Your team is already using AI. Someone is drafting client
emails in ChatGPT. Someone else installed a meeting note-taker last month. A
manager pasted a spreadsheet into a free chatbot to "clean it up."
Nobody asked permission because nobody said they needed to.
That's why an AI policy for small business has moved from a
nice-to-have to a basic control. In Microsoft and LinkedIn's 2024 Work Trend Index, 75% of knowledge
workers said they use AI at work, and 78% of those users bring their own AI
tools.
This guide is for CEOs and COOs at firms of 10 to 200
people, including the many Chicago businesses we talk to every week. It covers
why you need a policy now, what goes in it, how to protect client data, who
should own it, and how to roll it out without slowing anyone down.
Why is an AI policy for small business urgent now?
A small business needs an AI policy now because employees
are already using AI tools, often personal accounts, with company and client
data. Without written rules, you can't control what data leaves the building,
which tools are safe, or who checks the output. A short policy fixes that
quickly.
The gap between use and oversight is wide. Verizon's 2026 Data Breach Investigations Report found
that 45% of employees are now regular AI users on corporate devices, up from
15% the year before, and 67% of users reach AI tools through non-corporate
accounts on those devices.
The cost of skipping governance shows up when something goes
wrong. IBM's 2025 Cost of a Data Breach research found that
63% of the organizations studied had no AI governance policies, and high levels
of "shadow AI" (unapproved AI tools) added USD 670,000 to the average
breach cost.
What Illinois law means for Chicago businesses
If you employ people in Illinois, an amendment to the
Illinois Human Rights Act (HB 3773) took effect January 1, 2026. It requires
employers to notify employees when AI is used in decisions such as hiring,
promotion, and discipline, and it bars AI use that has a discriminatory effect.
Your AI policy is the natural place to say which tools touch HR decisions and
who signs off. (This is general information. Talk to your employment counsel
about your specific obligations.)
What should an AI acceptable use policy include?
An AI acceptable use policy should list approved, limited,
and prohibited tools; define which data can never go into AI; require human
review of AI output; explain how to request a new tool; and say who to tell
when something goes wrong. For most small firms, 2 to 4 pages is enough.
Here's a structure that works for most small firms:
·
Purpose
and scope. Who the policy covers (employees, contractors) and which tools
count as AI, including features built into software you already use.
·
Approved
tools in 3 tiers. A green list of approved business tools, a yellow list of
limited tools for public information only, and a red list of prohibited tools,
such as free consumer accounts that may use your inputs to train their models.
·
Data
rules. What never goes into an unapproved tool: client files, financials,
personnel records, passwords, health information, and anything under a
nondisclosure agreement.
·
Human
review. A person checks AI output before it reaches a client, a court, a
regulator, or a financial decision.
·
New tool
requests. One simple path to ask for a tool, with a named person who
approves it.
·
Incident
reporting. What to do if someone pastes the wrong thing into the wrong
tool. Fast reporting beats silence.
·
Training
and acknowledgment. Everyone completes short training and signs the policy.
Keep the language plain. If a staff member can't tell in 30
seconds whether a task is allowed, rewrite it.
Which AI tools are your employees already using?
Most firms find 3 kinds of AI use: chat assistants on
personal accounts, AI features switched on inside software they already pay
for, and add-ons like browser extensions and meeting note-takers. You can't
govern what you haven't listed, so take inventory before you write rules.
A quick way to build the list:
1. Ask, with amnesty. Send a 5-question
survey and promise no one gets in trouble for honest answers. You'll learn more
in a week than an audit finds in a month.
2. Check your sign-ins. Review which
outside apps employees have connected to Microsoft 365 or Google Workspace
accounts.
3. Check expenses. Look for AI
subscriptions on company cards and expense reports.
4. Ask department heads. Marketing,
finance, and HR usually adopt AI first.
Expect surprises. Keep the process blame-free, because the
goal is to learn where your data already goes.
How do you protect client data when staff use ChatGPT and other AI tools?
Protect client data by giving staff an approved business AI
platform with contract terms that prohibit training on your data, then setting
clear rules for what information can go into any AI tool. Pair that with
sign-in controls, admin visibility, and training so the safe path is also the
easy one.
Blocking every AI tool rarely works. People find workarounds
on their phones. A better approach:
·
Provide
an approved platform. Choose one that's built for business use, with single
sign-on, role-based access, and audit logs.
·
Check the
data terms. Free consumer tools may use your inputs to train their models.
Business platforms should put "no training on your data" in writing.
·
Classify
your data. Define public, internal, confidential, and restricted
information in plain words, and map each level to the tools allowed to touch
it.
·
Add
guardrails for regulated work. Law firms need to protect privilege.
Financial and wealth management firms need to protect client personal
information. Healthcare-adjacent firms need a Business Associate Agreement
where protected health information is involved.
This is why we offer Managed Framework AI to our partners.
It runs on an enterprise platform that's SOC 2 Type I, SOC 2 Type II, and SOC 3
certified. Partner data is encrypted, isolated from other organizations, and
never used to train AI models. Administrators control who can use which models
and features, with full audit trails.
Who should own AI governance in a 50-person firm?
In a 50-person firm, a senior leader (usually the CEO or
COO) should own AI governance decisions, one operations lead should run the
policy day to day, and your IT partner should vet tools and enforce technical
controls. Department "AI champions" help colleagues use approved
tools well.
A simple ownership model:
·
Executive
sponsor: sets the risk tolerance and approves the policy.
·
Policy
owner: often the COO, operations director, or office manager. Keeps the
approved-tool list current and handles requests.
·
IT
partner or virtual Chief Information Officer (vCIO): reviews new tools for
security and data handling, configures access controls, and updates the policy
as tools change.
·
AI
champions: 1 per department. They answer questions, share what works, and
report problems early.
·
Legal or
compliance: reviews rules for privileged, regulated, or HR-related use.
At Framework IT, responsible AI guidance is part of every
managed services engagement. Our Partnership Guarantees include proactive
guidance on responsible AI policies and a commitment to help each partner
identify at least 1 real-world AI use case for their business. Your vCIO covers
AI and automation strategy alongside security and budgeting, so AI governance
sits inside your IT plan. Learn more about our AI services.
How do you roll out an AI policy without slowing people down?
Roll out an AI policy alongside an approved tool, short
training, and a few quick wins in the first month. People follow rules more
willingly when the approved path is faster than the workaround. Start small,
show results, and expand by department.
The rollout we use follows a "Crawl, Walk, Run"
approach:
·
Crawl
(weeks 1 to 4): publish the policy, give everyone access to the approved
platform, complete training, and pick 3 to 5 quick wins, like summarizing long
reports or drafting first-pass client emails.
·
Walk
(months 2 to 6): build workflows for specific departments and track time
saved.
·
Run
(month 6 and beyond): build AI into core processes, with a governance group
that reviews new uses.
Training doesn't need to eat a week. Our AI Champion
Certification takes about 90 minutes. After that, partners in the Managed
Framework AI adoption program meet monthly with us for an AI Strategic Business
Review, and every Managed Framework AI partner gets access to the Framework AI
Resources Hub from day one. The hub holds training videos, getting-started
guides for leaders and employees, industry playbooks, office hours schedules,
and our library of Framework-built AI workflows and agents.
What does a good AI policy for small business look like in practice?
Firms that get AI right treat it as part of their IT plan,
with governance and enablement together. They know which tools are in use,
they've given staff a safe default, and someone reviews the policy as tools
change. We see the same pattern across professional services, legal, and
financial firms we support.
That's also why AI belongs on your IT roadmap. If your
current provider has never asked how your team uses AI, that's a sign your IT
is still reactive. Our guide to proactive IT management explains what a plan
should cover. For Chicago law firms and wealth managers, we've written more
about IT for law firms and RIAs and wealth management firms.
Frequently Asked Questions
Is an AI policy legally required?
Most U.S. businesses aren't required to have a standalone AI
policy. But data privacy laws, client contracts, industry regulators, and cyber
insurers expect you to control how sensitive data is handled, and AI tools are
part of that. Illinois employers also have notice duties when AI is used in
employment decisions.
How long should an AI policy be?
For a firm under 200 people, 2 to 4 pages usually works. Put
the approved-tool list and data rules on the first page so people actually read
them.
Can employees use free ChatGPT for work?
They can, but they shouldn't use it with client or
confidential data. Free consumer tools may use inputs to train their models and
give you no admin visibility. Give staff an approved business tool instead.
What is shadow AI?
Shadow AI is the use of AI tools that the company hasn't
approved or can't see, like personal chatbot accounts, browser extensions, or
AI features switched on without IT review. It's the AI version of shadow IT.
How often should we update our AI policy?
Review it at least twice a year, and update the
approved-tool list whenever you add or drop a tool. AI products change fast, so
a set review date matters more than a perfect first draft.
The Bottom Line
Your employees will use AI whether or not you write a
policy. A short, plain AI policy for small business teams, an approved tool,
and 90 minutes of training turn that habit into an advantage.
You don't have to build it alone. We help Chicagoland firms
write the policy, choose and secure the tools, and train the team, then fold AI
into the IT roadmap.
Book an AI readiness conversation with
our team to see where your firm stands and what to do first.
Framework IT | 700 N. Sacramento Blvd., Suite 101, Chicago,
IL 60612 | (312) 564-5446
About the Author
Adam Barney is President and Managing Partner of Framework
IT, a premier managed IT and telecommunications firm based in Chicago. With
more than 15 years of executive experience in managed services and
telecommunications, Adam leads with a core philosophy that technology should be
user-friendly and approachable, empowering businesses to thrive in their
respective industries.
Since assuming the presidency in January 2020, Adam has led
a team of over 40 professionals spanning sales, information technology,
operations, marketing, human resources, and fulfillment. Under his leadership,
Framework IT remains committed to its unique inverted-pyramid approach, which
ensures clients' needs and aspirations are always the company's top priority.
Founded in 2008, Framework IT specializes in IT support,
strategy, and cybersecurity for small and mid-sized businesses nationwide. The
company's 30+ engineers act as an extension of client businesses, proactively
preventing IT issues so teams have more time to focus on what truly matters.
During his career, Adam has consulted over 1,000 companies, helping them
transform and streamline their technology infrastructure.
In recent years, Adam has spearheaded the adoption of
artificial intelligence in Framework's internal operations and service
delivery, positioning the company at the forefront of AI-driven IT management.
He has pioneered the launch of a new service offering to help clients implement
AI and AI-based automation in their own businesses, enabling organizations to
unlock new levels of efficiency and competitive advantage. Adam is also a
founding member of The Forge AI Alliance of MSPs, an alliance of managed service
providers working to accelerate the adoption of AI and automation in their own
companies and those of their clients.
Under Adam's leadership, Framework IT has been named to the
Inc. 500 Fastest Growing Private Companies in America twice and the Inc. 5000
list at least five times over the past decade. The company has been ranked one
of the Best & Brightest Places to Work in Chicago for five consecutive
years and one of the Best & Brightest Places to Work in the Nation twice in
the last five years. Framework IT has maintained a BBB complaint-free record
since 2008.
Adam's expertise has positioned him as a sought-after voice
in managed services and business technology. His insights have been featured in
the Harvard Business Review, the Washington Post, and Fox 32 Chicago. Adam has
also served as a speaker and panelist at the Chicago Bar Association AI
Symposium, sharing practical guidance on AI adoption with the legal community.
Adam holds a Bachelor of Science in Finance and Business
Administration from the University of Illinois Urbana-Champaign, where he
graduated Summa Cum Laude. He maintains numerous industry certifications,
including ITIL Foundations and multiple AI and cybersecurity certifications.
Outside of work, Adam is a husband and father of two
daughters, as well as an avid reader with interests spanning leadership,
management, psychology, and technology.
