What an AI policy for a ten-person team actually needs
You do not need a forty-page document. You need five clear answers that everyone can remember.
Large companies write long AI policies because they have legal departments and regulators watching. A ten-person team has a different problem. People are already using AI tools, quietly and inconsistently, and nobody has said what is okay.
A useful policy for a small team fits on one page and answers five questions.
What data never goes in?
This is the most important line. Customer personal details, passwords, unreleased financials and anything covered by a confidentiality agreement are the usual list. Name the categories plainly so nobody has to guess.
Which tools are approved?
Pick one or two and pay for business plans where they exist, since those usually come with better data terms. An approved list removes the temptation to paste work into whatever free app showed up in an ad.
Who checks the output?
Anything that goes to a customer, a partner or the public gets read by a person first. Say who that person is for each kind of work.
When do we tell people?
Decide where disclosure matters to you. Many teams disclose when AI materially shaped a published piece or a client deliverable, and do not bother for internal notes. The point is consistency.
Who owns the policy?
Name one person who updates it every quarter. The tools change fast, and a policy nobody maintains becomes a policy nobody follows.
Write it, share it in a meeting, and invite questions. The conversation is half the value.