Category: blog
AI use is expanding across small businesses
- Chatbots
- Copilots
- Meeting transcription
- Document analysis
- CRM automation
- Code assistants
- Marketing tools
- Security platforms
The controls around these tools often remain undocumented.
An AI policy establishes the operating rules.
It identifies:
- Which tools are approved
- Which activities are permitted
- Which data cannot be submitted
- When human review is required
- Who owns governance
- How incidents are reported
- How vendors are evaluated
A policy does not need to be complex.
It needs to be current, enforceable, and connected to the wider IT environment.
Governance
AI governance is the process used to control AI tools, data, access, vendors, and business decisions.
For small businesses, governance should be assigned to a named owner.
This may be an internal manager, an operations leader, or a managed IT provider.
Responsibilities should include:
- Maintaining the AI tool inventory
- Approving new tools
- Reviewing vendor controls
- Classifying use cases by risk
- Maintaining data-handling rules
- Coordinating employee training
- Reviewing incidents
- Updating the policy
NIST’s AI Risk Management Framework provides a useful structure:
- Govern
- Map
- Measure
- Manage
The framework is voluntary.
Its controls can still be adapted to a small business environment.
Build an AI inventory
Every AI tool should be recorded.
Include:
- Vendor
- Product name
- Business purpose
- Users
- Account type
- Connected systems
- Data processed
- Retention settings
- Training-use terms
- Administrative owner
- Approval status
The inventory should include embedded AI features.
AI is not limited to standalone chatbots.
It may already be active inside:
- Email platforms
- Microsoft 365
- Google Workspace
- CRM systems
- HR applications
- Cloud storage
- Meeting platforms
- Help desk systems
- Security tools
Unapproved tools used by employees are often called shadow AI.
The risk is not AI adoption.
The risk is untracked AI adoption.
Classify tools
Each tool should be classified as:
Approved
Reviewed for business use.
Data controls and account ownership have been confirmed.
Conditional
Allowed only for specific users, tasks, or data types.
Additional review or human approval is required.
Prohibited
Not approved for company work.
The list should be accessible to employees.
A complete ban may drive usage into personal accounts.
Approved alternatives should be provided where practical.
Acceptable Use
An acceptable-use section should state what employees may do with AI.
Approved activities
Low-risk activities may include:
- Brainstorming
- Formatting
- Summarizing public information
- Drafting internal notes
- Creating outlines
- Generating non-confidential content
- Producing meeting agendas
- Reviewing generic code
- Converting information between formats
Approved activities still require data protection controls.
Public information should be kept separate from confidential business information.
Limited activities
Some uses may be permitted with conditions.
Examples:
- Customer communication drafts
- Marketing content
- Proposal preparation
- Internal reporting
- Analytics
- Meeting transcription
- Code generation
- Help desk responses
- HR document drafting
Conditions should be documented.
Typical requirements:
- Use a company-managed account
- Use an approved tool
- Remove unnecessary personal data
- Verify output accuracy
- Complete human review
- Retain required records
- Obtain approval before external distribution
AI-generated output should not be treated as a source of truth.
It may contain:
- Incorrect facts
- Unsupported claims
- Missing information
- Biased recommendations
- Exposed confidential material
- Incorrect calculations
- Unapproved commitments
Prohibited activities
The policy should prohibit:
- Entering credentials into AI prompts
- Uploading confidential files to unapproved tools
- Using personal AI accounts for company data
- Impersonating customers, employees, or executives
- Creating deceptive communications
- Bypassing legal or compliance requirements
- Making fully automated employment decisions
- Allowing AI to approve payments without review
- Allowing AI to change production systems without authorization
- Using generated content without checking rights and accuracy
AI should not make final decisions involving:
- Hiring
- Firing
- Promotion
- Compensation
- Credit
- Pricing
- Legal obligations
- Security response
- Customer eligibility
Human accountability should remain in place.
Data Protection
Data protection is the core of an AI policy.
Employees often submit information because a tool produces a faster result.
The submission may expose data outside company control.
Data that should not be submitted
Unless an approved business-grade tool has been reviewed for the specific use case, employees should not enter:
- Customer names and contact records
- Account numbers
- Payment information
- Employee records
- Health information
- Financial statements
- Contracts
- Legal correspondence
- Pricing information
- Trade secrets
- Source code
- Credentials
- Private keys
- Product plans
- Information covered by an NDA
- Regulated information
A simple operating rule can be used:
If the information would not be sent to an unknown third party by email, it should not be entered into an unapproved AI tool.
Use data minimization
Only the required information should be submitted.
Remove:
- Names
- Email addresses
- Phone numbers
- Account identifiers
- Internal project names
- Contract terms
- Unneeded file content
- Direct customer references
Use placeholders or anonymized data for testing.
Use approved enterprise tools when sensitive data must be processed.
Review vendor controls
AI vendors should be evaluated before approval.
Review:
- Data retention
- Model training use
- Data residency
- Encryption
- Access controls
- Audit logging
- Subprocessors
- Incident notification
- Account recovery
- Administrative controls
- Contractual protections
- Data deletion procedures
The same product name may offer different protections across free, individual, and business plans.
Business use should not rely on assumptions.
The selected plan and its terms should be documented.
Identity and Access
AI accounts should be managed like other business applications.
Personal accounts create control gaps:
- No centralized ownership
- No enforced MFA
- No SSO
- No audit trail
- No offboarding process
- Unknown retention settings
- No administrative recovery
- Unclear data ownership
Approved AI services should be connected to company identity controls where supported.
Access should be based on job responsibilities.
Use:
- SSO
- MFA
- Unique user accounts
- Role-based access
- Least privilege
- Central billing
- Administrative recovery
- Offboarding procedures
- API key management
Shared credentials should not be used.
API keys should be stored in a secrets manager.
They should not be placed in:
- Source code
- Chat
- Shared documents
- Ticket notes
AI services should be included in onboarding and offboarding checklists.
Human Review
Human review should be required before AI output is:
- Sent to a customer
- Published publicly
- Added to a contract
- Used in a financial decision
- Used in an HR decision
- Used in a compliance document
- Used to trigger a system change
- Used to close a security alert
- Used to modify a customer record
Reviewers should verify:
- Facts
- Numbers
- Sources
- Permissions
- Confidentiality
- Tone
- Business impact
- Regulatory requirements
Automation should begin in read-only mode where possible.
Write access should be enabled only after testing and approval.
Customer-facing chatbots should be reviewed for disclosure requirements, escalation procedures, and response accuracy.
Security and Incident Response
AI security should not be managed separately from the existing security program.
AI services may connect to:
- Cloud storage
- Identity systems
- Endpoints
- Network resources
- CRM platforms
- Business applications
A compromised account or integration may expose company data.
Security controls should include:
- Endpoint protection
- Email security
- MFA
- Network security
- SaaS access controls
- Backup
- Vendor risk management
- Security awareness training
- Logging
- Incident response
CISA AI guidance supports secure-by-design practices.
The incident response plan should include AI-related events.
Examples:
- Sensitive data submitted to an unapproved tool
- Compromised AI account
- Malicious browser extension
- Unauthorized cloud-file access
- Incorrect automated record changes
- Exposed API key
- Vendor security incident
- AI-generated phishing content
The response process should define when to:
- Disable the account
- Revoke sessions
- Rotate credentials
- Remove integrations
- Preserve logs
- Contact the vendor
- Identify affected data
- Assess notification requirements
- Restore affected systems
- Update controls
Managed AI Services from X-Tek
Small businesses may not have internal resources for continuous AI governance.
X-Tek provides managed IT support for the systems surrounding AI adoption.
Managed AI services can include:
- AI tool inventory
- Approved-tool policy development
- Data classification
- Vendor review
- Identity and access configuration
- SSO and MFA deployment
- SaaS AI feature review
- Endpoint monitoring
- Network monitoring
- Security awareness training
- Incident response planning
- Backup and recovery planning
- Policy review
Our business IT support and managed support plans can be aligned with existing cloud, network, endpoint, and security requirements.
AI systems should be reviewed as part of the wider infrastructure.
Accounts are monitored.
Access is limited.
Threats are identified and remediated.
Backups are tested.
Recovery procedures are documented.
2026 AI Policy Checklist
Review these items:
- Is every AI tool inventoried
- Are approved and prohibited tools documented
- Are personal AI accounts restricted
- Are sensitive data categories defined
- Are company accounts required
- Is MFA enabled
- Are AI features inside existing platforms reviewed
- Are API keys protected
- Is human review required for external output
- Are consequential decisions excluded from full automation
- Are AI vendors evaluated
- Are logs available
- Are AI incidents included in response plans
- Are backups monitored and tested
- Is policy training assigned
- Is the policy reviewed quarterly
Any “no” identifies a control gap.
Corrective actions are generally direct:
Inventory the tool.
Restrict the data.
Control the account.
Review the output.
Monitor the activity.
Document the response.
An AI policy gives employees usable boundaries.
Managed AI services provide ongoing enforcement across the technology environment.
Contact Information
Business Solutions Information Request:
https://xtekit.com/business-solutions-information-request/
815-516-8075