Yes, you need an AI policy, and for a business of 10 to 250 people it can fit on one page. Your staff are very likely using AI at work already, policy or not. Microsoft's UK research (2,003 employees, published 13 October 2025) found 71% have used unapproved consumer AI tools at work, 51% do so every week, and 28% say their company doesn't provide a work-approved option. So the policy's job is to give people a safe, approved route, not to ban anything: which tools to use, what must never go into them, who checks what comes out, and who to ask. The template below has ten sections, each with wording a small business can adopt as it stands.
Why does a small business need an AI policy at all?
Because the use is already happening, and the risk sits in the gap between what people are doing and what the business has said. The same Microsoft research found only 32% of those employees were concerned about the privacy of company or customer data they put into consumer AI tools (Microsoft UK Stories, 13 October 2025, figures as of September 2026). Nobody's being reckless on purpose. They've found something that saves them an hour, and nobody told them where the lines are.
Business owners are asking the right questions. The Federation of Small Businesses surveyed 904 small business owners and published in June 2026: 55% now use AI (up from 20% in 2023), and 92% have some concern about AI risk, up from 73% in 2023. The biggest single worry, at 54%, is AI producing inaccurate responses (FSB press release, June 2026, as of September 2026).
A one-page policy answers both. It tells staff which tools are safe, and it puts a named person between an AI draft and anything that leaves the building. That's most of the risk dealt with, and people keep the time they're saving.
What goes in a one-page AI policy? The template
Ten sections. Each has a line of example wording you can copy, edit and put your company name on. Keep the whole thing to one side of A4 if you can; a policy nobody reads protects nobody.
| Section | What it says | Example wording you could adopt |
|---|---|---|
| 1. Purpose and scope | Why the policy exists and who it covers | "We want everyone to use AI tools to save time and do better work. This page covers every employee, contractor and temp who uses AI for [Company] work, on any device." |
| 2. Approved tools | The named tools, on business plans, signed in with work accounts | "Use [Microsoft 365 Copilot Chat, signed in with your work account] and [ChatGPT Business, company workspace]. Don't use personal or free accounts for company work." |
| 3. What never goes in | The hard list, short enough to remember | "Never put these into any AI tool, approved or not: client or customer personal data, payroll and HR records, passwords and access keys, unreleased financial results, anything covered by an NDA or client contract." |
| 4. What's fine | The everyday uses you want to encourage | "Go ahead with: drafting and tidying emails, summarising public documents, first drafts of proposals and reports, brainstorming, explaining a formula or a spreadsheet, meeting notes from approved tools." |
| 5. Checking the output | A named human checks anything that leaves the building or informs a decision | "AI gets things wrong and sounds sure when it does. Anything that goes to a client, supplier, regulator or the board, or that a decision rests on, is checked by the person sending it. Figures are checked against the source, every time." |
| 6. Client and customer data (UK GDPR) | Personal data follows your existing data protection rules | "Our data protection policy applies to AI tools like any other system. If a task needs personal data, ask [Data Owner] first. We don't use AI to make decisions about individuals without a person reviewing them." |
| 7. Saying when AI helped | When you disclose AI use, internally and to clients | "If AI wrote a substantial part of something a client will rely on, say so if they ask, and tell your manager. Never present AI output as independently checked research unless you checked it." |
| 8. Who approves new tools | One route for adding a tool, so nobody goes around it | "Want to use a new AI tool or plug-in? Ask [Name / IT]. We check where the data goes and whether it trains on our data, and reply within five working days." |
| 9. Training | What everyone gets, and when | "Everyone joins a 30-minute session when this policy launches, and new starters cover it in their first week." |
| 10. Review and owner | Who owns the page and when it's next read | "Owner: [Name, role]. Reviewed every six months, or sooner if we add a tool. Next review: [date]. Questions go to the owner." |
Source: a structured template, not survey data. Adapt the names in brackets; the sections are the part to keep.
A few notes on the sections that get argued about most.
Approved tools. Name them. "Use approved tools" with no list sends people straight back to their personal accounts. The point of a business plan is what the vendor promises about your data. Microsoft says Copilot Chat gives enterprise data protection at no extra cost when you sign in with a work account, and that prompts and responses aren't used to train its foundation models (Microsoft Learn, as of September 2026). OpenAI says it doesn't train on ChatGPT Business data by default (OpenAI business data page, as of September 2026). Other assistants' business tiers make their own commitments and are reasonable choices too. Pick the one that fits the systems you already run, after reading its data page.
What never goes in. Keep it to five or six items people can recite; a two-page list of data classifications gets skimmed. The five in the template cover the things that would really hurt: other people's personal data, your people's pay, your passwords, numbers the market or the bank haven't seen yet, and anything you've contractually promised to keep private.
Checking the output. This is the section that answers the FSB's 54%. AI tools are very good at producing something that reads well, and reading well isn't the same as being right. The rule isn't "don't trust AI"; it's that the person who sends something owns it, however it was drafted. For numbers, the check is against the source system, not against another AI answer.
What does UK law and guidance say about AI at work?
There's no single UK law that says a business must have an AI policy. What applies is the law you already follow, mainly UK GDPR and the Data Protection Act 2018 wherever personal data is involved. If staff put a customer's details into an AI tool, that's processing personal data, with the same duties as any other system.
The Information Commissioner's Office publishes guidance on AI and data protection covering accountability, transparency, lawfulness, accuracy, fairness, security and individual rights. As of September 2026 the ICO says that guidance is under review following the Data (Use and Access) Act and may change, and it's working on a statutory code of practice on AI and automated decision-making. It's the right place to check what "using personal data fairly" means in practice.
On the government side, the Department for Science, Innovation and Technology consulted on a self-assessment tool called AI Management Essentials. In its response of 6 February 2026 it said it won't publish that tool and will instead write simpler governance guidance aimed at SMEs (GOV.UK, AI Management Essentials government response). Worth watching for.
None of this is legal advice, and I'm not a lawyer. If you handle regulated data (health records, financial advice, anything under FCA or SRA rules, children's data), have the finished page checked by your solicitor or compliance adviser before you publish it.
How do we roll it out without it becoming a project?
A fortnight is enough for most businesses of this size.
Days 1 to 3: agree the approved tools. Ask people what they already use (they'll tell you if the question isn't a trap), check what your existing licences cover, and pick one or two.
Days 4 to 7: fill in the template and publish it. Put names in the brackets, get the MD to sign it off, and put it where people actually look: the intranet, the Teams channel, the staff handbook. One page, one link.
Days 8 to 10: a 30-minute team session. Walk through sections 2, 3 and 5, because those change behaviour. Show an AI answer that sounds right and isn't. Then take questions; they'll tell you what to add.
Three months later: review it. What did people ask for that wasn't approved? Which rules got in the way? Update the page and reset the review date. The first version will be wrong somewhere, and that's fine as long as someone owns it.
Which company data should AI tools be allowed to read?
The policy is also the right moment to make a bigger decision: beyond what staff type in, which of your company's own systems should AI tools be allowed to read? This is where the useful answers about your own business come from. "What was gross margin by customer last quarter?" only gets a correct answer if the AI is reading your actual numbers, from a source where the definitions are agreed and the totals match the accounts.
If the plan is for Copilot or similar tools to answer questions about your numbers, it's worth checking whether your reporting data will give it correct answers before anyone relies on them. That's what my AI-Ready Power BI Assessment does, including Copilot capacity and licence cost modelling and recommendations on who should have access, and if you're not sure where you'd start, a free 20-minute intro call will tell you whether you need it at all. I've written more about the data side in What Makes Power BI AI-Ready.
What does a good AI policy look like in practice?
It's short and it has names on it. People can tell you, without looking, which tools they're allowed to use, the five things that never go in, and who checks anything that goes out. AI is useful for a small business: it takes the first draft off people's plates and gives them time back for the work that needs a person. The policy is what lets them use it properly, instead of quietly on personal accounts.
Common questions
Does a small business legally need an AI policy?
There's no UK law that requires a stand-alone AI policy. But UK GDPR applies whenever staff put personal data into an AI tool, and a written policy is the simplest way to show you've set rules for that. For a business of 10 to 250 people, one page is enough.
What should an AI acceptable use policy include?
Ten sections cover it: purpose and scope, approved tools, what never goes in, what's fine, checking the output, client data and UK GDPR, disclosure, who approves new tools, training, and a review date with a named owner. The template in this post has example wording for each.
Should we ban ChatGPT at work?
Banning tends to push use onto personal accounts where you can't see it. Microsoft's UK research (13 October 2025) found 71% of employees had already used unapproved AI tools at work. It's usually safer to approve a business version, set clear rules on what never goes in, and make the approved route the easiest one.
What data should staff never put into an AI tool?
Client or customer personal data, payroll and HR records, passwords and access keys, unreleased financial results, and anything covered by an NDA or client contract. Keep the list short enough that people can remember it without looking it up.
Who should own the AI policy in a small business?
One named person, usually the MD, the finance director or whoever already owns data protection. They approve new tools, answer questions and review the page every six months. A policy with no owner stops being true within a year.
How often should an AI policy be reviewed?
Review it three months after launch, then every six months, or sooner whenever you add a tool. AI tools change quickly, and the first version will have gaps that only show up once people start using it.
Where can I find official UK guidance on AI and data protection?
The ICO's guidance on AI and data protection is the main reference; as of September 2026 the ICO says it's under review following the Data (Use and Access) Act. DSIT said in February 2026 it's preparing simpler AI governance guidance for SMEs. If you handle regulated data, have your policy checked by a solicitor or compliance adviser.