ethics committee. It requires a short document, one person responsible for keeping it current, and a habit of asking a few questions before using AI in a new way. The rest of this guide is about making those three things practical.
How should a small team sort AI uses by risk?
A simple three-tier sort, plus a short list of things you never do, covers most small organisations. Adjust the examples to your own work.
| Risk level | Typical uses | Minimum controls |
|---|---|---|
| Low | Brainstorming, rewriting your own internal notes, summarising public articles, drafting social captions you will edit. | Approved tool; no sensitive data; the author reviews before use. |
| Medium | Customer emails and chat replies, marketing images and copy, translating documents for clients, internal reports using company data. | Human review before sending; disclosure where audiences would expect it; business plan with data protections; facts and figures checked. |
| High | Anything influencing decisions about people (CV screening, grading, credit, staff evaluation), health or legal information, content using real people’s faces or voices, automated replies without review. | Written approval from the accountable person; accuracy and bias testing; consent for likeness; a human makes the final decision; a way to appeal; a record of use. |
| Not allowed | Realistic fakes of real people without consent, fake reviews or testimonials, entering passwords or ID numbers, secretly monitoring staff with AI. | Prohibited outright; report if discovered. |
Review the table every few months. Tasks move between tiers as tools mature, and new uses appear that nobody predicted.
Eight principles for a one-page AI policy
A human owns every output. Whoever sends, publishes or acts on AI output is responsible for it, exactly as if they had written it themselves. “The AI said so” is never an explanation to a customer.
Facts are checked before they leave the building. Language models can invent figures, quotes, laws and sources. Anything factual that goes to a customer, a regulator or the public is checked against a real source.
Sensitive data stays in approved tools. Personal data of customers or staff, confidential contracts and financial information go only into tools the organisation has approved for that purpose.
Faces and voices need consent. Do not generate or alter images, video or audio of real people, including staff and customers, without their clear permission for that specific use.
Disclose where people would want to know. Tell customers when they are chatting with an automated assistant, and label realistic AI images used in advertising. Follow platform and legal labelling rules where they apply.
Respect other creators. No prompting with living artists’ names for commercial work, no reproducing recognisable characters or brands, and proper credit for sources used in research.
Test before AI judges people. Any use that ranks, scores or filters people needs a bias check, a human final decision and a way for people to ask for review.
Approved tools, secured accounts. Keep a short list of approved tools and plans, require two-factor authentication on them, and remove access promptly when people leave.
How to write your AI policy in one afternoon
The aim is a document people actually read, not a legal treatise. One or two pages is enough.
- List how AI is already used. Ask each person, without blame, which AI tools they use and for what. You will usually find more than you expected.
- Sort the uses into tiers. Place each use in low, medium, high or not allowed, using the table above as a starting point.
- Choose approved tools. For each tier, decide which tools and plans are allowed. Read the data and training terms of business plans before approving them.
- Write the principles in your own words. Adapt the eight principles to your sector. A clinic will say more about health information; a design studio more about copyright.
- Name an owner. Pick one person to answer questions, approve high-risk uses and update the policy. In a small team this is often the director or the office manager.
- Add a simple process for new uses. Anyone wanting to use AI in a new high-risk way writes three lines, covering what, why and what could go wrong, and gets approval first.
- Share it, explain it, review it. Walk through it in a team meeting with real examples, invite questions, and set a date to review it within six months.
Keep the tone practical. Rules that explain why are followed far more often than rules that only forbid.
Three situations put to the test
A marketing agency and a customer who does not exist. A small agency is asked to produce an ad for a skincare brand featuring a satisfied customer. Generating a realistic face and a glowing quote would take ten minutes. Under the policy this is “not allowed”: a fabricated testimonial presented as real misleads consumers, whatever the image quality. The agency proposes either a clearly illustrated style or a real customer who gives written consent. The client picks the real customer, and the ad carries more weight because of it.
A language centre and AI-assisted marking. Teachers want to use AI to score student essays and save hours each week. The policy marks this as high risk because grades affect students. The head teacher approves a trial with conditions: AI suggests feedback and a provisional score, a teacher makes the final decision, the team first compares AI scores with teacher scores on past essays to see whether the tool is harsher on certain writing styles, and students are told how AI is used. Essays go in without names, in line with the centre’s rules on what can safely be typed into chatbots.
A spa and a booking chatbot. A spa adds an AI chatbot to its website for bookings and simple questions. Within a week, a customer asks whether a treatment is safe during pregnancy. Because the policy treats health information as high risk, the bot has been set up to say it cannot give medical advice, to suggest asking a doctor and to offer a handover to staff. The chat window also tells visitors at the start that they are talking to an automated assistant, and the manager reads a sample of conversations each week.
In each case the policy did not block AI; it shaped how AI was used. And in each case the result was more trustworthy than the shortcut would have been, which is the real commercial argument for having rules at all.
Common mistakes when teams set AI rules
Banning AI outright. People keep using it on personal phones, now without any guidance. A clear “yes, with these rules” is safer than an ignored “no”.
Copying a big company’s policy. Long documents written for multinationals go unread in a ten-person team. Write for your own size and work.
Approving tools instead of uses. Approving a tool does not make every use acceptable. The same chatbot can draft a harmless caption or leak a client contract.
Forgetting the copyright side. Teams think about privacy but publish AI images that resemble existing works or characters. Add a quick check before publishing visuals, based on who owns AI-generated content and what can infringe.
Treating disclosure as optional. Hiding AI involvement may feel smoother, but discovery damages trust far more. Decide disclosure rules up front.
Leaving the policy without an owner. A policy nobody maintains goes stale within months as tools change. Name one person and put the review date in the calendar.
Ignoring staff concerns. Employees worried about being replaced or monitored will resist quietly. Explain what AI will and will not be used for.
Writing it once and never testing it. Walk the policy through real situations every few months. Gaps show up quickly when you look at actual cases.
When should you bring in a lawyer, a data protection specialist or other experts?
A one-page policy handles everyday use. Some situations need more. If AI will process personal data at scale, such as customer records, health information or children’s data, ask a lawyer or data protection specialist about your obligations under current Vietnamese rules and any foreign rules that apply to your customers.
If AI will make or strongly influence decisions about hiring, credit, insurance or education, get advice on discrimination and transparency obligations, and consider an independent review of the system’s fairness before launch.
For copyright questions with real money at stake, such as a brand identity, a book or a large campaign, consult an intellectual property lawyer. For health-related uses, involve qualified medical professionals in deciding what an AI system may and may not say.
When an incident happens, and where to find affordable advice
And if an incident happens, such as a data leak through an AI tool or a published fake that harms someone, act quickly: contain it, inform the people affected where required, and get legal advice before making public statements.
Outside advice does not have to be expensive. Industry associations, chambers of commerce and the business teams of banks and software vendors often run briefings on these topics. The point is to know where your own expertise ends, and to ask before something goes wrong rather than after.
Frequently asked questions
Does a ten-person company really need an AI policy?
Yes, but a short one. A single page that sets approved tools, forbidden data and who is accountable prevents most problems and saves staff from guessing.
Should we tell customers when AI wrote a message?
Tell customers when they are interacting with an automated assistant. For emails drafted with AI but reviewed and sent by a person, disclosure is less critical, because a human has taken responsibility for the content.
Can we use AI-generated “customers” in ads?
Presenting generated people as real customers, or fabricated testimonials as genuine, misleads consumers and may breach advertising rules. Use real customers with consent, or clearly illustrative imagery.
Who should own the AI policy in a small business?
Usually the director or an office manager with authority to approve tools and uses. What matters is that one named person answers questions and keeps the policy current.
How often should an AI policy be updated?
Review it at least every six months and whenever you adopt a new tool or a new high-risk use. Both AI tools and the rules around them change quickly.
Is using AI to grade or screen people ever acceptable?
It can be, as a support tool, if it is tested for bias, a human makes the final decision, people are informed and there is a way to appeal. Without those safeguards it is too risky.
