FAQs
Have Questions?
What goes into a written AI policy for an SMB?
A working AI policy for a Houston SMB names sanctioned AI tools, classifies data into tiers that can or cannot enter each tool, defines acceptable use including output review and citation expectations, sets training requirements, addresses customer and contractual obligations, and defines the disciplinary path for misuse. The policy needs to be short enough that staff actually read it and specific enough that an auditor accepts it.
Why are cyber insurance carriers asking about AI policy?
Carriers are seeing claims from AI data leaks, AI-generated phishing impersonations, and AI tool misconfigurations exposing customer data. The questions on AI policy reflect that loss experience. A business with documented governance and sanctioned tooling presents a lower risk than a business where staff use any AI tool they want with whatever data they want.
How is AI policy different from acceptable use policy?
Acceptable use policy covers internet, email, and software broadly. AI policy is a focused document that addresses the specific risks AI tools create: training data exposure, hallucinated output liability, prompt injection, deepfake potential, and intellectual property complications. Most SMBs need AI policy as a standalone document that references the existing acceptable use policy.
What is shadow AI and why does it matter?
Shadow AI is the use of AI tools by staff without the business knowing or sanctioning the use. The risk is data leakage and intellectual property exposure that the business did not consent to. The governance work names the risk and provides a sanctioned path so staff get the productivity benefit without the exposure. Banning AI rarely works. Channeling it does.
Do small businesses really need AI governance?
Yes. The smaller the business, the more concentrated the data exposure if a single staff member pastes the wrong content into the wrong tool. The policy work scales down well: a 25-employee business can have working governance in a working day. The cost of the document is a fraction of the cost of one breach or one insurance renewal increase.
