What Should an AI Policy for a Small Business Cover?

An AI policy for a small business sets out which tools staff may use, what data may go into them, who reviews AI output before it reaches a customer, and how customers are told when they are speaking to AI. This guide covers the eight sections to include, the California rules that apply, and how to roll it out.

What is an AI policy, and why would a small business need one?

AI policy: a short written document that states which AI tools your business permits, what data may be entered into them, who is accountable for checking AI output before it is used, and how customers and staff are told when AI is involved.

The usual objection is that governance is a problem for large companies. In practice the opposite is true. A large company has a legal department deciding what goes into which tool. A twelve person office in Irvine has an office manager pasting a signed contract into a free chat tool to summarize it, with nobody to ask. The exposure is the same; the guardrails are not.

A policy is also what makes AI adoption faster rather than slower. When staff know which tools are approved and which data is off limits, they stop asking permission for everything and stop guessing on the rest. We treat the policy as a prerequisite for deployment, not paperwork that follows it. That is the same sequencing we describe in what it means to be an AI-native business.

What are the eight sections an AI policy should cover?

Write these in plain language, in this order. Each one answers a question an employee will actually ask.

1. Scope and who it covers. Employees, contractors, and anyone using a company account. Say whether it covers personal AI accounts used for work, because that is where most unapproved use happens.
2. Approved tools. A named list, not a category. "The assistant in our Microsoft tenant" is a rule; "reputable AI tools" is not. Include how to request an addition.
3. Data that may never be entered. Be specific to your business: customer records, signed agreements, pricing not yet public, payroll, protected health information, card numbers, anything under a client confidentiality clause.
4. Human review before output is used. Name the cases where a person must read the output before it reaches a customer, a file or a regulator. Anything that quotes a price, makes a commitment, or states a fact about a customer belongs here.
5. Disclosure. When customers are told AI is involved, and in what words. Cover calls, chat, email and recording notices together, because they appear in the same conversation.
6. AI in hiring and people decisions. The tightest section in the policy, and the one most often missing. See the rules below.
7. Vendor review. What you check before a new tool goes live: what data it receives, where it is stored, whether your inputs train the vendor's models, and who approved it.
8. Ownership, training and review date. One named owner, a short onboarding briefing, and a fixed date to re-read the policy. Quarterly is realistic for a small team.

If you want a published structure behind yours, the NIST AI Risk Management Framework organizes AI risk into govern, map, measure and manage functions, and it is voluntary guidance rather than a standard you have to certify against. Borrowing its skeleton gives your policy a defensible shape without turning it into a compliance project.

Which rules actually apply to a California business?

This is where most templates downloaded from the internet fail an Orange County business, because they are written for a national audience and skip California specifics. These are the ones that come up most in our advisory work as of October 2026. None of this is legal advice; confirm the detail with your attorney.

Rule	What it governs	Who it applies to	What your policy should say
Penal Code 632 and 632.7	Recording a confidential communication without the consent of all parties	Any business recording calls in California	Announce recording at the start of every call and keep the notice in the script
Business and Professions Code 17941	Misleading someone about a bot's artificial identity to incentivize a sale	Online and automated commercial interactions	Disclose clearly and conspicuously that the person is dealing with an automated assistant
FEHA automated decision system rules	AI used in hiring, promotion, training selection and similar decisions	California employers covered by FEHA, effective October 1, 2025	Keep AI out of the final decision, retain automated decision system records four years
CCPA automated decisionmaking rules	Automated decisions about lending, housing, education, employment or health care	Businesses meeting CCPA thresholds, ADMT duties from January 1, 2027	Pre-use notice, an opt-out, and a risk assessment before the use starts
FTC Act enforcement	Deceptive claims about AI, or deception carried out with AI	Every business	No AI claim in marketing that the product cannot support

Two of these deserve a note. The employment rules are broader than people expect: an automated decision system is defined as a computational process that makes or facilitates a decision about an employment benefit, and an employer is responsible for the tool whether or not it built it, with records kept for four years, per the published guidance on the regulations. A resume screener you bought is still yours to answer for.

The CCPA rules, by contrast, may not reach you at all. They apply to businesses that meet the CCPA's own thresholds, and many local firms do not. The useful part for a small business is the shape of the obligation rather than the obligation itself: notice before use, a way to opt out, and an assessment written down before you start. The CPPA's own announcement sets the automated decisionmaking compliance date at January 1, 2027, which is enough runway to adopt the practice voluntarily and be ready if you grow into scope.

On marketing claims, the FTC has been explicit that there is no AI exemption from existing consumer protection law. Your policy should route AI claims through the same review as any other advertising claim.

How should the policy handle calls and recording?

Calls are where a small business's AI use is most visible to customers and most regulated. California requires the consent of all parties to record a confidential communication, under Penal Code 632, and section 632.7 extends that to cell and cordless calls. The practical answer is a single opening line that handles both the recording and the AI disclosure, every time, with no discretion left to the person or the agent on the call.

Write the words into the policy and into the call script, not just the principle. Then make sure the route to a human is real and short. If you run an AI voice agent such as Donya, the disclosure and the escalation path are configuration, so they can be fixed in an afternoon once the policy says what they should be. Our call recording notice generator produces notice wording you can take to your attorney as a starting point.

How do you write and roll out the policy?

1. List what is already in use. Ask every team which AI tools they touch, including personal accounts. The list is always longer than leadership expects.
2. Decide the approved list. Approve few tools, well. Consolidating on tools inside systems you already pay for removes most data questions at once.
3. Write the banned data list first. It is the section that prevents the worst outcome, and it takes an hour.
4. Set the human review rule. Tie it to consequence, not to tool. Anything that commits the company gets read by a person.
5. Write the disclosure wording. Calls, chat and email. Get it reviewed by your attorney once rather than per channel.
6. Name the owner and the review date. Put both on page one, with a name, not a job title alone.
7. Brief the team in fifteen minutes. One meeting, the one page, and the three examples most likely to come up in their actual work.
8. Review on the date you set. New tools, new rules and real incidents all land in that review.

What does an AI policy not fix?

Honest limits matter here. A policy does not stop a confident wrong answer from an AI tool; only human review does. It does not secure your data if staff are on unmanaged devices and an open guest network. It does not make a vendor's data practices acceptable, and it cannot substitute for reading a contract. It will not make an AI deployment work if the phone system, CRM and network underneath it are not ready, which is what the AI readiness assessment is for. Treat the policy as one of several controls, and the weakest ones will usually turn out to be technical rather than written.

Key takeaways

• An AI policy is two or three pages: approved tools, banned data, human review, disclosure, hiring, vendors, and a named owner.
• Small businesses need one more than large ones, because nobody else is deciding what goes into which tool.
• California specifics matter: all-party consent for recordings, clear bot disclosure, and employment rules that make you responsible for tools you bought.
• CCPA automated decisionmaking duties may not reach you yet, but the notice, opt-out and risk assessment pattern is worth adopting early.
• Policy comes before deployment, and review before any output reaches a customer.

How Telxpress helps

Telxpress is an Irvine business solutions provider and AI advisor. Policy and governance are part of our AI advisory engagement: we inventory what your team already uses, write the policy in plain language with your counsel reviewing the legal wording, set the disclosure and recording scripts, and then build and support the systems the policy governs, from the voice agent to the network underneath it. Start with the free AI readiness assessment and we will tell you honestly whether policy or infrastructure is your first problem.