Your AI Policy Fits on One Page

80% of HR professionals in small businesses use AI in their work. Only 23% of those businesses have any written AI policy. That gap is not explained by low adoption — adoption is high. It points to something else: the governance got skipped because it looked complicated.

The informal norm argument sounds reasonable until it isn't

A fair objection runs like this: if your team already knows not to share client data outside approved systems, a separate AI policy is another document nobody reads. For a five-person agency using an AI writing assistant to draft blog posts, that objection has real weight. The EU AI Act's tiered risk architecture concentrates its obligations on high-risk deployments — AI used in hiring at scale, credit decisions, law enforcement — not a small team summarizing meeting notes.

The problem is that HR work is not low-risk tool use. Hiring decisions, employee evaluations, salary data — these sit in exactly the categories flagged as carrying regulatory and ethical risk. General IT security policies were not written to address what data gets typed into a prompt, whether staff use personal ChatGPT accounts instead of work accounts, or who reviews an AI-generated candidate assessment before it affects a real person. Those are AI-specific behaviors. Existing policies do not cover them by default.

What one page actually needs to say

The Pax8 Nebula Q2 2026 report shows 28% of small businesses relying on informal guidelines and 24% with an incomplete policy still in progress. That 52% combined is not a picture of teams with coherent informal norms — it is teams in transition, where the norm has not formed or has not been tested under pressure.

A one-page AI use policy for a lean team needs three things. First, explicit data input rules: which data categories staff are not permitted to enter into any AI tool (client PII, salary information, unpublished financials). Second, an approved tools list: the specific tools the business has reviewed, not a blanket prohibition on everything else. Third, a single escalation contact: one named person — not a role, a name — who handles questions about edge cases or incidents. That contact does not need to be a lawyer. They need to be reachable and willing to make a call.

The account separation problem nobody talks about

One practice the research identifies as high-impact gets almost no attention in the informal-norm world: separation of work and personal AI accounts. When a team member uses their personal ChatGPT account for work tasks, the business has no visibility into what data left the building, no ability to audit usage, and no standing to enforce any policy it writes after the fact. A work account under a business email, with terms reviewed by whoever owns vendor relationships, closes that specific exposure without requiring a compliance department.

IBM's Global AI Adoption Index for 2023 identifies limited AI skills and expertise as a leading barrier for smaller organizations. Asking the same time-constrained team to produce an enterprise governance framework compounds that barrier. A one-page document does not.

The checklist, timed

Set a 90-minute block. In the first 30 minutes, list every AI tool the team currently uses — not tools you plan to adopt, tools in use today. In the next 30 minutes, identify which data categories appear in your work and mark which ones should never enter a prompt. In the final 30 minutes, write the policy: approved tools, prohibited data inputs, escalation contact, and a review date 12 months out. Print it. Send it in an email so there is a timestamp. Done.

The review date matters more than the policy length. Tools change. A policy written for a team using one set of tools in 2024 needs a named moment where someone asks whether the list is still accurate. Without it, the document ages into irrelevance and the informal norm problem returns.

NIST's AI Risk Management Framework is adaptable to small teams, but it was built for organizations with dedicated staff to work through it. The practices above — data input rules, approved tools, account separation, a named escalation contact, and a scheduled review — address the privacy and security risks the Pax8 data shows as the leading stated barrier to AI adoption. They fit on one page because that is all a lean team will actually use.