x
Because they do different jobs and neither can do the other's.
Your terms and conditions are a defensive instrument. They are written for a dispute, in a register lawyers understand, and their success condition is that they hold up if things go wrong. Nobody reads them, and that's fine — they're not for reading.
A one-page AI policy is a persuasive instrument. It's written for a cautious client at 9pm deciding whether to send you an enquiry, and its success condition is that they finish it and feel better. Twelve pages protects you. One page reassures them. You need both, and the mistake is assuming the first covers the second.
Half an hour on a Saturday. Here's what goes on it.
1. Where we use AI. The tasks, not the tools — drafting, summarising, first-pass research, data tidying. Specific and dull.
2. Where we never use it. This line does more work than the first. Naming a boundary is the fastest way to demonstrate you have one. "We don't use AI to produce advice, analysis or recommendations. Those are ours."
3. Who reviews the output. A person, named by role. "All client-facing work is reviewed by the director before it's sent." If review is partial, say which parts — a checkable narrow promise beats an unkeepable broad one.
4. What happens to your data. Where it goes, what you don't upload, whether anything is retained by a third party. If you use a tool with a business tier that excludes training, say so; if you don't know your tools' settings, that's this afternoon's job before it's this page's sentence.
5. How to ask us not to. The opt-out. Most policies omit it entirely, and it costs you almost nothing — very few clients invoke it, and the ones who read it are reassured that they could.
6. When we last reviewed this. A date. Just a date.
The sixth, and it's the one that does the most damage by its absence.
An undated policy reads as abandoned. A policy visibly dated 2024 says more about your operation than no policy at all — it tells a reader you wrote something once, when it felt urgent, and haven't looked at it since the tools changed twice. A date is the cheapest credibility signal on the page, and it's the only line that costs nothing to keep true.
Then actually keep it true. Diarise a quarterly re-read alongside the disclosure audit — fifteen minutes, same sitting, because the audit tells you whether the policy still describes reality. New surfaces appear every time you try a tool, and a policy that hasn't noticed is a policy that's quietly become inaccurate.
The other frequently-omitted line is the second one. Founders write where they use AI and stop, because the boundary feels like an admission of limits. It's the opposite. A supplier who can state precisely what they won't hand to a machine is a supplier who has thought about it, and thinking about it is the whole product.
Like a person wrote it. That's the entire brief, and it's harder than it sounds because the temptation to sound impressive is strongest exactly where you should sound plain.
Cut anything that would look at home in a pitch deck. No "leverages cutting-edge". No "AI-powered excellence". Short sentences. Real examples — "for instance, we'll ask AI to summarise a 40-page report, then read the report" — because a concrete example is worth three paragraphs of assurance.
And write nothing you won't do. This is the point where a policy stops being a document and becomes a commitment, and the arithmetic is unforgiving: one broken line costs more than the whole page earned. If you can't promise same-day human review, don't. Promise what's true. Everything in the three sentences applies here at slightly greater length — the page is those sentences with the edge cases filled in.
Two links and one habit.
Link it from your site footer, so it's findable without being sought. Link it from every proposal, so it arrives at the moment a client is deciding. Then re-read it quarterly, which is the habit.
If the transparency rules that applied on 2 August 2026 reach your business, this page is also the obvious home for the standing disclosures — though it doesn't replace the in-context ones, because a policy page a user never visits doesn't tell them the chat window is answered by a machine. Both, not either.
Not legal advice — a policy page is not a substitute for advice on your own position.
Half an hour. Six lines. A date at the bottom. It'll answer more questions than any page on your site.
For the prompt set we use to draft and pressure-test it — free, 5-min read: 7 AI Prompts That Run a One-Person Business.
Related Decodes
AI the Brief (@aithebrief) — AI advice you can act on and trust, for time-starved founders.
TL;DR: Terms and conditions are defensive and nobody reads them; a one-page AI policy is persuasive and is read by cautious clients before they enquire — you need both. Six lines: where you use AI (tasks, not tools), where you never use it, who reviews the output, what happens to client data, how to ask you not to, and when you last reviewed the page. The date is the line everyone forgets and the cheapest credibility signal there is, because an undated or 2024-dated policy reads as abandoned. Write it like a person — no pitch-deck language, short sentences, one concrete example — and write nothing you won't actually do, because one broken line costs more than the whole page earned. Link it from your footer and every proposal, and re-read it quarterly alongside your disclosure audit.
