An AI policy can be a single clear page. Its job: tell your team what they can and can't do with AI, so everyone's protected. Here's what to include, with an example to adapt.
An AI policy sounds like a big corporate document, but for a small business it can be a single clear page. Its job is simple: tell your team what they can and can't do with AI, so everyone's protected. Here's what to include, with a plain example you can adapt — no legal jargon, no bloat.
Why your small business needs an AI policy
Without clear rules, staff make their own judgements about AI — and that's how confidential data ends up in the wrong tool. A short policy removes the guesswork, protects your business under UK GDPR, and gives staff the confidence to use AI well. It doesn't need to be long to be effective.
What to include in a small business AI policy
1. What AI can be used for
Be positive and specific — drafting emails, summarising documents, writing marketing content, and so on. Staff should know AI is encouraged for the right tasks.
2. What must never go into AI
The critical rule: no confidential, personal, or client data in consumer AI tools. Spell out examples so it's unambiguous.
3. Which tools are approved
Name the specific tool(s) your business has approved, so staff aren't left choosing for themselves. See how to check if a business AI tool is safe.
4. The human-check rule
AI output must always be reviewed by a person before it's used or sent. AI drafts; humans decide.
5. Who to ask
Name a person to go to with questions. This alone prevents most mistakes.
A simple AI policy example
Example wording you can adapt: "We encourage the use of [approved tool] for drafting, summarising, and content tasks. Never enter client names, personal data, financial details, or confidential information into any AI tool. Always check AI-generated output before using it. Free consumer AI tools must not be used for any work involving customer or business data. Questions? Speak to [name]."
That's genuinely enough for many small businesses to start. You can expand it as your AI use grows.
From example to your policy
An example is a starting point — your policy should reflect your actual tools, your data, and how your team works. Our guide to a simple AI safety policy for office employees goes deeper on the safe-use side, and the NCSC's small business guidance is a sound reference.
Want an AI policy tailored to your business?
AskColin drafts a clear, simple AI policy built around your business, your tools and your team — ready to use. Start with a free consultation.
Request a free consultationFrequently asked questions
What should a small business AI policy include?
A good small business AI policy covers five things: what AI can be used for, what must never go into AI (confidential, personal, or client data), which tools are approved, the rule that humans must check all AI output, and who to ask with questions. For many small businesses this fits on a single page.
Does a small business really need an AI policy?
Yes — without clear rules, staff make their own judgements about AI, which is how confidential data ends up in the wrong tool. A short policy removes the guesswork, helps protect your business under UK GDPR, and gives staff confidence to use AI well.
Can I use an AI policy template or example?
An example is a useful starting point, but your policy should reflect your actual approved tools, the specific data your business handles, and how your team works. Adapt the wording rather than adopting a generic template wholesale.