Small Business AI Policy Checklist

Three Samsung engineers pasted proprietary source code into ChatGPT. Samsung is not a small business without an IT department. Samsung had technical controls. What it lacked was a clear rule telling engineers that source code was out of scope for public AI tools. The breach came from a behavioural decision, not a missing firewall. That sequence matters for every founder who thinks the answer is a better tool rather than a clearer rule.

The behaviour that causes the leak

Security telemetry on how staff use generative AI at work shows a consistent pattern: employees copy and paste source code, financial records, and client personal data into public tools. Not because they want to cause harm. Because no one told them not to, and the task needed finishing. The absence of a rule is not neutral. It is a decision by default, and the default is exposure.

A written policy without any enforcement component is under-powered, and this is worth saying plainly rather than papering over. If you write a rule and never mention it again, you have created documented proof the risk was known, without changing what happens at 4pm on a Friday when someone needs to draft a client report fast. The Salesforce research finding that more than four fifths of SMB leaders weight trust and security in vendor purchasing decisions cuts both ways: your clients are asking the same question about you.

What the checklist needs to cover

The policy does not need to be long. It needs to be specific about four things.

Data handling comes first. Name the categories of data staff cannot paste into public AI tools: client personal data, financial records, source code, anything under an NDA. "Sensitive information" is too vague to act on. A staff member who does not know whether a draft contract counts as sensitive will make a guess. Give them a list instead.

Approved vendors comes second. Pick two or three tools your team is allowed to use for work tasks, and name them. The OECD and NIST guidance on proportionate AI governance does not call for blanket bans. It calls for accountability at the point of use. An approved vendor list is accountability made concrete: if a staff member uses a tool not on the list, that is a conversation, not a mystery.

Version control is the piece most checklists skip. AI tools do not produce a single authoritative output. A staff member who asks the same question twice gets two different answers. For anything client-facing, the policy should require that the human-reviewed final version is what gets saved and sent, not the raw AI output. This is not about distrusting the tool. It is about knowing which version of a document is the real one.

Employee responsibilities close the loop. Name one person, by role, who fields questions about edge cases. Not a committee. One person. Staff who are unsure whether a task falls inside the rules need somewhere to go that is not "figure it out yourself." The research on proportionate governance from the OECD and UK ICO converges on this: light monitoring and a named point of contact do more than a longer rulebook.

Why the written rule beats the missing one

The counterargument worth taking seriously is this: a small business with no dedicated IT function cannot enforce a written policy, so the policy creates false assurance. Security researchers who documented the Samsung leak and the copy-paste telemetry do argue for browser-based data loss prevention tools alongside any prohibition. They are right that a rule without any monitoring is under-powered.

The counterargument fails at a specific point. It assumes the choice is between a policy with full technical enforcement and a policy with none. The moderate position in the OECD and practitioner guidance is a third option: a clear rule, a 30-minute onboarding session on what counts as sensitive data, a shared log of which AI tools the team uses, and one named person for edge cases. None of that requires an IT budget. All of it addresses the decision point the Samsung engineers faced, which was not a missing DLP tool but a missing rule.

A client who asks what your AI data handling rules are gets a documentable answer. That answer does not require enterprise software to be credible. It requires that the rules exist, that staff know them, and that someone is responsible for keeping them current.

Run the 30-minute onboarding before the end of the month. The policy document means nothing until the person pasting the client records has read it.