How to Write an AI Use Policy for Your Alberta Small Business (Without a Lawyer on Retainer)

Most Alberta small businesses already have an AI policy. They just do not know it. It is whatever each employee decided on their own last Tuesday when they pasted a customer email into a free chatbot to get a faster reply.

That is not a criticism of your team. It is what happens when a useful tool shows up and nobody says where the lines are. I would rather you have a short, written policy that people actually follow than a twelve-page document that sits in a shared drive.

This post walks through how I help business owners write a one-page AI use policy. It is practical, it takes a few hours, and it does not require a legal department. If your situation involves regulated data, contracts with strict confidentiality terms, or anything that smells like legal exposure, have a lawyer review the final version. Everything below is operational guidance, not legal advice.

Why a small business needs an AI policy at all

Three things go wrong when there is no policy.

Customer or company data ends up in the wrong place. Someone pastes a client list, a quote, a contract, or an employee issue into a consumer AI tool. Depending on the tool and the account settings, that data may be retained or used in ways you did not intend. You often will not know it happened.

Inaccurate output reaches customers. AI drafts are fluent, and fluent text feels trustworthy. A wrong price, a made-up policy, or an invented product spec goes out under your name because nobody was assigned to check it.

The good uses never get shared. The employee who figured out a clever way to summarize job notes keeps it to themselves, or worse, quits using it because they are not sure it is allowed. You pay the risk but miss the benefit.

A policy fixes all three. It sets guardrails, it names who checks what, and it gives people permission to use AI well. If you have already read my overview of AI for small business in Alberta, think of this as the governance layer that makes those ideas safe to roll out.

What a good small business AI policy looks like

Aim for one page, two at most. If a new hire cannot read it in five minutes, it is too long. I build mine around six sections:

1. Purpose and scope
2. Approved tools
3. Data rules (what never goes in)
4. Review rules (what a human must check)
5. Disclosure and customer-facing use
6. Ownership and updates

Let me take them one at a time, with the decisions you need to make for each.

1. Purpose and scope

Open with two or three sentences. Say why the policy exists and who it covers. Something like:

“We use AI tools to work faster and serve customers better. This policy sets the rules so we do that safely. It applies to every employee, contractor, and freelancer who does work for us.”

Include contractors. A freelancer writing your website copy with an unapproved tool is still producing work in your name with your information.

2. Approved tools

This is the section that does the most work. Instead of trying to write rules for every possible tool, name the specific ones people may use and for what.

Build a simple list with three columns of information, written as short lines:

• Tool name and plan. For example, “ChatGPT Team” or “Microsoft Copilot under our business account,” not just “ChatGPT.” The plan matters because business and enterprise tiers typically come with different data handling terms than free consumer accounts.
• Approved uses. Drafting internal documents, summarizing meeting notes, brainstorming, cleaning up spreadsheets.
• Not approved for. Anything involving the data categories in section 3.

How do you decide whether a tool makes the list? Use these criteria:

• Data handling terms. Read what the vendor says about retention and whether your inputs are used for training. Prefer plans where you can opt out of training and where the vendor commits to that in writing.
• Account control. Can you create accounts under the company, remove them when someone leaves, and see who is using it? Shared personal logins are a red flag.
• Where the data goes. Many AI tools process data outside Canada. That is not automatically a problem, but you should know it and disclose it where your obligations require it.
• Cost against value. A tool nobody uses is not a risk, it is just a bill. Keep the list short. Three well-chosen tools beat fifteen half-vetted ones.

If you are still figuring out which tools are worth paying for, my rundown of AI tools for business owners in 2026 is a reasonable starting point, and how much AI actually costs will help you budget.

Add one line for everything else: “If a tool is not on this list, ask before using it with any company information.” That single sentence handles the tools that did not exist when you wrote the policy.

3. Data rules: what never goes into an AI tool

This is the section people skim, so make it concrete. Use three tiers.

Never enter (red). Examples for most small businesses:

• Customer personal information beyond a first name (full names with contact details, addresses, payment details, health information)
• Employee records, performance issues, medical or HR matters
• Passwords, API keys, banking details
• Anything covered by a confidentiality agreement or client contract that restricts third-party sharing
• Unreleased financials or legal documents

Enter only in approved tools (yellow). Internal process documents, anonymized customer scenarios, pricing structures, draft marketing, meeting notes without sensitive details.

Fine anywhere (green). Public information, generic questions, publicly available company material, brainstorming with no real data.

Then give people a trick to stay safe: anonymize first. Replace “Sarah Jenkins at 42 Birch Crescent in Sexsmith” with “Customer A.” You still get the draft, and the sensitive details never leave your systems.

Alberta private-sector businesses generally fall under the Personal Information Protection Act (PIPA), and some also have federal obligations. I am not going to summarize the law here, because the details depend on your business and I would rather you get that right. What I will say is that a clear data rule in your policy gives you a documented position if a customer ever asks how their information is handled. If you handle health, financial, or other sensitive categories, get proper advice before finalizing this section. My post on preparing business data for AI goes deeper on sorting what you have.

4. Review rules: what a human must check

AI output is a draft. Your policy should say so plainly, then specify which drafts need which kind of review.

I use a simple rule based on who sees the output:

• Internal only, low stakes (meeting summaries, brainstorm lists): the person who used the tool reviews it.
• Customer-facing (emails, quotes, proposals, website copy, social posts): the author reviews it for accuracy and tone, and anything involving prices, dates, legal terms, or promises gets a second look from a named person.
• High consequence (contracts, safety documents, regulatory filings, HR decisions, medical or financial guidance): AI may assist with a first draft or research, but a qualified person owns and signs off on the final version. No exceptions.

Add a short “check these every time” list for customer-facing work:

• Are names, numbers, dates, and prices correct?
• Does it describe a service, policy, or guarantee we actually offer?
• Are any facts or sources invented? Click the links. Verify the quotes.
• Does it sound like us?

Hallucination, where a tool states something false with total confidence, is a known limitation of current language models. The policy cannot remove it. It can make sure a person is accountable for catching it.

This matters most for automated systems. If you are considering a chatbot or agent that talks to customers directly, the review model changes from checking each message to monitoring samples and setting escalation rules. I cover that difference in AI chatbots vs AI agents and what customer-facing automation looks like in practice in AI customer service for Alberta businesses.

5. Disclosure and customer-facing use

Decide, and write down, how you talk about AI with customers. There is no single right answer, but there should be a consistent one.

Questions to settle:

• Will customers know when they are talking to an automated system? My recommendation is yes, always. A short line such as “I’m an automated assistant, and I can connect you with a person” costs you nothing and protects trust.
• Do you label AI-assisted content? Many businesses do not label a blog post that a human edited and approved, but they do disclose AI-generated images or automated replies. Pick a rule and keep it.
• How can a customer reach a human? Every automated channel needs an obvious path to a person.
• Do any client contracts address AI use? Some larger clients, particularly in oil and gas, construction, and professional services, are starting to include AI clauses in vendor agreements. Check before you assume. If you serve those industries, it is worth reading AI in oil and gas in Alberta and AI for trades and construction in Alberta for the operational context.

6. Ownership and updates

A policy with no owner decays. Name one person, usually the owner or operations lead, who:

• Approves new tools
• Answers “can I use AI for this?” questions
• Reviews the policy every six months, or sooner when a tool or law changes
• Keeps a short log of incidents and near misses

Also include a no-blame reporting line: “If you think you entered something you should not have, tell us right away. You will not be punished for reporting.” This is the single most useful sentence in the whole document. Mistakes happen. You want to hear about them in hours, not months.

How to roll it out in about two weeks

Writing the document is the easy part. Getting people to follow it takes a little structure.

Days 1 to 3: Find out what is already happening. Ask your team, without judgment, what AI tools they already use and for what. You will learn more from this conversation than from any template. Some of what you hear will be smart and worth formalizing.

Days 4 to 7: Draft and decide. Use the template above. Pick your approved tools, set the red list, and name the owner. If you have regulated data or contracts with confidentiality terms, send the draft to your lawyer or insurer for a quick review.

Days 8 to 10: Walk the team through it. Thirty minutes, live, with real examples. Show one thing that is fine, one that is not, and how to anonymize. Let people ask questions. A policy people understand beats one they have merely been emailed.

Days 11 to 14: Set up the basics. Move people onto company accounts for approved tools, turn off training or history settings where the plan allows, and bookmark the policy somewhere people will find it.

Decision criteria: do you need more than a one-page policy?

A one-page policy is enough for most businesses with under 25 or so people who use AI for drafting, summarizing, and internal productivity. You likely need something heavier if:

• You handle health, financial, or other sensitive personal information
• Your clients require vendor AI disclosures or audits
• You are building automations that act on their own, such as sending emails, updating records, or quoting prices
• You operate in a regulated industry with specific professional obligations

In those cases, the policy becomes one piece of a larger plan that includes access controls, logging, testing, and a human escalation path. If you are heading that way, my AI readiness assessment guide is a good next step, and so are the questions to ask before hiring an AI consultant.

Get help if you want it

If you are in Grande Prairie, Edmonton, Calgary, or anywhere else in Alberta and want a second set of eyes on your policy or your first AI rollout, I work with businesses across the province. You can see how I approach this on my Grande Prairie AI consultant page or the Edmonton page, and I also serve Calgary and Red Deer.

If you would like to talk it through, book a consult with me. We can look at the tools your team already uses, decide where the real risks are, and put a simple policy and rollout plan in place without turning it into a big project.

Andy