One Page Beats Forty: The AI Policy People Actually Read

Somewhere in your document store is a forty-page AI policy. It was drafted carefully, reviewed twice, and approved with ceremony. Almost nobody has read it, and nobody's Tuesday behavior changed because of it.

A policy nobody reads is not a control. It is evidence of intention. The control is the one page people can remember: what data never goes into an AI tool, which tools are approved, and when a human must review the output.

Write that page first. The forty pages can follow for the auditors, but the page is what governs behavior.

TLDR

• If people cannot repeat the rules, the rules do not exist.

• One page, three sections: data, tools, human review.

• Name real examples from your business, not abstract categories only.

• Publish where people actually look, and re-run it when tools change.

• Keep the long policy for auditors; never confuse it with the working rule.

Three sections carry all the weight

Data: what may never be entered into an AI tool - customer records, unpublished financials, personal data, credentials, and anything under an NDA. Tools: which services are approved and with what account type. Review: when a human must check the output before it ships - anything customer-facing, anything contractual, anything that affects a person.

Everything else in a forty-page policy is elaboration of these three. If the page nails them, the organization is meaningfully governed. If it does not, the appendix does not matter.

Use your own nouns

'Do not share sensitive data' teaches nothing. 'Do not paste the customer master, the pricing spreadsheet, or anything from the HR system into an unapproved tool' teaches at a glance. Name your actual systems, your actual data, and your actual tools.

This fictional example shows the shape of a one-page policy. It is an illustration, not a policy to copy.

Rule area	The one-line rule	A real example
Data	No customer, HR or unreleased financial data in unapproved tools	Drafting a customer email is fine; pasting the account list is not
Tools	Use the company AI account, never a personal one	Log in with your work SSO, not your Gmail
Review	A human checks AI output before customers or contracts see it	The proposal goes out after your edit, not before

Publish where people look

The one page belongs in the onboarding pack, pinned in the team channels, and printed near the coffee machine if your office still has one. It should take thirty seconds to find and two minutes to read.

NIST's AI guidance emphasizes that governance works when it is integrated into how people actually operate. A policy that requires a document search to consult fails that test on day one.

Refresh on the tool cycle, not the audit cycle

AI tooling changes quarterly. Set a standing review - every quarter, or whenever a major tool or vendor term changes - and update the page in plain language. Version it, date it, and tell people what changed.

Keep the forty-page version aligned for the auditors and regulators who will ask for it. Just never mistake it for the mechanism that changes what an employee does at 4:45 on a Friday.

The related discussion of building trustworthy AI is worth your time alongside this one.

Frequently asked questions

Is one page really enough?

For behavior, yes - the page carries the rules people must remember. Keep the detailed document behind it for edge cases, procurement reviews and audits. The page is the interface; the document is the reference.

Who should write the page?

A small group: security, legal or compliance, and one or two heavy AI users from the business. Users keep the rules honest; governance keeps them safe. A page written by governance alone tends to ban everything and get ignored.

How do we handle exceptions?

The same way you handle them elsewhere: a named approver, a reason, and an expiry. One line on the page - who to ask - is enough.

A Defensible Next Step

Draft your one page this week: three sections, your own system names, and a named owner for exceptions. Pin it where people work. Book a Decision-Clarity Call if you want a critique of the first draft.