An AI Usage Policy: Three Ground Rules for Small Companies
A common scenario: the owner thinks the company hasn't started using AI yet, but in fact sales has long been using free tools to reply to customers on LINE, the accountant pastes bank statements into a chatbot to tidy them up, and the social media assistant writes posts with AI every day. No one has reported it, and no one has ever said what can be pasted and what can't.
Two new surveys this week point to the same thing: small businesses are adopting AI faster than they're setting rules. In today's post on getting started with AI, I want to talk about the most basic, yet most often skipped, document: an AI usage policy.
Today's Highlights: Everyone is using AI, but the AI usage policy is missing
Meta commissioned YouGov to survey 3,983 owners of small businesses with fewer than 50 employees across nine Asia-Pacific markets, including Taiwan, online from August 6 to September 2. The results show 84% already use AI, 76% feel their productivity has improved, and 71% say it had a positive impact on revenue or sales over the past year. The most common uses are creating content (51%), local advertising and marketing (43%), translation (38%) and customer communication (37%).
But in the same survey, 86% of owners believe small businesses need more guidance to truly benefit from AI, and the biggest barrier to training is cost (51%). What owners most want to understand is, first, costs and return on investment, and second, how to protect data privacy and security. Meta also notes that the survey isn't a representative sample of each country, and differences between markets may come from translation and response habits.
"Shadow AI" isn't just a big-company problem anymore
On October 12, cloud marketplace Pax8 released its Q3 SMB AI survey of 1,150 decision-makers at companies with 5 to 499 employees in the US, UK, Germany and Sweden. Among companies using AI, 35% discovered "shadow AI" in the past six months: tools, workflows or AI agents running without company approval. The highest share with formal written review of internally built AI was only 45%, and as low as 23% in the UK. Data security and privacy breaches were the top risk of employee-built AI in all four markets (30% to 35%).
Two other numbers are very practical: 49% of companies paying for AI have received bills higher than expected, and 55% of decision-makers spend more than three hours a week checking, revising or verifying AI output.
What should the policy cover? Hong Kong's checklist is a good starting point
At the end of March 2025, Hong Kong's Office of the Privacy Commissioner for Personal Data published a checklist of guidelines for employees' use of generative AI. It's not new, but it's very suitable for small companies to reference directly. It recommends that employers first set a "clear scope of permitted use" covering five areas: which tools may be used and for what; which personal data may be entered and how outputs may be used; lawful and ethical use; who may use it, on which devices, and how to report a data breach; and the consequences of violations. The checklist also recommends regular communication, employee training, and a feedback channel.
Jesse's Take: Spell out the rules first, and people will feel safe using AI
After reading these reports, my takeaway is this: for many small businesses in Taiwan, getting started with AI isn't held back by tools, but by no one making clear how AI can be used. Data is scattered across LINE groups, Excel files and the owner's head; employees want to use AI but fear making mistakes, so they use it quietly in private. Rather than hunting down shadow AI after the fact, spell out the rules up front. Here are my three suggestions:
1. Take stock first. Don't ban first
Spend half an hour asking around: which AI tools does everyone use now, what for, and what data have they pasted in? The goal isn't to catch anyone, but to see clearly where the risks are. Banning everything from the start just drives usage underground, and you'll see even less. While you're at it, note which are personal free accounts and which are paid company accounts; you'll need that when classifying.
2. Classify data with a red-yellow-green traffic light
The policy doesn't need to be ten pages. Just split data into three levels: Green is public information, such as website copy and product catalogs, which can be used freely; Yellow is internal data, such as quotes and meeting notes, which may only be used with company-approved accounts that have commercial data protection terms; Red is customer personal data, national ID numbers and unpublished financial figures, which must never be pasted into any AI tool.
3. Name a point person, who also keeps an eye on the bills
Small companies don't need an AI committee, but they do need a point person: someone who approves new tools, reviews AI costs once a month, and collects and shares the practices that work well. Pax8's numbers remind us that usage-based tools can easily run over budget; AI output must always be reviewed by someone, and that time counts as a cost too. If your company works with a regular IT vendor, ask them to help check account permissions and settings.
An honest caveat: Meta is a platform that sells ads and AI tools, and Pax8 itself sells AI and cloud services, so both have reasons to stress that "AI is useful, but you need help." Use these numbers to see the direction, not as gospel.
A first step you can take today
Find a spare moment this week to write your company's "red data" list on one page, post it to the notes in your company LINE group, and ask each colleague to reply with one line: which AI tools they currently use. One page and one message make up the first version of your AI usage policy.
Further Reading
Related posts on JCXO
Original sources