A One-Page AI Use Policy for Small Businesses and Recruiters

If you employ anyone, assume they are already using AI tools at work. Some will be pasting emails into a chatbot, others will be drafting job ads or summarising CVs with it. That is not a problem in itself, but without a few clear rules you will not know what data is leaving your business or who is checking the output.

A one-page policy fixes most of this. It does not need to be legal-sounding. It needs to be short enough that people actually read it.

What a one-page policy should cover

Five short sections are enough to start.

1. Which tools are approved. Name them. "Use the company's paid account of tool X" is much clearer than "use AI responsibly." Paid business plans often come with different data-handling terms from free personal accounts, so read the terms of whichever tool you choose rather than assuming.

2. What must never go in. Be specific. For most businesses this means passwords and API keys, client contracts and pricing, financial records, and anything marked confidential. For recruiters, add candidate personal details such as ID numbers, salary history, medical or family information, and full CVs unless you have checked that the tool and your candidate privacy notice allow it.

3. What a person must check. AI output can be fluent and wrong. Set a rule that a named person reads and approves anything that goes to a client or candidate, any number or date, and any claim about a person or company.

4. What AI may not decide. Shortlisting, rejecting candidates, setting pay and disciplinary matters should stay with a human. Some jurisdictions have rules on automated decisions in hiring, so check the position where you and your candidates are based.

5. Who to ask, and what to do if something goes wrong. Name one person. Say plainly that reporting a mistake, such as pasting the wrong document into a tool, will be treated as helpful rather than punished. You want to hear about it on day one, not month three.

How to roll it out

• Draft it in an hour, using the five headings above.
• Ask two or three team members what they already use AI for, and adjust the policy to reality rather than forbidding everything.
• Put it where people will see it: onboarding, the shared drive and your team chat.
• Put a review date in the diary. Tools and terms change quickly, so a six-month check is sensible.

A short example

"We use the company's approved AI accounts only. We never paste passwords, client contracts or candidate ID documents into AI tools. A person checks everything before it goes to a client or candidate. AI does not decide who is hired, rejected or paid what. Questions or mistakes go to [name], no blame."

That is about 60 words, and it already puts you ahead of many businesses.

The caveat

This is a practical starting point, not legal advice. Data protection and employment rules differ by country, and a UAE, UK or EU business may have specific obligations around personal data and automated decisions. If you handle sensitive candidate or client data at scale, have a qualified adviser review your policy. A policy also does nothing unless someone enforces it, so check in now and then on what is actually being used.

If you are putting AI into your recruitment workflow and want a second opinion on setting it up sensibly, talk to us.