AI Policy in a Weekend: The Small Business AI Use Policy, Rollout Pack and Governance Kit

An AI use policy your team will actually follow: approved tools, simple data rules, a rollout plan and the training records to show for it. Your staff are already using AI. Someone drafts emails in a chatbot, someone else runs a meeting note-taker, a third pastes spreadsheets into whatever tool is open. Mostly on personal accounts, with default settings, sometimes with client data. A free template off the internet does not fix that, because nobody reads it and nothing changes. This toolkit gets you from no rules to a policy people have read, in one weekend. The weekend • Saturday morning: a no-blame staff survey, plus where else to look (expenses, admin panels, browser extensions). Build the tool register. • Saturday afternoon: Green, Amber, Red data rules with examples from your own business. Check each tool people want to keep against seven questions. Approve a short list. • Sunday morning: fill in the two-page policy template, with clause notes explaining each choice. Extra clauses for regulated and client-heavy work. • Sunday afternoon: the announcement, a 30-minute briefing plan, a ten-question quiz, the training log and acknowledgment form. • Then: a quick process for new tool requests, a new-starter checklist and a twice-yearly review. What you get • The toolkit (36-page fillable PDF) with 7 worksheets: staff survey, tool register, data matrix, vendor check, training log, incident report, review checklist. • AI Use Policy template (Word): two pages in plain language, bracketed fields to fill. • Rollout Pack (Word): staff survey email, announcement, briefing outline, quiz with answer key, acknowledgment form, client templates. • AI Governance Kit (Excel): tool register, vendor checks, data matrix, training log, incident log, tool requests and review log. Checked, dated and sourced Rules and vendor data terms were checked against official sources on 30 September 2026, including the EU AI Act literacy duty as amended in July 2026, GDPR and UK GDPR guidance, and the business-plan data terms of the main AI assistants. Every source is listed at the back, with dates. Who it is for Owners and operations leads at companies of 5 to 200 people who have no compliance department and want sensible rules without banning useful tools. Not legal advice. These are practical templates and plain-language explanations. Have your final policy reviewed by a qualified adviser, especially if you handle sensitive personal data or work in a regulated profession. Product names are trademarks of their owners and used descriptively; Lucidens is not affiliated with any vendor. FAQ Is this legal advice? No. It gives you templates and explains the rules in plain language. Have a qualified adviser review the final policy. Does it cover the EU AI Act? It covers what applies to ordinary business use: the AI literacy duty (Article 4) and the transparency rules from August 2026 (Article 50), with the training log as your record. It does not cover high-risk AI systems. We are in the US / UK. Is it still useful? Yes. The policy is jurisdiction-neutral; the toolkit summarises UK GDPR, FTC, New York City, California and Colorado points where they matter. Will it ban ChatGPT? No. The approach is to approve a small set of tools on business accounts and set clear data rules, so people stop hiding what they use. Can I edit the templates? Yes. The policy, rollout pack and kit are editable Word and Excel files, licensed for use in one business. Can consultants use it with clients? Not under the standard licence. Contact us about a consultant licence. What if the rules change? Dates are in the text. We update the toolkit when the law or vendor terms change. By Lucidens. Version 1.0, September 2026. Instant download: PDF plus editable Excel and Word files in one ZIP.