Rules Before Tools: A Plain English AI Policy for Small and Medium Sized Firms

The internet reached the workplace before the rules for using it did, and firms spent a decade catching up. AI is repeating the pattern, faster and with higher stakes, because what leaves the building this time is the firm's own knowledge. This paper argues that a small firm does not need a compliance department to use AI safely. It needs one page of written rules, a named owner, a clear list of what never goes into a tool, and the habit of checking what comes out.