The Notebook Method for AI Guardrails

You don't need compliance software to have AI guardrails. You need a notebook. Here's the method:

Page one: list every AI tool the business uses, who uses it, and what for. One line each.

Page two: the rules. Three or four sentences your whole team can memorize — things like "no customer data in AI tools" and "a human reviews everything before it goes to a client."

Page three: the log. Date, tool, what you used it for, anything odd. One line per use, or per week — whatever you'll actually maintain.

That's it. Three pages. And here's why it works: most AI problems in small businesses aren't sophisticated attacks. They're someone pasting the wrong thing, or nobody remembering who approved what. A notebook answers both.

Review it once a month — ten minutes. Anything in the log that surprises you becomes a new rule on page two. Your guardrails grow with your actual experience instead of some consultant's template.

Fancy systems fail when nobody maintains them. A notebook you'll actually open beats software you'll actually ignore. Start with paper; graduate to software when the notebook bursts.

I explain frameworks; I don't give legal counsel.