Most small teams now have AI tools. Far fewer have a written AI working agreement that says what those tools may touch, who owns the rules, and what never gets pasted into a prompt. The gap shows up as leaked client files, invented citations in a proposal, and a model that still writes in last quarter’s voice because nobody updated the brief.
The productivity story is real. McKinsey’s State of AI 2026 survey, fielded in May and June 2026 among 1,719 respondents, finds that 80 per cent of respondents say AI has improved their individual productivity. The firm-level story is slower. Only 37 per cent attribute at least some EBIT impact to AI use, unchanged from the year before. A one-page agreement will not close that gap by itself. It is the cheapest way to stop the tools from making the gap worse.
That split is the operating problem for a five to fifty person firm. Large organisations reporting over $1 billion in revenue moved from 27 per cent scaling agents last year to 40 per cent this year. Smaller organisations stayed flat at 22 per cent. Gartner’s C-suite AI survey, published 1 September 2026, finds that only 22 per cent of organisations have successfully scaled AI across multiple business units, and that roughly 11 per cent are entirely unaware of what their function spent on AI in 2025. You do not need a transformation office to write the rules. You need a named owner and a page the whole team can find.
What belongs in an AI working agreement
NIST’s AI Risk Management Framework is voluntary. It is also the cleanest public map of the job. The four functions are Govern, Map, Measure, and Manage. A small team does not implement the whole playbook. It does need those four verbs on one page.
NIST’s July 2024 Generative AI Profile names twelve risks that generative systems make worse. Three of them show up in ordinary office work every week: confabulation, which is the production of false or misleading content; data privacy; and human-AI configuration, including over-reliance. Intellectual property is the fourth that a client-facing firm cannot ignore. Your agreement is not a legal opinion. It is a list of what the tools may draft, what a human must check, and which files never leave the systems you already treat as confidential.
Keep the page short enough that a new contractor can read it on day one. Four blocks are enough.
- Allowed work. Drafting emails, first-pass research summaries, meeting notes, code comments, and internal checklists. Name the tools you actually pay for. Do not list every chatbot on the internet.
- Human check. Anything that leaves the firm, invoices, contracts, client advice, published copy, and numbers that will be repeated, needs a named reviewer. The reviewer is a person, not “the team”.
- Never paste. Payroll files, passport scans, bank exports, unreleased financials, client data covered by an NDA, and passwords. If it would be a problem on a lost USB stick, it does not go into a public model.
- Voice and facts. House spelling, the claims you will not make, and the rule that a citation must be a URL the writer opened. Invented sources are a confabulation problem, not a style problem.
This is the same discipline as moving agentic AI from pilot to production, written for a team that will never have a dedicated AI programme. Scope, data rights, and an approval step have to be named before the first live file, not after a leak.
Who owns it, and where it lives
McKinsey’s 2026 high performers, the 6 per cent of respondents who attribute at least 5 per cent of EBIT to AI and call the impact significant, are twice as likely as others to say senior leaders demonstrate commitment and to report defined processes to measure the impact of those initiatives. In a small firm the “senior leader” is often the founder. The owner of the agreement can still be someone else, the operations lead, the office manager, or the person who already runs access to the shared drive.
Write the owner’s name on the page. Put the page where the tools already live, a shared folder, the internal wiki, or the onboarding pack. Do not bury it in a slide deck from a workshop. If a contractor cannot find it without asking you, it is not the working agreement. It is a memory.
Access control is part of ownership. If three people share one login to a public chatbot, you cannot tell who pasted the payroll file. One seat per person, with the company email, is the minimum. That is also how you revoke access when someone leaves. Digital transformation for SMEs starts from the workflow that already exists. The workflow here is “someone opened a chatbot and pasted a file”. Name that someone.
What never goes in, including your own methods
The never-paste list is not only personal data. It is also the firm’s unpublished numbers, unannounced hires, and any method you would not put on the public website. Customer-facing copy should explain what you do and why, not the internal how. The same rule applies inside the prompt. If a contractor would need an NDA to see it, the model does not see it either, unless you are on a private deployment with a contract that says so in writing.
NIST flags information security risks that include prompt injection and data leaving the system. You do not need to become a security engineer. You do need a rule that browser extensions, “helpful” plugins, and mystery connectors are off until the owner has said yes. Connecting an assistant to mail, chat, and the CRM is a later article. The working agreement comes first, because a connected tool without rules is a faster leak.
Stanford HAI’s 2026 AI Index notes that the most capable models are often the least transparent. The Foundation Model Transparency Index average dropped to 40 points from 58 the year before. Vendor opacity is a reason to write your own rules, not a reason to skip them. You cannot outsource judgement to a model card you cannot read.
How you notice the tools have drifted
Drift is quiet. A new model version starts hedging. A staff member switches to a cheaper tool that stores chats. A freelancer pastes a client deck into a personal account. None of that appears in a dashboard.
Run a thirty-minute check once a month. The owner asks four questions. Which tools are we actually using? Does the never-paste list still match the files on the shared drive? Who reviewed the last five pieces of external copy? Did anyone grant a new plugin access? Write the answers on the same page, with a date. That is Measure and Manage in NIST’s language, without a GRC platform.
Gartner finds that high performers, those who constantly track ROI, treat AI as a portfolio, and discontinue underperforming work, reported positive returns in 81 per cent of their AI initiatives. Low performers did not know the return for 29 per cent of AI initiatives. A small team will not run a portfolio committee. It can still kill a tool that nobody can explain, and it can refuse to count “we used AI” as a result. Scaling AI agents beyond pilots fails for the same reason a working agreement fails. Nobody named the work, the data, or the reviewer.
McKinsey also records that about 20 per cent of respondents say AI-related operating costs, including token costs, constrained their AI use. Cost drift is a cousin of rule drift. If the bill jumped, someone is sending more into the model, or sending files that should have stayed local. The monthly check should include the invoice.
What to do this week
Open a blank page. Write the four blocks: allowed work, human check, never-paste, voice and facts. Put one person’s name at the top. Share it in the same place you share the wifi password. Then pick last week’s outbound emails and proposals, and mark which ones a model drafted. If you cannot tell, that is the first finding. The agreement exists to make that visible.
An AI working agreement is not a transformation programme. It is the house rule for tools the team already uses. McKinsey’s 80 per cent individual-productivity figure will keep rising. The 37 per cent EBIT figure will not, unless the work, the data, and the reviewer are named. Write the page. Date the check. Change the tools only when the page still matches the work.
Key takeaways
- McKinsey’s 2026 survey shows 80 per cent reporting personal productivity gains from AI, and only 37 per cent attributing EBIT impact. A written agreement will not create return. It stops unmanaged use from destroying it.
- Smaller organisations stayed flat at 22 per cent scaling agents, while large firms reached 40 per cent. The working agreement is how a small team catches up on control, not on headcount.
- NIST’s AI RMF gives four verbs, Govern, Map, Measure, Manage. Put them on one page as owner, allowed work, never-paste, review, and a monthly drift check.
- The Generative AI Profile’s office-relevant risks are confabulation, privacy, over-reliance, and intellectual property. Treat invented citations as a control failure.
- Vendor transparency scores have fallen. Write your own rules. Do not wait for a model card to tell you what your staff may paste.
FAQ
What is an AI working agreement?
A one-page set of house rules for the AI tools a team already uses. It names the owner, the allowed work, the files that never get pasted, and the human review step for anything that leaves the firm.
Does a small team need NIST or ISO certification to write one?
No. NIST’s AI RMF is voluntary. Use the four functions as a checklist. Certification is a later, separate decision for firms that sell into regulated buyers.
Can staff use personal chatbot accounts for work?
Not if client files or unpublished numbers are in play. Company seats, with company email, are the minimum so you can revoke access when someone leaves.
How often should the agreement be updated?
Whenever a tool, a plugin, or a reviewer changes, and at least monthly. If the page is older than the last model version you switched to, it is already stale.
Is this the same as an AI policy for customers?
No. A customer-facing AI policy explains what you do with their data. The working agreement is internal. It tells staff how to use the tools without creating that customer problem.
Sources
- McKinsey, “The state of AI in 2026: On the road to ROI”, 25 August 2026. mckinsey.com/…/the-state-of-ai
- Gartner, “Gartner Survey Finds Only 22% of Organizations Have Successfully Scaled AI Across Multiple Business Units”, 1 September 2026. gartner.com/…/successfully-scaled-ai-across-multiple-business-units
- NIST, “AI Risk Management Framework”, overview page, updated 2026. nist.gov/itl/ai-risk-management-framework
- NIST, “Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile” (NIST AI 600-1), 26 July 2024. nist.gov/…/generative-artificial-intelligence
- Stanford HAI, “Inside the AI Index: 12 Takeaways from the 2026 Report”, 13 April 2026. hai.stanford.edu/…/inside-the-ai-index-12-takeaways-from-the-2026-report
This article is general information, not investment advice. See section 4 of our Terms & Conditions.
This is the kind of decision we advise on. If you are weighing it for your own business, see how we work or start a conversation.
