Whether or not you have approved it, someone in your business is probably already using AI tools to draft emails, summarise documents or write social media posts. That can be a real productivity boost. It can also lead to customer data, pricing or confidential plans being pasted into tools you know nothing about. The answer is not to ban AI, but to set clear, simple rules. This guide shows you how to write an AI policy for small businesses in an afternoon.
Why you need a policy now
- Data protection: under the Nigeria Data Protection Act, you remain responsible for how customer data is handled, including when staff paste it into third-party tools. See our NDPA checklist.
- Accuracy: AI tools can produce confident but wrong answers. Unchecked output can reach customers, contracts or financial reports.
- Consistency: without guidance, every employee makes up their own rules.
- Opportunity: a clear policy actually encourages safe use, so you get more of the benefit.
The five parts of a simple AI policy
Keep it short. One or two pages that people will read is better than twenty that nobody does.
1. Purpose and scope
State why the policy exists and who it covers. For example: “This policy explains how staff and contractors may use AI tools for work, so we benefit from them while protecting our customers, our data and our reputation.”
2. Approved tools
List the AI tools staff may use for work, and how they should access them. Business or enterprise versions of AI tools often offer stronger data controls than free personal accounts, such as commitments not to use your data for training. Specify:
- Which tools are approved.
- Whether staff must use a company account rather than a personal one.
- Who to ask if they want to try a new tool.
3. What data can and cannot be used
This is the most important section. A simple three-level classification works for most businesses:
- Public: information already on your website or in published materials. Fine to use with approved tools.
- Internal: general business information that is not sensitive, such as draft marketing copy or meeting notes without personal details. Use only with approved business accounts.
- Confidential: customer personal data, staff records, financial details, passwords, contracts and anything under a confidentiality agreement. Never enter into AI tools unless a specific, approved system has been set up for it.
Give concrete examples so staff can apply the rules without guessing.
4. Human review and accountability
Make it clear that the person using AI remains responsible for the result:
- Check facts, figures and names before anything is sent or published.
- Do not use AI output for legal, financial, medical or HR decisions without proper expert review.
- Review code generated by AI for security issues before it goes live.
- Be transparent with customers where AI plays a significant role in a service you provide.
5. Reporting and review
Tell staff what to do if they think confidential data has been entered into the wrong tool: report it immediately, without fear of blame, so the risk can be assessed. Commit to reviewing the policy every six to twelve months, as AI tools change quickly.
Good uses to encourage
A policy should not only say “no”. Highlight the safe, high-value uses you want people to try:
- Drafting and improving emails, proposals and job descriptions.
- Summarising long public documents and reports.
- Brainstorming campaign ideas and social media content.
- Creating first drafts of standard operating procedures.
- Writing formulas, simple scripts and data analysis steps.
- Translating and simplifying technical language for customers.
Roll it out in three steps
- Write a one-page draft using the five sections above.
- Run a 30-minute team session to explain it, show examples and answer questions.
- Collect feedback after a month and update the approved tools list.
From policy to real results
Once safe use is in place, the bigger gains come from building AI into your actual workflows: automatically classifying enquiries, drafting replies for staff to approve or extracting data from documents. Combined with automation, as we describe in our WhatsApp Business automation guide, this is where businesses save serious time.
Geopaju’s AI strategy and adoption team helps businesses find where AI saves the most time and money, prove it with a short pilot and roll it out safely with clear data rules. Book a free AI and automation assessment to get started.
