How to write a one-page AI rule sheet for your New York business
Finish today with one page that tells your team what never goes into ChatGPT or Claude, what always gets a human check, and who to ask when unsure.
By the end of this guide you will have a written one-page AI rule sheet your team can use today: what customer data never goes into ChatGPT or Claude, what always gets a human check before it leaves the office, and who to ask when someone is unsure. You need two things before starting: a chat window with ChatGPT or Claude open, and the New York Attorney General's SHIELD Act page open for reference. This is general information, not legal advice.
The New York Attorney General publishes a SHIELD Act page under its Data Breach Reporting guidance for organizations. The page is the state's own reference on the law, and it is the right page to keep open while you write your rules. Because a small business using AI is a small business moving information around, the practical question for you is simple: which pieces of customer information should never be typed into a chatbot, and how do you make that rule stick.
Why a rule sheet, not a policy binder
Long policies sit unread. A single page taped to the wall gets used. The goal is a document short enough that a busy employee will actually scan it before pasting something into a chat window. Three sections do the work: a never-goes-in list, an always-gets-a-human-check list, and a named person to ask. We use this same structure when we help a team build safe-use ground rules, and it works because it answers the two questions people actually have in the moment.
Keep the page in the tools your team already uses, such as a shared drive or a pinned message, and also print one copy for the wall. The printed copy is the one people see when they are moving fast.
Write the rule sheet
- 01Open the reference page
Open the New York Attorney General's SHIELD Act page under Data Breach Reporting and keep it in a tab. You will refer to it while deciding what counts as private information for your business.
- 02List what never goes in
Write a short list of the customer information your business holds that should never be pasted into ChatGPT or Claude, such as full names paired with account details, payment card numbers, government identification numbers, and health information. One column, plain words, no legal definitions.
- 03List what always gets a human check
Write a second list of outputs that leave the office only after a person reads them: quotes, estimates, emails to customers, and anything that states a price, a date, or a promise. AI drafts, a person sends.
- 04Name who to ask
Write one name and one phone number or channel for the question "can I put this in?". If you are the owner, write your own name. One name, not a committee.
- 05Write the rule for unsure moments
Add one line at the bottom: "If you are not sure whether something goes in, ask first." This single line covers everything the lists missed.
- 06Run a live test
Open ChatGPT or Claude in front of the team and walk through one real task, showing one thing from the never list staying out and one draft from the check list getting reviewed. Ten minutes, once, makes the page real.
- 07Print and post it
Print the page, post it where the team works, and save a copy where the team can find it digitally. Revisit it whenever you add a tool or a new kind of customer data.
Where people get stuck
The list feels too short
A short list is the point. If the never-goes-in list runs past ten items, nobody reads it. Keep the items that name real categories of information your business actually holds, and let the "ask first" line carry the rest. You are writing a habit, not a statute.
Team members use personal accounts
The rule sheet should state plainly which tool the business uses, and that customer work happens there, not in personal accounts. If you have not picked a tool yet, pick one before you post the page. Owners usually need one AI subscription such as ChatGPT or Claude, paid directly, and any cost should be named before anything is bought.
Nobody follows it after week one
Rules decay without a check. Put a five-minute item on a weekly or monthly meeting: one example of something that stayed out of the chatbot and one draft that got a human check. Praise both. The page survives because someone keeps mentioning it, not because it was written.
If you want help building this, our AI Training for Business is hands-on, built on approved real tasks, with sessions that run 90 minutes and up. People leave with take-home routines, safe-use ground rules, and a follow-up check-in. Training happens on Zoom, and the same scope and quality bar apply anywhere in New York State. Everything built lives in your own accounts and is yours to keep.
