🎯 The business: you help a small firm decide which AI tools staff may use, for what, and with which data, then write it down as a short policy people actually follow. You inventory what is already in use, check each tool’s data terms, sort uses into allowed, allowed with limits and not allowed, brief the staff, and review it every quarter. Where a law applies, the client’s own lawyer signs off; you organize the work, you do not give legal advice.
At a glance
| Money to start | ≈ $840 to $2,630 |
| Time to the first paid engagement | 1 to 3 months |
| Hours a week | 10 to 25, mostly business hours |
| Skills that matter most | Knowing how offices handle client data, reading software terms closely, writing plain rules |
| What it can pay | About $5,010 a month before tax with one review, one policy and two tool checks (worked below) |
Is this for you?
It suits someone with real office experience: a former practice manager, compliance or HR person, IT administrator, paralegal, or someone who ran operations at an accounting or insurance firm. You need to be comfortable reading terms of service and asking a managing partner awkward questions.
It is a poor fit for a beginner or a student working alone. Clients are trusting you with their clients’ data, and they want someone who has seen how things go wrong. A student can do well assisting an experienced consultant. It is also a poor fit if you want to tell people what the law requires; that is a lawyer’s job, and this business works only if you stay on your side of that line.
Who pays, and what
Firms of 5 to 100 people that hold sensitive client data: accountants and bookkeepers, small law firms, insurance agencies, clinics and therapy practices, financial advisers, staffing agencies, agencies handling client marketing data, and nonprofits with donor records. The trigger is usually a scare: a staff member pasted a client file into a free chatbot, a client asked "do you use AI on my data?", or an insurer or large customer sent a questionnaire.
The worry is widespread. In Bluevine’s April 2026 survey of 942 small-business owners, data security and privacy was the top barrier to AI, named by 33%, up from 23% a year earlier. In Goldman Sachs’ March 2026 survey, 50% of owners using AI named privacy and security as a challenge.
No survey publishes rates for this work. Research notes for this section put small-firm engagements at roughly $1,500 to $10,000 (an estimate from consultancy blogs). Free policy templates are everywhere, so you are paid for tailoring the rules to the firm’s real tools and data, and for making staff follow them.
What it takes to start
| LLC and city or county license | $150 to $500 |
| Professional liability (errors and omissions) insurance, first payment (an estimate; get quotes) | $400 to $1,200 |
| Two paid AI accounts to test tools and settings, a year | About $240 to $480 |
| A course or books on privacy and AI risk (optional; NIST’s AI materials are free) | $0 to $300 |
| Simple website, domain, business email | $50 to $150 |
| All-in | ≈ $840 to $2,630 |
Do not skip the insurance. If a firm follows your rules and still has a data incident, you want coverage and a contract that says what you did and did not promise. See Business insurance.
Start to finish: the steps
1. Pick the industries you already know. An ex-paralegal should start with law firms, an ex-practice manager with clinics. Each industry has its own data rules and its own words, and clients pay for someone who speaks them.
2. Build your toolkit. A tool inventory sheet, a staff survey ("which AI tools do you use, for what, on which account?"), a tool-review checklist (who owns the data, is it used for training, can it be deleted, will the vendor sign a business associate agreement, where is it stored), and a policy template you wrote yourself.
3. Make the business legal. Register an LLC, get the local license, open a business bank account, bind insurance, and write a contract that states you provide operational guidance, not legal advice. See Choosing a legal structure.
4. Start with a readiness review. Interview the owner and two or three staff, run the anonymous survey, and list every AI tool in use, including the free ones on personal phones. Hand back a short report: what is in use, the three biggest risks, and what the policy should cover.
5. Check each tool’s terms. For every tool in use or wanted, read the business terms: does the plan train on inputs, who can see the data, how long it is kept, whether admin controls exist. Note which plan the firm would need, such as a business plan rather than a free account.
6. Sort the uses. Put every use the staff want into one of three lists, like the example below. This is the heart of the policy and the part staff remember.
7. Write the policy and send it to their lawyer. Two to four pages: approved tools and plans, the three lists, who reviews AI output before it reaches a client, how to report a mistake, and who owns the policy. Where HIPAA, hiring rules or professional duties apply, the firm’s lawyer reviews it before it is adopted.
8. Brief the staff. A one-hour session with real examples, a one-page summary, and a signed acknowledgment. A policy nobody has heard of protects no one.
9. Review every quarter. New tools, new features and new laws appear constantly. A quarterly check of the inventory and the lists is the repeat business, and it is what clients value once the first scare has passed.
Pricing
| Readiness review: interviews, survey, tool inventory, short report | $750 to $2,000 |
| AI-use policy written for the firm, plus one staff briefing | $1,500 to $4,000 |
| Review of one tool’s terms and settings | $250 to $600 |
| Quarterly review | $250 to $600 a quarter |
These are example prices; no survey covers them. Price by scope (people interviewed, tools reviewed, industries’ rules involved), not by the hour. Never say the policy makes a firm "compliant" with a law; you can say it documents how they use AI and was reviewed by their counsel. More in Pricing AI and IT services.
The math
Take a consultant about a year in, with referrals from accountants and IT providers. One readiness review at $1,500, one policy package at $3,000 and two tool reviews at $400 bring in $5,300 in a month. Costs: about $100 set aside for insurance, $40 for AI and software, and $150 of marketing, $290 in all. That leaves about $5,010 before tax for roughly 25 hours a week. Months vary a lot; some bring only quarterly reviews.
The first engagements take longer than you expect, because you are building templates as you go. Set aside a quarter to a third of profit for income and self-employment tax.
Getting customers
Who to approach first. Firms in your old industry, and the advisers they already trust. IT providers, cyber insurance brokers and business lawyers are asked about AI constantly and have no one to hand the operational work to. One good referral partner can keep you busy.
The first ten customers. Meet 5 referral partners (an IT provider, two accountants, an insurance broker, a business lawyer) and ask what their clients are asking. Give 2 talks to professional groups. Send 25 personal emails to owners you know or were introduced to, offering a free 30-minute "AI exposure check": five questions about what staff use today. Expect 2 or 3 paid reviews in the first three months, and most of the rest from referrals after that.
Hi Tom, I help small professional firms set rules for how staff use AI tools with client data. In most offices I visit, people already use ChatGPT or Copilot, often on personal accounts, and nobody has written down what is allowed. I do a short review: which tools are in use, what each tool does with your data, and a two-page policy with clear do’s and don’ts, which your own attorney reviews before you adopt it. Would a 30-minute call be useful? I’ll bring the five questions I start with.
Channels, best to worst, for this customer.
| 1. Referral partners | IT providers, cyber insurance brokers, business lawyers and accountants see the problem first. |
| 2. Professional associations | CPA society chapters, bar small-firm sections and local SHRM chapters book speakers. |
| 3. LinkedIn | Good here: owners of professional firms read it. Post short, specific examples. |
| 4. Chamber and SBDC talks | Broader rooms; fewer buyers, but good practice and visibility. |
| 5. Google Business Profile | Helps referred clients check you out. |
| 6. Upwork | "AI strategy and consulting" grew over 50% there in Q2 2026, but buyers are mostly remote and price-shopping. |
| 7. Paid ads | Last. Trust work sells by introduction. |
Turning clients into case studies and referrals. Most firms will not want their name used, so ask for an anonymous case story ("a 12-person accounting office") and a quote. Ask each client’s IT provider or accountant to sit in on the staff briefing; they see your work and refer others. More in the launch and marketing playbook.
Running it week to week
Spend an hour a week on news: vendor term changes, new AI features in tools your clients use, state laws and enforcement. Log each client’s tools, plans and review dates. Send a short note when something changes that affects a client, such as a vendor changing its training policy. Keep your templates current, and never reuse one client’s details in another’s policy.
Rules to check
No license is needed to help a business write internal rules. The line you must not cross is legal advice: telling a client what a law requires of them, or that they comply with it. That is the practice of law, which only licensed attorneys may do. Organize the facts, write the operational rules, and send anything that turns on a law to the client’s lawyer. Put that in your contract.
Rules your clients will ask about, which you should know well enough to flag:
Colorado: SB 26-189, signed on May 14, 2026, replaced the state’s 2024 AI Act, and its duties apply from January 1, 2027. Law-firm summaries describe it as covering automated decision tools that materially influence consequential decisions about people (jobs, housing, lending, insurance, health care, education, government services). Businesses using such tools must give notice, explain adverse decisions within 30 days, let people correct data and request human review, and keep records for three years. The Attorney General enforces it, there is no private right to sue, and rules are still being written. A firm using AI to screen applicants or tenants in Colorado should take this to its lawyer.
Hiring: Illinois has barred discriminatory AI use in employment decisions and required notice since January 1, 2026, and New York City requires bias audits and notices for automated hiring tools. Health data: anyone handling patient information for a clinic needs a HIPAA business associate agreement, and so does every AI tool that sees it. Lawyers: the ABA’s Formal Opinion 512 (July 2024) covers confidentiality and supervision when firms use generative AI. Tax preparers: federal rules limit using or disclosing tax-return information without the client’s written consent. Privacy: about 20 states have consumer privacy laws, mostly with thresholds tiny firms do not meet. EU AI Act: only if the client has EU operations or customers. See Contracts, client data and AI rules.
What goes wrong
A client asks "so are we compliant?" and you answer; don’t, send it to their lawyer. The policy is adopted and ignored; insist on the staff briefing and a quarterly check. A vendor changes its data terms and your tool list is wrong; watch the vendors your clients rely on. Staff keep using personal accounts on their phones; the policy must offer an approved tool, not just bans. And you take on an industry you do not know, such as a medical practice with no health background; partner with someone who has it.
Questions people ask
Does a small business need an AI use policy?
If staff use any AI tool with customer or client information, a short written policy is sensible: it tells people which tools and accounts are approved, what data never goes in, and who checks the output. Whether a specific law requires one depends on the industry and state, which is a question for the firm’s lawyer.
What should an AI acceptable use policy include?
Approved tools and the plan or account to use, what data is never allowed in, uses that are allowed and allowed with limits, human review before anything reaches a client, how to report a mistake, who owns the policy, and when it is reviewed. Two to four pages is enough for most small firms.
How much does AI policy consulting cost for a small business?
There is no published market rate. As an estimate, a small firm might pay about $750 to $2,000 for a readiness review and $1,500 to $4,000 for a tailored policy with a staff briefing, plus a few hundred dollars a quarter for reviews.
Do I need to be a lawyer to write an AI policy for a company?
No, to write internal operating rules. Yes, to advise a company on what a law requires or whether it complies. A non-lawyer consultant should write the operational policy and have the client’s attorney review anything that depends on a law.
Does Colorado’s new AI law apply to small businesses?
It applies by how a tool is used, not mainly by company size, according to the law-firm summaries we read: it covers automated tools that materially influence consequential decisions about people in Colorado. We did not find a small-business exemption described in those summaries. It was signed on May 14, 2026, its duties apply from January 1, 2027, and the Attorney General’s rules are still in progress, so check the final text with a lawyer.
Free help
NIST’s AI Risk Management Framework and its Generative AI Profile are free and give you a structure for reviews. The FTC’s business guidance explains its rules on AI claims, and HHS publishes HIPAA guidance for business associates. SCORE mentors and Small Business Development Centers can help with pricing and contracts at no cost.
Checked in November 2026: Colorado SB 26-189 from law-firm summaries (the signing date of May 14, 2026 is from the Colorado legislature’s bill page; the duties were read in law-firm summaries), the Bluevine and Goldman Sachs survey figures, and the hiring and HIPAA rules as long-standing. Re-check Colorado’s Attorney General rules before January 2027 and each vendor’s data terms before every review.