512–843–2835
Find Us
Decorative title card for an AI ethics policy
UI Design Illustration

AI Ethics Policy for Small Businesses: What to Include

Computer & Technology Tips

An AI ethics policy is a short, enforceable document that says how your business may use AI, what data may go into it, who approves tools, and who answers when something goes wrong. If your staff already use ChatGPT, Copilot or an AI feature in your software, you have AI risk today, with or without a policy. The fix is not a 40-page philosophy paper. It is a few pages that people read, follow and can be held to, tied to the security and privacy controls you already run.

This guide is for owners and administrators of small and mid-sized businesses, including healthcare practices that handle patient data. It covers what belongs in the policy, who owns it, how HIPAA and U.S. rules fit in, and how to roll it out.

tekrescue
Build AI Use on Stronger Security
tekRESCUE helps small businesses strengthen cybersecurity and protect sensitive data as they navigate digital transformation.

Visit

TL;DR

  • An AI ethics policy turns principles (fairness, transparency, accountability, privacy) into rules your staff can follow: approved tools, banned data, review steps and named owners.
  • “Responsible AI policy” and “AI governance policy” overlap heavily with it. Ethics sets the values, governance sets the owners and processes. One document can do both at SMB scale.
  • Anchor it to the NIST AI Risk Management Framework, a voluntary framework built for organizations of all sizes.
  • Healthcare practices: HIPAA has no AI-specific rule, but its existing rules apply to any AI tool that touches patient data.
  • Start with an inventory of the AI tools in use, then write, train, and review on a schedule.

Table of Contents

What an AI ethics policy is, and how it differs from similar terms

People use three phrases for overlapping things.

  • AI ethics policy: the values and red lines. Be fair, be open about AI use, protect people’s data, keep a human accountable.
  • Responsible AI policy: the same commitments, usually framed around how you build or buy and deploy AI.
  • AI governance policy: the machinery. Who approves a tool, who reviews risk, how incidents are escalated, how often the policy is revisited.

Large organizations keep these as separate documents. A company with 10 to 200 people should not. One document with a values section and an operating section is easier to enforce. Standards bodies are moving the same way: the IEEE approved IEEE 2863-2026, a recommended practice for organizational governance of AI in June 2026 and published it in October 2026, covering governance principles, implementation processes and case studies for organizations that develop or use AI.

The American Bar Association’s corporate counsel guidance makes a point worth copying: a company-wide AI use policy should be separate from, but aligned with, your security and privacy policies. Do not let the AI policy contradict your acceptable use, data retention or incident response rules.

Why a small business needs one now

The risks are practical, not abstract.

  • Data leakage. An employee pastes a client contract, a patient note or a customer list into a public AI tool. That data has left your control. We cover this in depth in our guide to implementing AI without exposing confidential business data.
  • Wrong answers presented as fact. Generative AI can produce confident output that is not grounded in anything real. Someone has to be responsible for checking it before it reaches a customer.
  • Bias in decisions about people. Screening résumés, scoring leads or setting prices with AI can disadvantage protected groups, which brings legal exposure.
  • Shadow AI. Staff adopt tools you never approved, because nobody told them which ones were allowed.
  • Attackers use AI too. The same technology makes phishing and impersonation cheaper and more convincing. Your policy and your security stack have to be written with that in mind.

A written policy also gives you something to show a customer, insurer or auditor who asks how you control AI. For the data side, see AI data privacy: what U.S. professionals must do.

What to put in the policy

Keep it to a few pages. These are the sections that earn their space, drawn from NIST, the ABA guidance and state guidance.

Section What it says Why it matters
Purpose and scope Which people, tools and data it covers, with plain definitions of “AI,” “generative AI” and “sensitive data” NIST’s Govern guidance starts by defining key terms and scope
Principles Fairness, transparency, accountability, privacy, human oversight The ethical core, in five lines or fewer
Approved and prohibited uses Named tools that are allowed, tasks that are off limits Ends shadow AI
Data rules What may never be entered into a public AI tool Prevents the most common incident
Human review Which outputs need a person to verify before use Covers errors and bias
Roles Accountable owner, technical owner, reviewer Someone answers for each system
Vendor requirements What you require from AI vendors Third-party risk
Incident handling How to report and respond to an AI-related problem Speed limits damage
Training and review Who is trained, and how often the policy is revisited A policy nobody knows is not a policy

NIST’s Govern playbook is the best checklist for what mature governance looks like. It points organizations to connect AI governance to existing risk controls and data governance, document testing and validation, set monitoring and audit frequency, run legal review, and maintain tested incident response plans. You do not need all of it on day one, but it shows where the policy should grow.

If you want a ready structure for employees, our guide to an enforceable AI policy for employees lays out a few-page format aligned with NIST and EEOC guidance.

Rules for generative AI tools

Most small business exposure comes from generative AI: chatbots, writing assistants, image tools and AI features inside email and document software. Write explicit rules for them.

  1. List approved tools by name. Include the account type. A business account with data controls is a different risk from a free personal account.
  2. Ban sensitive data from public tools. Client financials, passwords, patient information, contracts under NDA and employee records stay out.
  3. Require human review. Anything customer-facing, legal, medical or financial is checked by a person who is accountable for it.
  4. Disclose AI use where it matters. If a customer talks to a chatbot, say so.
  5. Handle intellectual property. Decide whether staff may use AI-generated text or images in client deliverables, and who checks them.
  6. Watch for manipulation. Prompt injection means hidden instructions in a document or web page that steer the AI into ignoring your safeguards. Any AI tool connected to your files or email should be treated as a system that can be tricked.

NIST released a Generative AI Profile in July 2026’s predecessor year, on July 26, 2024, as a companion to the AI RMF. It addresses risks such as misinformation, deepfakes and intellectual property, with more than 400 suggested actions. It is a reference, not a to-do list for a 25-person firm.

Assign owners and review vendors

Policies fail when nobody owns them. Maryland’s state guidance for implementing its responsible AI policy is a useful model for small organizations: designate an AI lead, start with a “crawl, walk, run” approach to use cases, inventory your datasets and flag high-risk uses, such as those affecting public safety, individual rights or critical services.

Translated to a small business:

  • Accountable owner. One executive or manager who answers for AI use. In a small firm this is often the owner or operations lead.
  • Technical owner. The person, or your IT provider, who configures tools, access and logging.
  • Reviewer. Someone who approves new tools before they are used, with security, privacy and legal questions answered.
  • Authority to pause. The owner can switch off a tool that misbehaves.

For vendors, ask before you sign: where does our data go, is it used to train models, how are you notified of model changes and incidents, and what happens to our data when we leave. Put the answers in the contract. Our AI data governance guide for SMBs walks through a 90-day approach mapped to NIST.

If you handle patient data: HIPAA and AI

Healthcare practices carry the highest stakes. HIPAA has no AI-specific rule, but it is technology-neutral. According to a 2026 regulatory tracker, the existing Privacy and Security Rules govern any AI tool that touches protected health information, and an AI vendor that creates, receives, maintains or transmits that information on your behalf is a business associate that requires a business associate agreement under 45 CFR 164.504(e).

In practice, your policy should say:

  • No protected health information goes into any AI tool without a signed business associate agreement and a security review.
  • Staff may not use personal AI accounts for anything involving patients.
  • AI-generated clinical or billing content is reviewed by a qualified person.
  • AI tools are covered by your HIPAA risk analysis and access controls.

For more on this, see our guide to making AI for healthcare compliance audit ready and our HIPAA compliance overview.

There is no single federal AI law for private businesses. What exists is a patchwork, and it moves.

  • NIST AI RMF 1.0 (January 2023) is voluntary, not sector-specific and built for organizations of all sizes, organized around four functions: govern, map, measure and manage. It is the most common yardstick for a policy and a safe foundation.
  • State laws vary. Colorado’s first comprehensive AI law was replaced by SB 26-189, signed May 14, 2026 and effective January 1, 2027, with notice, disclosure, data-correction and human review requirements and broad exemptions for HIPAA-covered entities.
  • Employment screening. New York City’s Local Law 144 has applied since 2023 and requires a bias audit and candidate notice before an automated employment decision tool is used on NYC candidates.
  • Federal direction changed. Federal AI governance moved under new executive orders in 2025, and NIST has said the AI RMF is being revised. Treat the framework as a stable starting point and check the official NIST page for the current version.

Because these rules change, have your attorney review the policy against the states where you hire, sell or treat patients. Ask your IT provider to keep the technical controls current.

A 30-60-90 day rollout

Days 1 to 30: see what you have.
Inventory every AI tool and feature in use, including free accounts staff signed up for themselves. Note what data each touches. Name the accountable owner.

Days 31 to 60: write and decide.
Draft the policy using the table above. Approve a short list of tools. Block or restrict the rest where you can. Update vendor contracts and, for healthcare, sign business associate agreements where required.

Days 61 to 90: train and test.
Train everyone on the data rules with real examples from your business. Turn on logging and access controls. Run one tabletop exercise: an employee pastes client data into a public tool. Who finds out, and what happens next?

Every quarter after that.
Review the tool list, incidents, new laws and vendor changes. Update the policy and re-train when it changes. If you are unsure where you stand, an AI readiness assessment gives you a baseline, and clean inputs matter too, see data quality for AI.

How tekRESCUE helps

A policy only works if the technology enforces it. tekRESCUE provides Strategic AI Consulting for small and mid-sized businesses, along with cybersecurity services and risk assessments, managed IT and incident response. We also work with healthcare providers on HIPAA compliance. If you want the policy written, the tools locked down and the rollout handled in one place, contact us.

Our perspective

Here is the uncomfortable truth: most small businesses do not have an AI problem on paper. They have an AI problem in practice. Someone in accounting is pasting a spreadsheet into a chatbot right now, and nobody told them not to.

We see the policy as the easy half. The hard half is making it real: approved tools, access controls, logging, vendor terms and a plan for the day something leaks. That is why we treat AI governance as a security and IT issue first, and a document second. Our expertise is in compliance and security management, including HIPAA and NIST standards, and that is the lens we bring to AI.

Attackers are already using AI to move faster than any human team can react. A policy that sits in a shared folder will not slow them down. A policy backed by managed security, monitored systems and trained people will.

If you run a business, start with the inventory. You cannot govern what you cannot see.

Randy Bryan

FAQ

How long should an AI ethics policy be?

For a small business, two to five pages is enough. Cover scope, principles, approved and prohibited uses, data rules, roles, vendor requirements, incident reporting and review frequency. Shorter policies get read and enforced, and you can add detail as your AI use grows.

Do we need separate responsible AI and AI governance policies?

Usually not. Ethics and responsible AI describe your principles, while governance describes owners, approvals and reviews. At small business scale, one document with a principles section and an operating section does the job and avoids conflicting rules.

Is an AI policy legally required for a U.S. small business?

There is no single federal requirement for private businesses, though some state and local laws apply to specific uses such as automated hiring tools, and HIPAA applies to AI that touches patient data. Because requirements differ by state and change, have your attorney confirm what applies to you.

Which framework should we follow?

The NIST AI Risk Management Framework is the usual starting point. It is voluntary, free and designed for organizations of all sizes. Map your policy sections to its govern, map, measure and manage functions so you can show a customer or auditor how your controls line up.

How often should we update the policy?

Review it at least quarterly in the first year, and any time you adopt a new AI tool, change a vendor, have an incident or see a relevant law change. Re-train staff whenever the rules change.

Sources

Previous Post
IT Asset Disposal Policy: What to Include and How to Enforce It

Related Posts

Terms and Conditions - Privacy Policy Content