Most Small Businesses Use AI. Only 23% Have Written Rules for It.

TL;DR: Most small businesses already use AI, but few have written down how. In one 2026 survey, 61% of small and midsized businesses were actively using AI and only 23% had a documented AI use policy. You do not need a committee to close that gap. One page covering approved tools, data that stays out and who reviews the output is enough to start.

Ask a small business owner whether the team uses AI and the answer is usually yes. Ask where it is written down which tools are fine, what data can go in and who checks what comes out, and the answer is usually a pause. That pause is the gap this post is about.

Why write AI rules if everyone already uses AI?

Because the rules already exist, they are just unwritten. Each person has their own idea of what is safe to paste into a chatbot. Each person has their own habit for checking a draft before it goes to a client. When those habits differ, the business inherits the weakest one.

Written rules do two practical things. They tell a new hire the answer on day one instead of week six. And they give you a starting point when you automate something, because the data and review questions are already settled.

What the numbers say

The Pax8 Pulse report for Q2 2026 surveyed 402 U.S. small business leaders and reports a margin of error of 4.9 percentage points. Its findings on adoption and governance:

Training shows a similar gap. A Thryv survey of 561 small and midsized business owners, fielded in April 2026, found that 70% say they need more training to use AI effectively. These are vendor surveys with different samples, so read them as direction, not exact measurement. The direction is consistent: use is ahead of structure.

What should a one page AI policy cover?

Keep it to one page. If it is longer, nobody reads it. Five short sections are enough.

1. Approved tools. The tools people may use for work, and who to ask before adding another.
2. Data that stays out. Client personal details, payment information, contracts and anything under an NDA, unless the tool is approved for it.
3. Review before it leaves. Anything AI drafts for a client or the public gets read by a person first.
4. Disclosure. When you tell a client that AI helped, if your clients or contracts expect it.
5. An owner. One named person who keeps the page current and answers questions.

That last item is the same lesson as automation needing an owner. A rule with no owner drifts the same way a workflow does.

Who checks the output?

This is the part most teams skip, and it matters most once AI starts acting instead of only drafting. If an agent can send, book or update something, the policy should say which actions need a person to approve first. We wrote about planning for the waiting that approval adds, and about why agents need a defined stop. Both are easier when the review rule already exists on paper.

Does a small team really need this?

Yes, but a small one. A five person team does not need a governance board. It needs the same answer from everyone to the question "can I paste this in?" One page, reviewed twice a year, does that. The goal is fewer guesses, not more paperwork.

The takeaway

Using AI is no longer the hard part. Most small businesses are already doing it. The edge now is in having decided how: which tools, which data, who checks. Write that on one page this week, name an owner and review it twice a year. Every automation you add after that starts on firmer ground.

Keep reading

• Market Shifts

  Business Agents Now Wait for Your Approval. Plan for the Waiting.

• AI Statistics

  62% Are Building Agents. Nearly Half Already Ban Autonomy Somewhere.

• Myth-Busting

  Your Automation Is Not Set and Forget. It Needs an Owner.