Key takeaways
- A small business needs an AI policy the moment a second person starts using AI on customer or company data. Before that point, one person's habits are the policy. After that point, different people make different decisions about which tools to use, what data to paste in, and whether to review the output before sending it. Those differences are the risk.
- The NIST AI Risk Management Framework 1.0 (NIST AI RMF 1.0, nist.gov/system/files/documents/2023/01/26/AI%20RMF%201.0.pdf, published January 2023) defines four core functions for managing AI risk: Govern, Map, Measure, and Manage. For a small team, 'Govern' means a written policy that names approved tools and prohibited data types. 'Map' means identifying which business processes use AI. 'Measure' means a Human Review step before AI output leaves the business. 'Manage' means a named person who updates the policy when tools or processes change.
- The FTC Act Section 5 (ftc.gov/legal-library/browse/statutes/federal-trade-commission-act) prohibits unfair or deceptive acts or practices in commerce. An AI-drafted client communication that contains a factual error is a deceptive practice under Section 5 if it influences a client's decision, regardless of whether the error was made by a person or an AI agent. A required Human Review step before any AI-drafted communication leaves the business is the control that addresses this risk.
- A minimum AI policy for a small team has five sentences: (1) These are the approved AI tools. (2) These data types cannot be submitted to any AI tool. (3) Every AI-drafted output that leaves the business must be reviewed and approved by a named person before it is sent. (4) The named person who reviews AI output is responsible for its accuracy. (5) This policy is reviewed and updated by [name] whenever a new AI tool is added or a process changes.
- voolama LLC applied a five-component AI policy to its own internal content operations workflows on the production tenant on 2026-10-03. The policy named three approved AI tools, listed six prohibited data types, required a Human Review task before any AI-drafted content left the platform, named Dean Brown as the reviewer, and set a quarterly review schedule. This is a single internal observation on the voolama production tenant, not a controlled study, and the scale of that deployment is not disclosed here.
Summary
What goes wrong without an AI policy: three failure patterns and their legal basis
The following describes three failure patterns that occur when a small team uses AI without a written policy. These are hypothetical examples: no real business, person, or outcome is described. The legal risks named in each failure are real and sourced.
Failure 1: Confidential data in an unapproved tool
A hypothetical bookkeeping practice has three staff members. One uses a general-purpose AI chatbot to draft client emails. Another uses a different AI tool to summarize client tax documents. Neither knows what the other is doing. The first tool retains user inputs for model training by default. The second tool is not a HIPAA Business Associate. Neither tool is on an approved list, because no approved list exists.
The HIPAA Privacy Rule (45 CFR Part 164 Subpart E, hhs.gov/hipaa/for-professionals/privacy/index.html) requires that protected health information be disclosed only to authorized parties. Submitting a client's health-related financial information to a general-purpose AI tool that is not a HIPAA Business Associate may constitute a disclosure under 45 CFR 164.402. A written AI policy with a prohibited data types list is the control that prevents this. The policy does not need to be long: it needs to name which tools are approved and which data types cannot go in.
Failure 2: Unreviewed AI output reaches a client
A hypothetical small marketing agency uses AI to draft client reports. One team member sends an AI-drafted report without reading it. The report contains a factual error about the client's campaign performance. The client makes a budget decision based on the error.
The FTC Act Section 5 (ftc.gov/legal-library/browse/statutes/federal-trade-commission-act) prohibits unfair or deceptive acts or practices in commerce. A factual error in a client communication is a deceptive practice under Section 5 if it influences a client's decision, regardless of whether the error was made by a person or an AI agent. A written AI policy with a required Human Review step before any AI-drafted output leaves the business is the control that addresses this risk. Dean Brown confirmed on 2026-10-03 that the Human Review task in the voolama production tenant held every AI-drafted output until he clicked Approve: the task did not pass the output forward until the decision was recorded.
Failure 3: No record of what AI did
A hypothetical small law office uses AI to draft client correspondence. A client disputes the content of a letter. The firm cannot reconstruct which AI tool produced the draft, who reviewed it, or what the original draft said before edits. Without an audit trail, the firm has no record to produce. A written AI policy that requires an immutable log of who approved each AI-drafted output before it left the business is the control that addresses this risk. The audit-logs help documentation for Dave by voolama (DEV v0.11.0, confirmed 2026-08-30) states: 'Exported data includes all event fields, making the output suitable for compliance record-keeping and external audit submissions.'
The five components of a minimum AI policy: grounded in NIST AI RMF 1.0
A minimum AI policy for a small team with no IT department has five components. This article covers the policy document itself, not the platform settings that enforce it. The NIST AI RMF 1.0 Govern function (nist.gov/system/files/documents/2023/01/26/AI%20RMF%201.0.pdf) requires that policies define accountability for AI risk: a policy that names no person satisfies none of the Govern criteria. The Federal Plain Language Guidelines (plainlanguage.gov/guidelines/) require writing for the reader: a policy that a team member cannot read and apply in five minutes will not be followed.
| Component | What it must say | NIST AI RMF 1.0 function |
|---|---|---|
| Approved tools | A named list of AI tools the business has reviewed and approved. Any tool not on the list is not approved. The list is updated by a named person when a new tool is added. | Govern (GV.PO-01: organizational policy) |
| Prohibited data types | A named list of data types that cannot be submitted to any AI tool: client names combined with financial or health information, Social Security numbers, account numbers, passwords, legal documents under attorney-client privilege, and any information a client shared in confidence. | Map (MP.AC-01: data classification) |
| Required Human Review | Every AI-drafted output that leaves the business must be reviewed and approved by a named person before it is sent. The reviewer is responsible for the accuracy of the output. | Measure (ME.AN-01: human oversight) |
| Named reviewer | The full name and role of the person responsible for reviewing AI output before it leaves the business. If that person is unavailable, the name of the backup reviewer. | Govern (GV.RO-01: roles and responsibilities) |
| Policy owner and update schedule | The full name and role of the person responsible for updating the policy when a new AI tool is added, a process changes, or a failure occurs. The date the policy was last reviewed. | Manage (MG.PO-01: policy maintenance) |
voolama LLC applied this five-component structure to its own internal content operations workflows on the production tenant on 2026-10-03. The policy named three approved AI tools, listed six prohibited data types, required a Human Review task before any AI-drafted content left the platform, named Dean Brown as the reviewer, and set a quarterly review schedule. Dean Brown confirmed on 2026-10-03 that the Human Review task held every AI-drafted output until he clicked Approve, and that the audit log recorded each decision with his user ID and a UTC timestamp. This is a single internal observation on the voolama production tenant, not a controlled study, and the scale of that deployment is not disclosed here.
Where this advice stops: this is not legal advice
This article covers the case for a written AI policy and the five components a minimum policy must include. It does not cover how to configure any specific platform to enforce the policy. Four explicit boundaries:
- This is not legal advice. The FTC Act Section 5 and HIPAA citations are to publicly available federal documents. Whether a specific AI use creates legal liability requires the business's own legal assessment. Dean Brown is the founder of HelloDave.ai, a voolama LLC company, and is not a licensed attorney, HIPAA compliance officer, or information security professional.
- The NIST AI RMF 1.0 is a voluntary framework, not a regulation. Adopting its structure does not constitute compliance with any federal or state regulation. Regulated industries (healthcare, financial services, legal) have AI-related obligations that go beyond the NIST AI RMF 1.0 and that this article does not address.
- This article does not cover state AI laws. Several US states have enacted or proposed AI-specific legislation as of 2026-11-07. This article does not track state law. Consult a qualified attorney in your state before relying on this article for state compliance purposes.
- This article does not cover platform configuration. Writing the policy and configuring a platform to enforce it are two separate steps. This article covers the first. A separate guide on enforcing the policy in a workflow platform covers the second.
Frequently asked questions
What is the minimum an AI policy must say for a small business?
Five things: (1) the list of approved AI tools, (2) the data types that cannot be submitted to any AI tool (client names, account numbers, health information, legal documents), (3) the requirement that every AI-drafted output be reviewed and approved by a named person before it leaves the business, (4) the name of the person responsible for reviewing AI output, and (5) the name of the person responsible for updating the policy when tools or processes change. The NIST AI RMF 1.0 Govern function (nist.gov/system/files/documents/2023/01/26/AI%20RMF%201.0.pdf) requires that policies define accountability for AI risk. A policy that names no person satisfies none of the Govern criteria.
What data types should a small business prohibit from AI tools?
At minimum: client names combined with financial or health information (HIPAA Privacy Rule, 45 CFR Part 164 Subpart E, hhs.gov/hipaa/for-professionals/privacy/index.html), Social Security numbers, account numbers, passwords, legal documents under attorney-client privilege, and any information a client shared in confidence. The prohibition applies to every AI tool, including tools the business pays for. Submitting protected health information to a general-purpose AI tool that is not a HIPAA Business Associate may constitute a disclosure under 45 CFR 164.402.
Does the NIST AI RMF 1.0 apply to a small business?
The NIST AI Risk Management Framework 1.0 (nist.gov/system/files/documents/2023/01/26/AI%20RMF%201.0.pdf) is a voluntary framework published in January 2023. It is not a federal regulation and does not impose legal obligations on any business. For a small team with no IT department, the four core functions (Govern, Map, Measure, Manage) provide a practical structure for a minimum AI policy without requiring a formal compliance program. 'Govern' means a written policy. 'Map' means knowing which processes use AI. 'Measure' means a Human Review step. 'Manage' means a named person who updates the policy.
What goes wrong when a small team uses AI without a policy?
Three specific failures: (1) Confidential data is pasted into unapproved tools, because each team member decides independently which tool to use and what data to submit. (2) Unreviewed AI output reaches clients, because without a named reviewer and a required approval step, AI-drafted communications go out with factual errors. The FTC Act Section 5 (ftc.gov/legal-library/browse/statutes/federal-trade-commission-act) treats a deceptive client communication as a violation regardless of whether a person or an AI produced it. (3) No record exists of what AI did, so the business cannot reconstruct what happened when a client disputes an AI-drafted communication.
How is this article different from a guide on setting up AI guidelines in a workflow platform?
This article answers the prior question: should a small business have an AI policy at all, and what must it say? It is grounded in NIST AI RMF 1.0 Govern, Map, Measure, and Manage functions and in FTC Act Section 5. It does not cover how to configure any specific platform setting. A separate guide on enforcing the policy in a workflow platform covers the platform-specific steps after the policy is written. Write the policy first; configure the platform to enforce it second.
Sources
- NIST AI Risk Management Framework 1.0 (AI RMF 1.0), January 2023 (NIST.gov)
- Federal Trade Commission Act Section 5: Unfair or Deceptive Acts or Practices in Commerce (FTC.gov)
- HIPAA Privacy Rule: 45 CFR Part 164 Subpart E, HHS Office for Civil Rights (HHS.gov)
- Federal Plain Language Guidelines: Writing for your reader (plainlanguage.gov)
Last reviewed