Your team is almost certainly using AI tools already: drafting emails, summarising documents, writing code. Most small businesses have no rules for it, which means customer data and confidential documents may be going into tools nobody has checked.

A good AI policy doesn't ban anything. It makes it clear what's safe, so people can use AI with confidence.

This guide is general information, not legal advice. Checked October 2026.

Why you need one now

  • Data protection. UK GDPR applies whenever personal data goes into an AI tool. You need to know which tools are used, what data goes in, and whether the provider is a suitable processor.
  • Confidentiality. Client documents, pricing and contracts pasted into the wrong tool may be stored or used in ways you didn't agree to.
  • Accuracy. AI tools make confident mistakes. Someone has to check what goes out under your name.
  • EU customers and staff. If you use AI systems in the EU, the EU AI Act's AI literacy duty may apply: organisations must take steps so staff using AI understand it. That duty has applied since February 2025, with enforcement from August 2026.
  • Trust. Clients increasingly ask how you use AI. A short policy is an easy, credible answer.

What a good policy covers

Keep it to one page. People read one page.

  1. Approved tools. A short list of tools the business has checked, on business accounts, with training on your data switched off where the tool allows it.
  2. What can go in. Public information and your own non-confidential work, freely.
  3. What never goes in. Personal data about customers or staff, client confidential information, passwords, financial details and anything under an NDA, unless the tool is specifically approved for it.
  4. Human review. A person checks anything AI-assisted before it reaches a customer, a contract or a decision about someone.
  5. Decisions about people. AI must not make significant decisions about individuals (hiring, firing, credit, pricing for a person) without meaningful human involvement.
  6. Being open. When you tell customers or colleagues that AI was used.
  7. Copyright and ownership. Don't paste in others' copyrighted material to reproduce it, and check AI-generated content before publishing.
  8. Security. Business accounts only, multi-factor authentication on, no sharing logins.
  9. Training. Everyone gets a short induction on the policy and the tools; record that it happened.
  10. Problems. Who to tell if something goes wrong, for example personal data pasted into the wrong tool.
  11. Ownership and review. Who owns the policy, and when it's reviewed.

Template: AI use policy

Copy this, replace the bracketed parts and delete what doesn't apply.

[Company name] AI use policy

Purpose. We use AI tools to work faster and better. This policy keeps our clients, colleagues and business safe while we do.

Approved tools. Only use these, on company accounts: [tool 1], [tool 2], [tool 3]. Ask [owner] before using anything else.

Never put into any AI tool: personal data about customers or staff, client confidential information, passwords or access keys, financial or payment details, or anything covered by an NDA, unless [owner] has approved that tool for that data.

Always check. A person reviews anything AI-assisted before it goes to a client, is published, or is used in a decision. You are responsible for what you send.

Decisions about people. AI may help prepare information, but people make decisions about hiring, performance, credit or pricing for individuals.

Be open. Tell clients when AI has played a significant part in work we deliver to them, if they ask or if our contract requires it.

Security. Use company accounts with multi-factor authentication. Never share logins.

Problems. If something goes wrong, for example personal data pasted into the wrong tool, tell [owner] the same day. Speed matters more than blame.

Training. Everyone completes a short AI induction when they join and when the policy changes.

Owner and review. [Name, role] owns this policy. We review it every six months. Last reviewed: [date].

Rolling it out

  1. Find out what's already in use. Ask the team, anonymously if needed. You'll be surprised.
  2. Choose the approved tools. Check each one's data, retention and training settings, and sign the provider's data processing terms.
  3. Run a 30-minute session. Walk through the policy with real examples from your work.
  4. Record it. A simple log of who completed the induction, and when.
  5. Review every six months. Tools and rules change quickly.

Common mistakes

  • Banning AI outright. People use personal accounts instead, which is far riskier.
  • A ten-page policy. Nobody reads it. One page, with examples.
  • No approved list. "Use AI responsibly" means nothing without specific tools.
  • Forgetting free personal accounts. Make it clear that work happens on business accounts only.

Want help putting AI to work safely?

We help small teams choose the right AI tools, set sensible guardrails and automate the work that eats their week, with people in control of the decisions that matter. Book a call or join the ai nerds, our community with monthly hands-on workshops.