How to write an AI policy for a small business

An AI policy for a small business fits on one page: which tools staff may use, what never gets pasted in, who checks the output, and who to ask.

Most owners I talk to around Cork have skipped this, and not out of carelessness. A policy sounds like something for a company with an HR department. Meanwhile three of your staff are using ChatGPT on their phones, one is pasting in customer emails, and nobody has said whether that is grand or a serious problem. It is the conversation you have not had, written down once so you stop having it badly.

This is general information, not legal advice. If you are in a regulated trade, or handle health records or data about children, have someone qualified read whatever you end up with.

Does a small business really need an AI policy?

Yes, and not mainly for compliance reasons. Without one you get the worst of both: the careless using AI in ways you would never sanction, and the careful not using it at all because nobody told them they could.

Silence is not neutral. It reads as permission to one half of your team and disapproval to the other. That is how you end up with a receptionist running every complaint through a free chatbot while your best writer types from scratch, having assumed it was off limits.

There is a mild legal nudge too. The EU AI Act expects organisations using AI to make sure the people operating it have a basic grasp of what they are doing. A one-page policy and twenty minutes explaining it is a reasonable answer for a business of eight. I wrote up the rest of the Act in plain English here.

The four rules an AI acceptable use policy needs

Four, not fourteen. An AI acceptable use policy running to six pages gets signed by everyone and read by nobody, and an unread policy protects you from nothing.

1. Which tools are approved. Name them. “Use the company ChatGPT account” is a rule. “Use AI responsibly” is a wish. If somebody wants a tool that is not listed, fine, they ask first.
2. What never goes in. The short list of things nobody pastes into any AI tool, ever: customer names and contact details, anything medical or financial, passwords, signed contracts, staff records, anything a client gave you under an NDA.
3. A person checks it before it leaves. Nothing generated goes to a customer, a supplier, Revenue or the internet without someone reading it and standing over it. The name on the email is still yours.
4. Who to ask. One named person, usually you. The point is that a question has somewhere to go, because the alternative to asking is guessing.

Those four cover most of what goes wrong. The rest is detail you add the first time you need it.

Writing staff AI rules people can actually recall

The test for staff AI rules is not whether they are complete. It is whether the part-timer working Saturday can remember them without looking anything up. What helps:

• Write it in your own words. If you would not say the sentence out loud in the kitchen, cut it.
• Give the reason, briefly. “Don’t paste customer details in, because we can’t promise where they end up” sticks. A bare prohibition gets worked around by whoever is in a hurry.
• Say what is encouraged, not only what is banned. Drafting, summarising a long email thread, a first pass at a job ad. People follow a policy that gives them something.
• Use examples from your own business. A café’s version names a supplier email and a review reply. A physio clinic’s names patient notes. Generic examples get generic compliance.
• One page. If it does not fit, you are writing a manual, and nobody reads manuals.

Then say it out loud once, to everybody, in a ten-minute meeting. A policy that arrives only as an attachment has not really arrived.

AI policy Ireland: where the law comes into it

Two bodies of law matter at your size, and neither needs the document to look official.

GDPR is the one with teeth day to day. Customer and staff personal data going into an AI tool is processing of that data, and the free consumer tiers are not built for it. The fix is usually a business account with training on your inputs switched off, plus the never-paste list above. Fuller version in my note on putting client data into AI tools.

The EU AI Act is the other, and for ordinary tools it lands lighter than the headlines suggest: mostly transparency, and making sure staff know what they are using. The exception worth naming is hiring. Screening CVs with AI is treated far more seriously than drafting a newsletter, so if anyone is tempted, the policy should say to come to you first.

Neither is satisfied by having a document. They are satisfied by the document being true. A policy saying nobody pastes client data in, while everybody does, is worse than none, because you have written down a standard you are visibly failing.

A one-page AI policy you can copy

Fill in the brackets, delete what does not apply, keep it to a page.

• Why we use AI. One sentence: we use AI to cut repetitive writing and admin, so we spend more time on [the actual work].
• Tools you may use. [Named tools and accounts.] Anything else, ask first.
• Never put these into an AI tool. [Customer names and contact details, payment details, medical or financial records, passwords, contracts, staff files, anything under an NDA.]
• Always check before it goes out. Send it only if you would have been happy to write it. Verify any figure, date, name, price or legal point yourself.
• Tell people where it matters. [Where you disclose AI use. For example: no AI-drafted reply to a complaint goes out unread.]
• If something goes wrong, tell [name] the same day. Nobody is in trouble for flagging it early.
• Questions: [name, and how to reach them].

That last rule does more work than it looks. The failure you want to avoid is a wrong figure sitting in a customer’s inbox for a fortnight because whoever sent it hoped nobody would notice.

How to stop it going stale

Put a review date on it, six months out, and keep it. Most reviews change one line: a tool added, a tool dropped, one new example of something that went sideways. The other half is using it. When somebody asks whether they can run the newsletter through Claude, answer from the policy rather than off the cuff, and if it does not cover that, add the line this week.

Most of this you can do in an hour on a wet Tuesday, and you should. If you would rather somebody looked at what your team is already using and told you where the real exposure sits, that is part of what the AI Assessment covers: a straight read of how your week runs, and a plain plan for what to fix first. Either way, write the page. The version in your head does not count.

AI for driving instructors is mostly a diary problem: cancellations, rescheduling, reminders and the messages you end up answering at the kerb between lessons.

AI for salon booking earns its keep on three things: no-shows, rebooking, and answering the phone while both your hands are in someone’s hair.

AI for a veterinary practice is best pointed at the admin, not the medicine: vaccination recalls, appointment reminders, and the phone that rings mid-consult.

An AI agent is a tool that carries out a job on its own rather than waiting for you to ask, deciding the steps itself and using your systems to get it done. Most small businesses do not need one yet, and the ones that do usually need exactly one.

AI pays for itself fastest in a recruitment agency on the writing and the follow-up, not on deciding who gets shortlisted. Job specs, candidate summaries, interview notes and the chase that keeps a placement alive are all repetitive, high-volume, and safe to hand over. Screening decisions are not.

AI earns its place in an Irish pharmacy on the counter admin and the phone, not anywhere near clinical judgement or the dispensing process. The wins are the repeat-prescription chase, the same twenty questions asked every day, and the paperwork that piles up behind the dispensary.

Most useful AI automation for a small business is working within days, not months. A drafting habit takes an afternoon, a single automation that runs by itself usually takes one to three weeks, and anything quoted in quarters is either much bigger than you need or badly scoped.

AI for a gym or fitness studio is most useful on the admin around the training, not the coaching: bookings, no-shows, lapsed members and the weekly content.

No business is too small for AI, but plenty are too small for the version of it being sold to them. If you are one person with a phone and a spreadsheet, the useful question is not whether to adopt AI, it is which single job in your week you would hand over first.

An AI course teaches you to use the tools; an AI consultant works out which jobs in your business are worth handing to them. Most owners need the second thing first, then the first thing to stick.

Real AI automation examples for a small business are duller and more specific than the hype suggests: a quote drafted from site notes, an inbox sorted before you open it, an invoice chased on day seven, a Monday report that writes itself.

AI for a construction small business earns its keep on the paperwork, not the building: drafting quotes, writing up site records, and chasing the documents and payments that quietly stall a job.

AI for estate agents in Ireland earns its place on the admin that eats a viewing day: drafting listing copy, chasing enquiries before they go cold, and turning scribbled viewing notes into follow-ups you would otherwise write from memory.

Writing AI prompts that actually work means giving the tool three things every time: the real context, the exact output you want, and an example of good, so it stops guessing at what "good" means.

AI vs hiring in a small business comes down to one test: automate the work that repeats to a pattern, and hire when the job needs judgement or presence.

AI email management works best for a small business when it sorts and drafts while you decide what actually gets sent, which keeps replies personal.

AI helps a Cork clinic write appointment reminders, draft patient information sheets and answer common questions faster, but anything touching patient records needs a properly configured, GDPR-compliant tool, not a free consumer chatbot.

AI helps a Cork shop write product descriptions, answer supplier and customer emails faster, and turn reviews and stock updates into social posts, without needing any technical setup.

AI is useful in a small Irish law firm for drafting, summarising and admin, as long as a solicitor checks every output and client confidentiality is settled first.

The EU AI Act applies lightly to most Irish small businesses: if you use ordinary AI tools, your duties are transparency and staff training, not paperwork.

An AI receptionist for a small business is software that answers calls, texts, or web chats when nobody is free to pick up, and either resolves the enquiry or books a slot straight into your calendar.

The best AI tools for small businesses in 2026 aren’t one big platform, but a short list matched to the job: a chatbot for drafting, a notetaker for meetings, and one scheduling tool that actually talks to your calendar.

To choose an AI consultant in Ireland, look for fixed pricing, a guarantee tied to a real outcome, and someone who names the tools before you pay anything, not after. Beyond that, most of the job is spotting who is selling hype and who is going to sit with your actual week.

Is AI actually worth it for a small business? Usually yes, but only for the dull, repeatable parts of the week, not as a blanket upgrade to everything you do.

How much does AI automation cost for a small business in Ireland? Honestly, less than most owners fear, once you split it into three plain tiers. The trouble is that the true answer starts with “it depends”, and nobody enjoys hearing that. So I’ll break the range down properly, with real figures where they exist and clear bands where they don’t.

The AI Assessment is a 60-minute look at how your week actually runs, ending with a plain plan and a four-day quick-start you can follow.

Is it safe to put client data into AI tools? Usually yes, if you pick the right tier and follow a few plain house rules that keep GDPR onside. The honest answer, for most businesses I meet around Cork, is that the tool itself is rarely the problem. The habits around it are. A lot of the worry I hear from owners is vague. “I don’t want to get in bother, so we just told the team not to touch it.” That is understandable. It usually means the team is using AI anyway, quietly, on their own phones, with no rules at all. Which is the worst of both worlds.

Seven low-risk tasks a small business can automate this month, each quick to set up and chosen to give a Cork owner back real time each week. None of them need a big project, a new platform, or a member of staff who understands code. Most are jobs you already do by hand every week: the small repetitive stuff that takes an hour here and forty minutes there until half your Friday is gone. So here are seven, with a plain reason each one is worth doing.

AI for hospitality doesn’t have to mean losing the personal touch. Here’s how Cork cafés, restaurants and hotels can use it to cut admin. Picture a Saturday in a busy spot off Oliver Plunkett Street. The floor is full, the kitchen is flat out, and somewhere between the lunch rush and the evening covers a pile of small jobs is stacking up. Three reviews to reply to. A supplier waiting on an order confirmation. Two enquiries in the inbox asking the same thing about the set menu. None of it is hard. All of it eats the hour you should be spending on the floor, or at home.

AI for accountants and bookkeepers in Ireland saves real time on drafting, summarising and chasing, but the figures still need a human eye. If you run a small practice in Cork or anywhere across Munster, you know the shape of the week already. Client work in the day, then the admin tail after: the email you owe three people, the meeting notes you meant to write up, the reminder about a VAT deadline you keep forgetting to send. That tail is where AI earns its keep. Not on the numbers themselves. On everything wrapped around them.

AI for tradespeople in Cork can take quotes, invoice chasing and job notes off your evenings, so the paperwork stops eating your nights. Picture the usual. It’s half nine at night. The van’s back, the kids are down, and you’re at the kitchen table with a cold cup of tea, working out a quote you should have sent on Tuesday. You’re grand on the tools. Nobody ever told you the job came with two hours of admin a night.

Do you need an AI consultant, or can you sort it yourself? Here’s an honest guide for Cork and Munster owners on when DIY works and when help pays. A lot of the time you can do it yourself, and I’ll tell you when. I’d rather you spend nothing and get a small win than hand me money for something you could have set up over a wet Sunday afternoon.

To know if your business is actually making money, you need one view that refreshes itself and gives a straight answer on a Monday. A lot of the owners I talk to here in Cork are flat out. The vans are moving, the diary is full, the team is stretched. Then I ask one simple question, how much did you actually make last month, and the honest answer is a shrug. That shrug is not a sign anyone is doing a bad job. It is a sign the numbers live in too many places to see at once.

ChatGPT vs Claude for business? For most Irish SMEs both are excellent, so the real win is picking the one your team will actually use. I get asked this a lot by owners around Cork, usually after someone in the family or the office swears blind by one of them. It’s a fair question. Here’s how I’d think about it, without the hype.

One team I worked with started every week the same way. Someone exported four files, cleaned them by hand, pasted them into a template, and sent it round by ten. Two hours gone before the real work even started.

There is a lot of noise about AI taking jobs. On the ground, in ordinary businesses, that is not what I see happening.