AI Policy for Small Business: A Practical Playbook

In late June, Brussels did something regulators almost never do: it handed businesses more time. The Digital Omnibus on AI, endorsed by the European Parliament on 16 June and adopted by the Council on 29 June 2026, pushed the EU AI Act’s high-risk obligations back by sixteen months or more. The headlines said “delayed”. A sizeable share of the business world heard “cancelled” and shelved their preparations, which would have been a rational response were it not for the one set of obligations that did not move at all: the transparency rules that will still take effect, precisely on schedule, on 2 August 2026.

If your business uses AI, and by now that describes most businesses that use computers, the sensible response to all of this is a written AI policy for small business use: one or two pages defining which tools are approved, what data may go into them, what may never go anywhere near them, and who checks the output before it reaches a customer. Wrap that policy in a light quarterly routine and you have AI governance without the enterprise price tag. This playbook covers the regulatory timeline as it actually stands, the five sections your policy needs, and a 30-day plan to build the whole thing.

The EU AI Act and Small Business: What Will Take Effect on 2 August

The AI Act entered into force in August 2024 with staggered compliance dates, and by late 2025 the supporting infrastructure (harmonized standards, national regulators, official guidance) was visibly behind schedule. The Digital Omnibus was the fix. It deferred the heavyweight high-risk regime, the part covering AI in hiring, credit scoring, and critical infrastructure, but left the broadly applicable transparency layer exactly where it was. The revised calendar now looks like this:

Article 50 is the part most likely to touch an ordinary small business, because it keys off what a system does rather than how risky regulators consider it. If a chatbot greets visitors on your website, it must disclose that it is AI. If you publish AI-generated images, audio, video, or text of public relevance, it must be identifiable as such. Providers of generative systems must mark outputs in a machine-readable way, with a short grace period to December 2026 for systems already on the market.

The catch for Canadian owners is reach. The Act applies to providers and deployers outside the EU whenever the system or its output is used inside the EU. A Vancouver firm whose website chatbot serves visitors in Frankfurt, or whose marketing team publishes synthetic media to a European audience, is within scope regardless of where the company is incorporated. Penalties for transparency breaches run to EUR 15 million or 3 per cent of worldwide turnover, whichever is higher; for small and medium-sized enterprises the Act caps fines at the lower of the two figures, which is proportionality of a sort, though the lower of two large numbers is still a large number.

The practical lesson sits one level up from the dates. Businesses that heard “the EU delayed the AI Act” and stood down their compliance work are precisely the ones now exposed, because the obligation most likely to apply to them was never delayed. The delay bought time for the hard cases. It did not buy time for the common ones.

Where Canada Stands: The Voluntary Code Is the Standard

Canada’s own attempt at binding AI law is a shorter story. The Artificial Intelligence and Data Act, packaged inside Bill C-27, died on the order paper when Parliament was prorogued on 6 January 2025, and the current government has chosen not to revive it. The national AI strategy launched in June 2026 is an adoption and investment program, aiming to lift business AI use from roughly 12 per cent toward 60 per cent by 2034, and it explicitly contemplates no comprehensive AI legislation for now. Ottawa, in short, wants you using AI more, not filing paperwork about it.

That leaves the federal Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems, published in September 2023, as the de facto national standard. It carries no legal force, but its six principles (accountability, safety, fairness and equity, transparency, human oversight and monitoring, validity and robustness) are the outline regulators, insurers, and larger customers expect to see reflected in how you operate. If you have already worked through an AI ethics framework for your business, the Code will read as familiar territory; the policy described below is where those principles acquire teeth.

Two caveats stop “voluntary” from meaning “optional”. First, privacy law never went anywhere: PIPEDA federally, and provincial statutes such as BC’s PIPA, already constrain what personal information may be fed into any system, AI included. An employee pasting a customer list into a free chatbot is a privacy problem today, no new statute required.

Second, the absence of a Canadian AI act does nothing for your EU exposure. The result is an odd inversion: the binding rules most likely to apply to a Canadian small business’s AI use are European, while the Canadian standard you will be measured against is voluntary. A written policy is how you satisfy both without thinking about either every day.

The AI Acceptable Use Policy: Five Sections That Earn Their Keep

Enterprise AI policies run to forty pages because forty people had to approve them. Yours needs five sections and two pages, and it borrows its structure from the acceptable use policy templates that IT security firms have refined over the past two years. Write it in plain language; a policy nobody reads governs nobody.

Scope

State who the policy covers (employees, contractors, anyone with access to company data) and what counts as AI use. Cast the second net wide: public chatbots, AI features embedded in the software you already pay for, transcription and meeting tools, image generators, and code assistants. Most firms discover their real AI footprint is double what the owner thought, because half of it arrived as feature updates inside existing subscriptions rather than as deliberate purchases.

Data classification

This is the section that does the heavy lifting. Define four tiers and map each to what is permitted: public information (anything already published), internal (day-to-day working material), confidential (financials, contracts, unreleased plans), and prohibited (customer personal information, employee records, payment data, anything under an NDA). Public and internal data may go into approved tools. Confidential data goes only into tools with contractual data protections. Prohibited data goes into nothing, ever, no matter how helpful the summary would be.

Approved tools

List the tools your business has actually vetted, and require business accounts rather than personal ones, since business tiers typically allow you to opt out of your data being used for model training. Add a request path for new tools: a short check of the vendor’s security posture, data retention terms, and training-data practices before anyone adopts it. If you are still choosing your first tools, a problem-first pilot approach will keep the list short and useful rather than long and decorative.

Prohibited uses

Four prohibitions cover most of the risk. No feeding prohibited-tier data into any AI tool. No AI-only decisions that materially affect a person, such as hiring, discipline, credit, or pricing for an individual customer; a human reviews and owns every such call.

No presenting AI-generated work as human-made where the audience reasonably expects disclosure, which after 2 August 2026 is also an EU legal requirement in many contexts. And no bypassing the vetting path because a tool is free, since free tools are where your data quietly becomes someone else’s training set. Vendor vetting here should mirror the discipline in your cybersecurity practices; unvetted AI tools are simply the newest species of unvetted software.

Accountability and review

Name one owner. In a firm of five to fifty people this is a person wearing an additional hat, not a committee, and their job is to keep the approved list current, field new-tool requests, and log incidents. Require staff to report AI mishaps (wrong output shipped to a client, data pasted where it should not have been) without blame attached, because a policy that punishes confession gets silence instead of information. Set a review date every six months; AI capabilities move fast enough that an unreviewed policy ages like fish.

A Governance Routine: The NIST AI RMF at Small Business Scale

A policy is a document; governance is the habit of using it. The most practical scaffolding for that habit is the NIST AI Risk Management Framework, which is free, voluntary, and organized around four functions that scale down to a small business surprisingly well. Govern means the policy above exists, has an owner, and gets reviewed.

Map means you maintain an inventory of every AI system in use and what data it touches. Measure means you spot-check outputs on a schedule (accuracy, bias, tone) rather than assuming the machine is fine. Manage means you act on what you find: retrain staff, restrict a tool, or retire it.

The formal alternative is ISO/IEC 42001, the certifiable AI management system standard published in 2023. It follows the same plan-do-check-act logic as ISO 27001 and its relatives, and certification is becoming a procurement checkbox in some supply chains. The recommendation for most small firms: run the NIST functions as your operating rhythm now, and consider ISO 42001 certification only when a customer contract or tender demands it. Certification is evidence of governance, and evidence is worth buying only when someone is asking for it. Either way, AI governance belongs inside your broader digital transformation plan rather than beside it, so that tool decisions, security spending, and AI rules pull in the same direction.

The 30-Day Build

Week one: inventory. Survey the team on which AI tools they use, for what, with which data. Offer amnesty; nobody gets in trouble for confessing to a chatbot habit, and shadow AI that surfaces now costs far less than shadow AI discovered during an incident. Expect the list to be longer than you predicted.

Week two: classify and select. Sort your data into the four tiers, pick your approved tools, and close the obvious gaps: convert personal accounts to business accounts, switch off training on your data where vendors allow it, and shut down any tool that failed the smell test.

Week three: draft and check exposure. Write the two-page policy, name the owner, and answer three EU questions honestly. Does a chatbot on your site face EU visitors?

Does your marketing publish AI-generated content to EU audiences? Do you sell an AI-powered product into the EU? A yes to any of these puts Article 50 disclosure and labelling on your task list, not your someday list.

Week four: train and calendar. Run a thirty-minute session covering the policy, walk through two or three real examples of what may and may not be pasted where, and fold the six-month review dates into the same compliance framework that tracks your other regulatory deadlines. A policy with a calendar entry survives; a policy without one is a PDF.

Frequently Asked Questions

Does the EU AI Act apply to my Canadian small business?

It can, and the test is use rather than location. The Act applies to providers placing AI systems on the EU market and to businesses whose AI system outputs are used in the EU. A customer-facing chatbot accessible to EU visitors, AI-generated marketing published to European audiences, or an AI-powered product sold into the EU can each bring you within scope.

The obligations most likely to apply to a small business are the Article 50 transparency duties in force starting from 2 August 2026: disclosing AI interaction and labelling AI-generated content. The high-risk regime, now deferred to December 2027 and August 2028, is a concern mainly if you build or deploy AI for hiring, credit, or similarly consequential decisions. If none of your AI output touches the EU, the Act does not bind you, though its transparency norms are rapidly becoming the global default.

What should an AI acceptable use policy include?

Five sections cover it: scope (who the policy binds and what counts as AI use), data classification (tiers from public through prohibited, mapped to permitted tools), approved tools (the vetted list, business accounts required, plus a request path for additions), prohibited uses (no restricted data in AI tools, no AI-only decisions about people, no undisclosed AI-generated work where disclosure is expected), and accountability (a named owner, blame-free incident reporting, and a six-month review). Two pages is the right length for a firm under fifty people. The common failure is not a missing section but a missing owner; policies without a named person to maintain them decay within a year.

Is an AI policy legally required in Canada?

No federal statute requires one. AIDA, Canada’s proposed AI law, died with Parliament’s prorogation in January 2025 and has not been revived; the 2026 national AI strategy focuses on adoption and contains no binding rules. What exists instead is the Voluntary Code of Conduct on generative AI, which sets expectations without legal force, and privacy law with real force: PIPEDA and provincial equivalents already restrict feeding personal information into AI tools. A written policy is therefore not a statutory checkbox but the practical mechanism for staying on the right side of privacy law, meeting the Code’s principles, and handling any EU exposure. It also increasingly shows up as a question on insurance renewals and larger customers’ vendor forms, which is regulation of a more direct kind.

Do small businesses need ISO 42001 certification?

Rarely, at least today. ISO/IEC 42001 is the certifiable AI management system standard, and certification involves an external audit with costs to match. For most small firms the sensible sequence is to run the free NIST AI Risk Management Framework functions (govern, map, measure, manage) as an internal routine, keep evidence of doing so, and pursue certification only when a specific customer, tender, or regulator asks for it. That request is starting to appear in supply chains where AI touches sensitive decisions, so the answer may shift from “rarely” to “sometimes” over the next few years. Building your policy and inventory now means that if certification ever becomes commercially necessary, you will be formalizing an existing practice rather than starting from a blank page.

The pattern across all of this is that good AI governance looks less like a legal project and more like an operating discipline: a short policy, a named owner, and a calendar. The businesses that treat it that way will find the EU deadlines, the insurance questionnaires, and the customer due-diligence forms all answer themselves. If you would rather pressure-test your draft against someone who builds these frameworks alongside broader small business strategy, we keep the first discussion informal, and the conversation costs nothing.