No IT Department? Write The Policy Anyway.
A company with no IT department still needs an AI acceptable use policy. Nobody there will configure a filter or watch a dashboard, so the policy has to be a page of decisions your people can remember.
Our post on what shadow AI risk actually costs ended on writing down what can and can’t go into a prompt. Vistage’s Q1 2026 CEO Confidence Index surveyed 1,302 small and midsize business leaders in March 2026, and 27% have no AI policy and no plans to write one. A lot of companies are starting from nothing, so this post covers what else goes on that page.
What goes in an AI acceptable use policy at a small company
- Which tools and which accounts. Name the approved tools and require company-paid accounts for all work.
- What never goes in. List the data that stays out of any prompt: customer personal information, credentials, financial records, contracts under NDA, and anything you are regulated to protect.
- What a person checks before it goes out. Anything a customer or regulator will see, such as a proposal or a contract clause, gets read by someone willing to sign it. If AI puts something wrong in front of a customer, you are generally still answerable for it.
- What AI doesn’t decide alone. Anything that decides something about a person’s job, pay, or credit has a human making the call.
- Who to ask, and what happens after a mistake. Name one person who answers questions, and make reporting a slip safe.
- When you’ll reread it. Tools and terms keep changing, so set a date.
Start your AI acceptable use policy with the accounts
The paid plans come with written commitments. As of late September 2026, OpenAI says it does not train on ChatGPT Business and Enterprise content by default, Anthropic says its Commercial Terms apply on Team and Enterprise plans and bar training on customer content, and Microsoft says Microsoft 365 Copilot prompts and responses are not used to train its foundation models. Vendor terms change, so check the current ones for your plan.
Those protections attach to the workspace you pay for. The same person on a personal account falls under different terms. LayerX’s State of AI Usage Report from May 2026 found about 47% of enterprise AI conversations run through personal identities, and another 14% under a corporate login are tied to personal licenses. In the enterprise accounts LayerX measured, you could buy every seat and still have much of the use outside what you paid for.
Without IT, three habits get everyone onto the company workspace:
- Buy a seat for everyone already using AI, so the approved route is as easy as the personal one.
- Put the subscription on a company card, with you or your office manager holding the admin login.
- Remove the seat when someone leaves.
Who approves what when there is no IT to ask
Where an enterprise has IT reviewing each tool request, you have to pick a person. A company this size can give this to whoever already has cross-functional authority, with no new executive, and we’ve argued that before. Put the name of the person who approves tools at the top of your page.
Writing the policy in one sitting
Start with what your team already does. Ask the two or three people who use AI most what they use it for and on which accounts, and tell them first that nobody is in trouble. Their workarounds show you where AI already pays off. A ban would only hide them.
“Use good judgment with sensitive information” gives nobody anything to check. “Customer names, account numbers, passwords, and anything under NDA stay out of prompts” is a rule anyone can check. If you hold health, financial, or other regulated data, get counsel’s or your regulator’s input on that line first.
Then write the six lines in the words you would use to explain them out loud. Show them to those same people before they go to everyone. They will quickly tell you which line will not work. They will also be the ones explaining it to the rest of the team, and that is the internal champion role in practice. Put the review date on the calendar before you close the document, a quarter out.
What a written policy can’t do
A written policy does not stop anyone, and without IT nobody will see it when someone ignores it. What it gives you is a rule people can name and a person to ask. Whether your tools are set up safely belongs to whoever manages them, and whether your contracts cover the data you handle belongs to a lawyer.
If you want to know where you stand before writing anything, Governance is one of six dimensions in Sillewa’s free AI Readiness Guide, which you score yourself and submit to no one. If you want help beyond that, the AI Adoption Program (Setup & Integration) covers a working session with whoever handles IT plus training for your team, and Our AI Partnership keeps senior governance advice available afterward.
The move this week: write the first two lines, tools and accounts, and show them to your heaviest AI users.