What should go in a one-page AI policy for your team?

In most small teams, AI arrives before any rules do. Someone starts drafting emails with a chatbot, someone else summarizes meeting notes, and a third person pastes a client file into a free tool to save time. None of this is malicious, but without shared rules each person makes different choices about privacy, accuracy and disclosure. A one-page policy fixes that with very little effort, as long as it stays short enough that people actually read it.

The goal is not legal language. A good policy answers the questions staff already have: "Can I use this tool? Can I paste this? Do I need to check it? Who do I ask?"

The six parts of a one-page policy

The off-limits row follows the principles that Canada's federal, provincial and territorial privacy commissioners set out for generative AI in December 2023. They advise using anonymized or de-identified information in prompts where possible, and entering sensitive personal information only where it is authorized. They also point out that what an AI infers about an identifiable person is itself personal information, which is easy to forget when a tool "guesses" a customer's mood or income. In Quebec, Law 25 adds its own steps, such as a privacy impact assessment before adopting a new tool that handles personal information.

A worked example

Here is how a seven-person landscaping company in the Outaouais might fill in its page:

OUR AI RULES (version 1, October 2026)
1. Tools: our paid assistant account only. Training on our data is turned off.
2. Never paste: client names or addresses, prices in signed contracts,
   employee files, anything with a card or ID number.
3. Check before it leaves: quotes, client emails and social posts are
   read by the person who signs them.
4. Say so: the website chat says "AI assistant"; AI images are labelled.
5. Questions or mistakes: ask Julie (office manager), same day.
6. Records: Julie keeps this page, the tool list and the training log.
Next review: April 2027.

An AI assistant can help you draft yours. Give it your facts and ask it to stay brief:

Draft a one-page AI use policy for a [number]-person [type of business]
in [province]. We use these AI tools: [list]. We handle this kind of
personal information: [list]. Use plain language and six short sections:
approved tools, information never to paste, human review, disclosure,
who to ask, records. Maximum 250 words. Then list three questions I
should answer myself before adopting it.

How do you train staff in AI literacy without a big budget?

AI literacy means the skills and understanding people need to use AI tools sensibly and to grasp their opportunities and risks. In the European Union it is a legal duty: Article 4 of the AI Act, as rewritten by the 2026 Digital Omnibus, requires providers and deployers to take measures that support the AI literacy of their staff and of others who use AI systems on their behalf. It does not require a guaranteed level for each person. The European Commission's questions and answers, updated on October 20, 2026, add that there is no mandatory format, no certificate is needed, and an internal record of training is enough. They also say the duty can reach businesses outside the EU when their AI use affects people there. Canadian law has no general equivalent, but the same habits protect any business.

A low-cost plan that matches that guidance:

1. One hour, together. Cover what the tools are, how they produce answers, and the risks for your work. The Commission's own example: staff who use ChatGPT to write ad copy or translate should know about hallucinations, meaning confident but false output. Show one real mistake a tool made with your kind of task.
2. Read the policy aloud. Walk through the one page and answer questions. This is where people learn what "never paste" means in their own job.
3. Adjust by role. The Commission says training can differ by knowledge and role. The person who runs the website chatbot needs more than someone who only drafts emails, and a contractor using AI on your behalf needs the same basics as staff.
4. Practise. Ask everyone to bring one task, run it with the approved tool, and check the result together.
5. Write it down. Date, who attended, what was covered. Keep it with the policy.
6. Refresh twice a year, or whenever you adopt a new tool.

Free material can fill the gaps: vendors' own help pages on privacy settings, the privacy commissioners' guidance, and, for teams with European clients, the Commission's living repository of AI literacy practices. If your business uses AI for decisions about people, such as hiring or credit, get advice on the specific rules before you rely on a one-page policy alone.