What should a UK small business AI policy cover?

Why a small business needs one

If anyone in your team uses an AI assistant for work, you already have an AI policy. It is just unwritten, and every person has their own version. One pastes client emails in to draft replies. Another won't touch it because they assume it is banned. A third uses a free personal account on their phone for everything. None of them is being reckless; nobody told them the rules.

A written policy fixes that. It protects client and personal data, gives cautious staff permission to use tools that are already paid for, and gives you a straight answer when a client asks how you use AI with their information. That question is turning up more often in tenders and supplier questionnaires.

It does not need to be long. A policy nobody reads protects nobody. Aim for something a new starter can understand in ten minutes, backed by a single page summary they can keep to hand.

What UK GDPR and the ICO expect

There is no separate AI law for UK small businesses to follow. UK GDPR and the Data Protection Act 2018 already apply whenever personal data goes into an AI tool, and the ICO publishes guidance on AI and data protection. That guidance is under review following the Data (Use and Access) Act 2025, so check the ICO's site for the current version rather than relying on an old summary.

In practice, your policy should cover the basics in plain English. You need a lawful basis for any personal data you put into an AI tool. You need a data processing agreement with the provider, which on business plans is usually part of the standard terms. You should know where the data is processed and whether that means a transfer outside the UK. And you should do a data protection impact assessment before using AI on anything likely to be high risk, such as health information or decisions about staff.

Decisions about people deserve their own line. The Data (Use and Access) Act relaxed some of the old restrictions on solely automated decisions, but people still need to be told, to be able to challenge the outcome and to get meaningful human review. The ICO consulted on updated guidance on automated decision making in 2026. For a small business, the simple rule is that AI can help prepare a decision about a customer, applicant or employee, but a person makes it.

Finally, say what happens if something goes wrong. If personal data ends up somewhere it shouldn't, that may be a personal data breach, and reportable breaches must go to the ICO within 72 hours of you becoming aware of them. Staff need to know who to tell, straight away.

What staff can and can't paste in

This is the section people will actually use, so make it a table with three columns: allowed, ask first, and never.

Allowed covers anything you would happily publish or that contains nothing sensitive: public web copy, your own marketing drafts, general research questions, anonymised examples and internal process notes. Ask first covers client documents, commercial terms, unpublished financial figures and anything with names and contact details in it. Never covers passwords and API keys, bank and card details, special category data such as health or ethnicity, information about children, and anything a client contract says must not leave your systems.

Two habits do most of the work here. Remove names and identifying details before pasting, because the task rarely needs them. And use work accounts only, never a personal login, so data stays under terms the business has agreed and can be deleted when someone leaves.

Approved tools, review and ownership

List the tools staff may use, the account type for each and any settings that must be on or off. Many businesses already pay for AI features inside their email, documents, CRM and design software, so start there before adding anything new. For each tool, check whether your inputs are used to train the provider's models and whether business plans let you turn that off. Then add a short checklist for approving a new tool, so the list doesn't quietly grow through free trials.

Human review is the rule that prevents most real problems. AI output can be fluent and wrong: invented figures, confident errors, out of date facts. Your policy should say that a named person checks every output before it reaches a customer, a client, a regulator or the public, and that some work, such as legal wording, prices and anything published under the company name, needs a second check.

Ownership needs a short paragraph too. Say that work produced with AI tools for the business belongs to the business, that staff must not paste in material they have no right to use, and that client contracts come first if they restrict AI use. UK copyright law on purely AI generated work is unsettled: the government's March 2026 report on copyright and AI kept the current law in place but signalled it may remove the special protection for computer generated works. So the safe position is that human creative input matters, and anything important should be edited, not just generated.

Getting people to follow it

Name an owner. Someone has to update the approved tools list, answer ask first questions and review the policy at least once a year, or sooner when you adopt a new tool or the ICO updates its guidance.

Ask everyone to read the summary and sign an acknowledgement, including freelancers who handle your data. Then show them the policy in use, with real examples from their own work. Rules that are explained alongside the tasks they apply to get followed. Rules sent round as an attachment get filed.

There is a free AI usage policy template on this site, written for UK small businesses, which you can adapt in an hour or two; have a solicitor or data protection specialist check it if you handle sensitive data. If you would rather have one tailored to your tools and data, we write it as part of our AI consulting and walk your team through it in training.