68% of small businesses use AI daily, but 77% have no written policy. Here’s how to build one before it becomes a security or compliance problem.