What to put in your company's AI policy.
If you haven't written down how your business uses AI, your staff have decided for you. A short, practical policy is the fastest way to make AI use safe, and it usually takes an afternoon, not a project.
In short: say which AI tools are approved, which kinds of data may go into them, who checks the output, and who to ask. Keep it to two pages, review it every six months, and set the tools up so the policy is easy to follow.
Why you need one now
Nearly half of UK small business owners now use AI tools, according to Simply Business, and the same research found security and privacy were the top worry, cited by 44%. In the IONOS and YouGov survey, half of UK small and medium-sized businesses feared data theft. Those fears are reasonable: the main risk isn't the technology, it's people pasting client data into free tools with no rules.
A policy doesn't slow people down. It tells them what's allowed, so they can use AI with confidence instead of quietly.
The nine things it should cover
- Approved tools. Name them, and say which plan or account to use. Business plans usually don't train on your data; free personal accounts often can.
- What data may go in. Use the table below. Be specific about client data and personal data.
- Code and intellectual property. For software teams: which repositories each tool may see, and whether proprietary code may leave your environment at all.
- Human review. Anything that goes to a client, a regulator or the public is checked by a named person first.
- Accuracy. AI can state wrong things confidently. Facts, figures and legal points get checked against a source.
- Disclosure. When you tell clients that AI was used, if your contracts or sector require it.
- Personal data. Your UK GDPR obligations still apply. The ICO's guidance on AI and data protection is the reference.
- Who to ask. One named person for questions and for approving new tools.
- Review date. Tools change monthly. Review the policy at least every six months.
A simple data table you can copy
| Type of data | Examples | Approved business AI tools | Free or personal AI tools |
|---|---|---|---|
| Public | Your website, published brochures, public reports | Yes | Yes |
| Internal | Process notes, internal emails, draft plans | Yes | No |
| Confidential | Client documents, pricing, contracts, source code | Only tools approved for it, with the right settings | No |
| Personal data | Customer and staff details, HR records | Only if approved after a data protection check | No |
A starting point to adapt, not legal advice. Check it against your contracts and your data protection obligations.
Make the policy easy to follow
A policy only works if the approved route is also the easy route. Before you publish it:
- Set up business accounts for the approved tools, so nobody needs a personal one.
- Check each tool's data retention and training settings, and switch off anything you don't need.
- For sensitive work, consider models that run inside your own cloud tenancy or on your own hardware.
- Give people a few ready-made prompts for their common tasks, so the approved tool is the quickest one.
- Spend thirty minutes walking the team through it, with examples from their own work.
What a policy won't do
It won't tell you where AI could actually help the business. It keeps today's informal use safe while you work that out. A draft policy is one of the outputs of the AI Direction Review, alongside a ranked plan of where AI pays.
Related
Where to go from here
Talk to Dom
Want help setting AI rules that people follow?
Tell me what's prompting the question. I'll reply within one working day to arrange a short first call.