How to Write an AI Policy for a Small Business (With a Template)

If anyone in your business uses AI for work, you already have an AI policy. It is just unwritten, and every member of staff is making it up as they go. A short written policy fixes that without slowing anyone down.

AI use among small firms has risen fast. A 2026 British Chambers of Commerce survey found 54% of UK SMEs actively using AI, up from 35% a year earlier. Most of that use starts informally, with staff trying free tools on their own accounts. The policy's job is to keep the benefit and remove the avoidable risk.

What an AI policy is for

• Protect client and personal data, which UK GDPR still covers when it is typed into an AI tool.
• Keep confidential business information out of accounts the business does not control.
• Make sure a person checks AI output before it reaches a client, a regulator or a contract.
• Give staff confidence about what they are allowed to do, so useful adoption is not held back by uncertainty.

The sections every small business policy needs

1. Purpose and scope

One or two sentences on why the policy exists and who it applies to: employees, contractors and anyone else working with your data.

2. Approved tools

Name the tools staff may use, and the account type. "ChatGPT through the company Business account" is clear. "ChatGPT" is not, because a free personal account has different data terms and no admin controls. If you are still choosing, our comparison of Copilot, ChatGPT and Claude will help.

3. Information that must never be entered

Be specific. For most small businesses this list includes client personal data in unapproved tools, health or financial information, passwords and access keys, and anything covered by a confidentiality agreement.

4. Human review

State which outputs must be checked by a person before use. Anything sent to a client, published, used in a contract, or used to make a decision about a person should always be reviewed.

5. Transparency

Decide when you tell clients that AI was used. Many businesses choose to disclose AI use where it materially shapes advice or a deliverable.

6. Requesting a new tool

Give staff a simple route to suggest a tool. Without one, useful tools get adopted quietly instead, which is how shadow AI starts.

7. Ownership and review

Name the person responsible for the policy and set a review date. AI tools change quickly, so review at least every six months.

A template you can adapt

[Business name] AI usage policy

1. 1.Purpose. This policy explains how staff at [Business name] may use artificial intelligence tools at work. It applies to all employees and contractors.
2. 2.Approved tools. You may use the following tools through company accounts only: [tool and account type]. Do not use personal or free accounts for work.
3. 3.Prohibited information. Never enter the following into any AI tool unless it is listed as approved for that data: [client personal data, health information, financial account details, passwords, confidential contract terms].
4. 4.Checking output. AI can be wrong. You must check any AI-assisted work for accuracy before it is sent to a client, published, or used to make a decision about a person.
5. 5.Disclosure. Tell your manager, and the client where appropriate, when AI has materially shaped advice or a deliverable.
6. 6.New tools. Request new tools from [name or role]. Do not sign up to AI services for work without approval.
7. 7.Breaches. If you think restricted information has been entered into an AI tool, tell [name or role] the same day so it can be assessed.
8. 8.Review. [Name or role] owns this policy and will review it by [date].

Rolling the policy out

A policy nobody reads changes nothing. Walk the team through it in a short session, show examples of good and bad use from your own work, and make the approved tools easy to access. Pair the policy with training so staff know how to get useful results within the rules.