AI policy template for UK small businesses: one page, plain English

I'm Managing Partner of a two-office law firm in East Sussex with around 30 people. Confidentiality comes first there, so the first question about any new tool is where the information goes, and who else can see it.

Do I need an AI policy for a small business?

If anyone on your team uses AI for work, yes, a short one. UK GDPR applies whenever personal data goes into an AI tool, and the ICO lists data protection policies, where proportionate, as one way to show you comply. Acas recommends clear rules on AI at work. One page everyone has read beats a long document nobody opens.

Your staff are probably ahead of you. The ONS found that over half of employees (55%) say they use AI for work or education. Only around a third of businesses with 10 or more staff (35%) report using it. That gap is people using their own accounts, with their own habits, and nobody checking.

The government's Cyber security breaches survey 2025/26 tells a similar story. Of businesses using or considering AI, around a quarter (24%) had practices in place to manage the cyber risks from it. A short, agreed policy is a sensible first step towards being in that quarter.

Even the regulator writes one. The ICO's own internal AI use policy runs to 30 pages, but the rules for staff sit in one short section. Most of the rest covers buying, building and explaining AI systems, which a small business rarely needs.

What should an AI acceptable use policy include?

Eight things: why the policy exists, which tools and accounts are approved, what information can and can't go in, checking every output, being open with customers, who to ask, how to report mistakes, and when you'll review it. Everything else, such as training plans and supplier checks, can come later.

Your one-page AI usage policy template

Copy this into a document, replace the parts in square brackets, and delete anything that doesn't fit. It's written for a business of roughly 3 to 30 people, and it's general information to start from, not legal or HR advice.

Section 4 matters most. The NCSC warns that AI tools can get things wrong and present them as fact, a flaw known as hallucination. Acas makes the same point: check outputs for accuracy, tone and bias.

Which AI tools and accounts should staff use?

Business accounts, signed in with work logins, on tools you've chosen. Microsoft, OpenAI and Anthropic each say they don't use data from their business products to train their models by default. You can't see or control a member of staff's personal account. Pick one or two tools and ask everyone to use only those for work.

Microsoft's data and privacy page for Copilot says prompts and responses in its business Copilot aren't used to train its foundation models. It also says Copilot only shows people information they already have permission to see. So if your shared drive lets everyone open the payroll folder, Copilot can surface it too. Tidy up permissions before you switch it on.

OpenAI says the same about its business plans for ChatGPT, and Anthropic about its commercial Claude products. Check the vendor's own data page for the plan you're on, because names and settings change. Microsoft 365 Copilot, for example, is now called Microsoft Copilot.

Choosing between the two most common options? My guide to Copilot vs ChatGPT for a small business compares them side by side.

What information can staff put into AI tools?

Public information and your own non-confidential drafts are fine in any approved tool. Customer and staff personal details should only go into an approved business tool, for agreed tasks. Bank details, passwords, health information and anything shared in confidence shouldn't go into AI tools at all. The table below makes it quick to check.

Health data is one of the special categories of personal data that UK GDPR gives extra protection. Anything like that needs proper advice before it goes near a new tool. For the wider question, see my guide: is ChatGPT safe for business use?

How do you introduce an AI policy to your team?

Talk first, write second. Ask the team which AI tools they already use and what for, with no blame for honest answers. Then fill in the template, agree it at a short team meeting, and ask everyone to sign it. Acas recommends consulting staff when you bring in AI, and involving them in shaping the rules.

1. Ask, don't accuse. A 10-minute chat or a quick anonymous form: which tools, which tasks, which accounts. The NCSC's advice on shadow AI is to understand why people use unapproved tools, because that tells you what they need.
2. Choose the tools. One is often enough: whichever fits the software you already pay for.
3. Fill in the template. Name a policy owner and set a review date.
4. Agree it together. Half an hour with the team, walking through the traffic-light table with real examples from your business.
5. Show people how. A rule without training quickly becomes a rule people work around.

If breaking the policy could lead to disciplinary action, it has to fit with your staff handbook and disciplinary rules. The Acas Code of Practice says disciplinary rules and procedures should be written down, specific and clear, with staff involved in developing them. How your AI policy links to discipline is a question for your HR adviser or an employment lawyer, not a template.

What if someone puts customer data into ChatGPT by mistake?

Deal with it quickly and calmly. Find out what went in, which tool and which account, and delete the chat if you can. If it included personal data, it may be a personal data breach. Notifiable breaches must be reported to the ICO within 72 hours of you becoming aware, so don't wait.

The ICO has a self-assessment tool to help you decide whether a data breach needs reporting. Whatever you decide, the ICO says to record every breach, including those you don't report. If the risk to the people affected is high, you must tell them directly too.

How you react matters as much as the rules. The NCSC warns that staff who are afraid for their jobs won't report mistakes. The whole point of the policy is that problems surface on the same day, while they're still small.

Common pitfalls

• Copying a big company's policy. A 20-page document doesn't get read in a team of eight. Keep yours to a page.
• Banning AI outright. The NCSC says staff turn to unapproved tools when policies and approved options haven't kept pace. A ban with no approved alternative risks exactly that.
• Forgetting the hidden extras. AI now sits inside browsers, email and video calls. Your approved list should cover add-ons and meeting note-takers too.
• No named owner. If nobody owns the policy, nobody updates it or answers questions.
• Writing it once. The ICO says accountability is ongoing, and measures should be reviewed and updated. Tools and settings change often.

What to do next

1. Today. Copy the template and fill in the square brackets.
2. This week. Ask your team which AI tools they use, with no blame for honest answers.
3. Before the team meeting. Choose your approved tools and read their data settings on the vendor's own pages.
4. At the meeting. Walk through the traffic-light table with real examples and ask everyone to sign.
5. In 6 months. Review it, and add what you've learned.

How I can help

I run hands-on AI training for small teams, and agreeing a one-page policy like this is part of it. We use your own emails and documents, so people see what the rules mean in real work. Not sure which tools your team already relies on? The AI audit maps that first.

Questions people ask

Is an AI policy a legal requirement in the UK?

Official guidance doesn't say every business must have a document called an AI policy. But UK GDPR still applies the moment staff put personal data into an AI tool, and the ICO counts a proportionate data protection policy as one way to show you comply. Add Acas's advice to set clear rules on AI at work, and a one-page policy covers both.

Can I just ban ChatGPT at work?

You can, but a ban doesn't remove the need. The NCSC's blog on shadow AI cites research finding that 71% of employees had used AI tools their employer hadn't approved. One approved tool with clear rules gives people a safe way to do what they're already trying to do.

Should the AI policy be part of our employment contracts?

Not necessarily. The Acas Code says disciplinary rules should be written down, specific and clear, and that staff should know where to find them. Whether your AI policy should be contractual, and how it links to your disciplinary rules, is a question for your HR adviser or an employment lawyer.

How often should we review our AI policy?

Every 6 months suits most small businesses, and straight away if you add a tool or something goes wrong. The ICO says accountability measures need reviewing and updating over time. Its own internal AI policy was set for review a year after it came into use.

Do we have to tell customers we use AI?

Not every time. The ASA says there's no blanket legal requirement in the UK to disclose AI in ads, but nothing you publish can mislead. Your privacy notice must explain how you use personal data, including who receives it. And if a customer is chatting to an AI tool rather than a person, tell them.

Does this template work for Copilot, ChatGPT and Claude?

Yes. It doesn't depend on any one tool. List whichever tools you approve in section 2, then check each vendor's own data and privacy pages for the plan you're on.

Related guides