Intuit’s 2026 AI Impact Report pulled data from more than 34,000 surveys of US small and mid-sized businesses. 77% now use AI daily. Then Pax8’s Q2 SMB AI Pulse Report, released July 13, added the number that actually matters: only 23% of small businesses have a documented AI policy. That gap sat there, mostly harmless, for two years. On August 2 it stops being harmless, because the EU AI Act’s transparency provisions take effect while US state disclosure laws keep stacking up underneath them.
This is not a compliance scare piece. The policy gap costs you before any regulator ever calls. It costs you in customer data pasted into free accounts, in three employees writing in three different AI voices, and in client security questionnaires you cannot answer. The fix fits on one page. You can write it this week, and this post walks through exactly how.
The Rules Land August 2. Your Team Wrote Theirs Months Ago
Start with what changes. On August 2, the EU AI Act’s transparency provisions go into force. Businesses that interact with EU users must tell people when they are talking to an AI system and may need to label AI-generated or AI-altered content. You may never touch an EU customer. The standard still travels, because platforms and larger clients tend to adopt the strictest rule in play and push it down their vendor lists.
The US map is messier. 47 states now have laws addressing AI-generated media, and each one defines “AI-generated” its own way. The FTC opened public comment on a proposed policy statement on AI accuracy, with the window closing July 31. Whatever comes out of that will sit on top of the state patchwork, not replace it. Waiting for the rules to settle before writing yours means waiting years.
Meanwhile your team already wrote its own rules, one personal account at a time. A BlackFog study of 2,000 employees found 49% using AI tools their employer never approved. 58% of those run free versions, the tier with the weakest data controls. In a small shop that looks like this: one person pastes the client list into a personal ChatGPT account to draft renewal emails, another records estimate calls through an AI notetaker nobody vetted, and a third publishes social posts in a voice that belongs to no one. None of it is malicious. You gave them no approved tools and no data rules, so each person invented their own. That is shadow AI, and in 2026 it is the default state of a small business.
What the Adoption Number Hides
Pax8 surveys 402 US small business leaders every quarter, and the topline looks stable: 61% actively use AI, another 29% are experimenting. The interesting number sits underneath. The share of businesses “interested but not started” collapsed from 9% to 1.5% in a single quarter. Everyone is in the pool now. The divide is no longer adopters versus holdouts. It is businesses that deployed versus businesses stuck in testing.
Governance is one of the two factors Pax8 found separating those groups. Among businesses actively using AI, about two thirds have a documented policy or written guidelines. Among the stuck experimenters, 34% do, and only 11% hold an actual documented policy. Leadership alignment follows the same staircase: 91% aligned among active users, 68% among experimenters, 32% among non-users.
Correlation is not causation, and Pax8 says so in the report. But the pattern holds across every measure they track, and the logic is plain. A written policy answers the exact questions that stall deployment: what data can we feed this, who approves a new tool, who checks the output before it ships. Businesses without answers stay in testing forever. Businesses with answers ship.
Write It Tuesday Morning: One Page, Five Sections
Step one is an amnesty audit, and it costs 30 minutes at your next team huddle. Ask everyone to list every AI tool they touch for work: which accounts, free or paid, and what they paste into them. Say the word amnesty out loud and mean it. Punish nobody. The list will surprise you, and without it you will ban tools nobody uses while missing the one everybody lives in.
Step two is the page itself. Five sections, five short paragraphs, drafted with the team in the room, because the people using the tools know where the real questions hide:
- Approved tools. Name the tools, the accounts, and who signs off on new ones. If you pay for ChatGPT Team or Claude Team seats (roughly $25 to $30 per user per month), say so, and retire the personal free accounts doing company work.
- Data rules. List what never goes into an AI tool: customer names, account numbers, financials, health data, anything under NDA. If a paid plan with data controls is in place, name it as the only place client work happens. This paragraph is the one that prevents your worst day.
- Disclosure. Decide when you tell customers they are talking to AI and where labels go on AI-made content. Write this section to the EU standard even with zero EU customers. The strictest rule wins over time.
- Human review. Name the work that always gets human eyes before it ships: quotes and estimates, anything customer-facing, anything legal.
- Spend and audit. Put every AI subscription on one budget line with a cap, and check spend against output monthly. This is also how you find the tools nobody uses anymore.
Step three: put a quarterly review on the calendar before you file the page. New tools arrive monthly and the rules change faster. A one-page policy reviewed four times a year stays true. A ten-page policy nobody rereads is fiction with a header. This is the whole reason a small business wins here: a 200-person company needs committees and weeks to do this, and you need a Tuesday morning and a pot of coffee.
The Same Page Wins Your Next Security Review
The compliance case gets the headlines. The sales case pays sooner. Larger clients now push their AI anxieties down the vendor chain, and the questions arrive with no warning inside security questionnaires, MSA negotiations, and renewal calls: how does your company use AI, where does our data sit, who reviews output before we see it.
The operator with a one-page answer replies in minutes and looks like the organized choice. The operator without one either improvises or goes quiet, and both read as risk. The same page also settles nerves inside the shop. Your people get a clear yes on the tools that help them do the work, instead of a vague fear that using AI might cost them the job.
The signal to watch over the next 30 days: what the FTC does after the July 31 comment window closes. If a federal accuracy standard emerges, it will collide with 47 state definitions, and the businesses holding a written policy will adjust one paragraph. Everyone else starts from a blank page, under deadline, with a client on hold. Write yours while it is still a Tuesday-morning job and not a fire drill.
We build AI systems for operators who want the upside without the babysitting, and a one-page policy is the cheapest insurance in the stack. New playbooks land here every weekday. Subscribe and put them to work.
