AI governance
How Do I Write an AI Policy for My Team?
A plain-English policy template for small businesses. What to include, what to ban, and how to roll it out.
Book a discovery callWhat this guide covers
A complete AI use policy for a small business fits on one page. It needs to be specific enough that people know what they can and can't do, and short enough that they'll actually read it. This guide walks through the five sections every policy needs, the specific prohibitions that matter most, how to roll it out without resistance, and a copy-paste template you can adapt in 30 minutes.
Most AI policy guides are written for legal teams in large enterprises. This one is written for a business owner who uses AI themselves and wants to give their team of 2-20 people clear, practical guidance - not a 40-page governance document that nobody will read.
The goal of the policy is simple: make it clear what's allowed, prevent the specific misuses that create real risk, and give everyone a consistent position when clients ask about AI. Nothing more complicated than that.
What to include
Five sections every policy needs
Each section has a different job. The purpose and scope section creates context. The approved tools list creates accountability. The data rules create the most important protection. The output review standard addresses professional liability. The disclosure position ensures consistency with clients.
Purpose and scope
Sets context so people understand why the policy exists - not as a control mechanism but as a way to protect the business and its clients.
Example wording
This policy applies to all team members and contractors of [Business Name] when using AI tools in connection with their work. It is reviewed quarterly.
Approved tools
Prevents people from using AI tools with inadequate data handling without realising it. Also sets a baseline for what the business has assessed and approved.
Example wording
Approved tools: ChatGPT Team (writing, research, drafting), Claude Pro (analysis, long-form writing). Tools not on this list require approval from [role] before use on client work.
Data rules
The most important section for client protection and regulatory compliance. Generic 'be careful' language doesn't work - people need specific, concrete rules.
Example wording
Do not input: personal data of any individual, NDA-covered material, internal financial data, client financial statements, or any material you would not be comfortable appearing in a data breach.
Output review standard
AI output must be reviewed before it is used, particularly in client-facing work. This section defines what 'reviewed' means in practice.
Example wording
AI-assisted content in client deliverables must be reviewed by the responsible team member before submission. Factual claims and statistics must be verified against source material.
Client disclosure position
Gives the whole team a consistent answer to 'did you use AI on this?' and prevents inconsistency across different client relationships.
Example wording
Our position: we use AI tools as part of our standard process. All work is reviewed and approved by a qualified team member. If a client asks directly, answer honestly and specifically. Client contract AI clauses take precedence over this policy.
What to ban
Seven specific prohibitions
"Use AI responsibly" is not a useful policy. These are the seven prohibitions that actually protect your business and clients - each with a plain explanation of the risk it addresses.
Inputting personal data of clients, staff, or third parties into public AI tools
UK GDPR requires a lawful basis for processing personal data. Uploading someone's name, email, health information, or financial details to a third-party AI tool without their knowledge almost certainly doesn't have one.
Using AI output in client deliverables without human review
AI produces plausible but sometimes incorrect content. Publishing AI output without review creates a professional liability risk - and damages trust significantly if a client catches an error you didn't.
Using AI tools not on the approved list for client work
Unapproved tools may have inadequate data handling for your sector. You can't manage a risk you don't know about.
Claiming AI-generated content is human-written when directly and sincerely asked
This is a misrepresentation risk. There's a meaningful difference between not volunteering information and actively lying when asked. The second creates genuine legal and reputational exposure.
Using AI to make autonomous decisions affecting individuals without human review
Decisions about hiring, credit, performance, or similar matters that significantly affect a person require human oversight under UK GDPR's Article 22.
Using AI on any engagement where the client contract restricts AI use
Breaching a contract clause, however small the breach seems, creates liability and relationship risk that significantly outweighs any efficiency gain.
Inputting legally privileged or NDA-covered material without legal advice
Uploading privileged communications to a third-party platform may waive privilege. NDA terms vary - check before inputting.
Rollout in 5 steps
How to roll out without scaring your team
The most common rollout mistake: emailing the policy document with no context. People read "AI policy" and immediately think either "they're tracking what I'm doing" or "they're replacing me". Neither is helpful. These steps change that framing before it takes hold.
Share a draft before it's final
Send the draft to your team and ask two questions: 'Is anything here unclear?' and 'Is there anything you think we've missed?' This is not a consultation exercise - you're the decision-maker. But people who helped shape the document are more likely to follow it.
Even if you don't change a word based on feedback, the act of asking changes how the policy is received.
Run a 30-minute session explaining why
Don't just send the document. Run a short session where you explain the three or four reasons the policy exists: protecting client data, managing professional liability, maintaining consistent standards, and meeting client expectations. People follow rules they understand - not ones handed down without context.
Address the job security question directly even if nobody asks it. 'This is about how we use AI, not whether we use it, and it's definitely not about replacing anyone.'
Publish it somewhere permanent and findable
Not email. Put it in your shared drive, Notion, or intranet - wherever your team looks for reference documents. Link to it from your onboarding checklist. If people can't find it when they need it, it doesn't exist.
Set a quarterly review reminder
Add a recurring calendar event for a 20-minute policy review every three months. AI tools change faster than annual reviews can keep up with. The review should check: are the approved tools still current? Has anything changed in our clients' requirements? Are the data rules still appropriate?
Lead by example
Talk openly about how you use AI in your own work. What you use it for. Where you don't trust it. Where it's saved you time. Normalising visible, thoughtful AI use is more effective at building a good AI culture than any policy document.
Free template
Copy-paste AI policy template
Fill in the bracketed sections with your specifics. The whole document should fit on one or two pages. Don't add length for the sake of it - a short, specific policy that people read is more effective than a comprehensive one that nobody opens.
AI Use Policy - Small Business Template
Copy, paste into a Google Doc or Word file, fill in the brackets, and share with your team
AI USE POLICY [Business Name] Version [1.0] | Last reviewed: [Month Year] | Owner: [Role] ──────────────────────────────────────────── 1. PURPOSE AND SCOPE This policy sets out how team members and contractors of [Business Name] may use AI tools in connection with their work. It applies to all AI-assisted activities including writing, research, analysis, design, and coding. The purpose of this policy is to protect our clients, our business, and the people who work with us - not to restrict the use of tools that genuinely help us do good work. This policy was last reviewed [Month Year]. Questions should be directed to [Role/Name]. ──────────────────────────────────────────── 2. APPROVED TOOLS The following AI tools are approved for work purposes: - [Tool name] — approved for: [writing / research / analysis / coding / design] - [Tool name] — approved for: [writing / research / analysis / coding / design] - [Tool name] — approved for: [writing / research / analysis / coding / design] Tools not on this list require approval from [Role] before use on client work or work involving client data. To request approval for a new tool, contact [Role/email]. ──────────────────────────────────────────── 3. DATA RULES Do not input the following into any AI tool, approved or otherwise: - Personal data of any individual (clients, staff, leads, third parties) without a clear lawful basis - Any material covered by a non-disclosure agreement — check the NDA before inputting - Legally privileged communications or documents - Internal financial data (forecasts, management accounts, pricing models) - Client financial statements or commercially sensitive data - Any material you would not be comfortable seeing in a data breach disclosure If you are unsure whether material is safe to input, do not input it. Ask [Role] first. ──────────────────────────────────────────── 4. OUTPUT REVIEW STANDARD AI tools produce plausible but sometimes incorrect content. All AI-assisted output must meet the following standard before use: Client deliverables: All AI-assisted content in client-facing documents must be reviewed and approved by the responsible team member before submission. Factual claims, statistics, and references must be verified against source material. Legal, financial, or regulatory statements: Must be reviewed by [a qualified person / legal counsel / the account lead]. Internal use: AI-assisted internal documents should be reviewed before sharing, though the standard may be lighter than for client work. ──────────────────────────────────────────── 5. CLIENT DISCLOSURE POSITION Our default position: we use AI tools as part of our standard workflow. All deliverables are reviewed and approved by a qualified team member before submission. If a client asks directly whether AI was used on a specific piece of work, answer honestly and specifically about your role in producing the work. If a client contract includes restrictions on AI tool use, those terms take precedence over this policy. Check contracts before using AI on any new engagement. Standard disclosure language: [Paste your disclosure wording here, or reference the document where it can be found] ──────────────────────────────────────────── 6. PROHIBITED USES The following are never permitted regardless of context: - Inputting personal data of any individual into a public AI tool without a lawful basis - Using AI output in client deliverables without human review - Using AI tools not on the approved list for client work - Actively claiming AI-generated content is human-written when sincerely and directly asked - Using AI to make decisions affecting individuals (hiring, credit, performance) without human review - Using AI on an engagement where the client contract restricts AI use - Using AI to impersonate another person ──────────────────────────────────────────── 7. QUESTIONS AND UPDATES Questions about this policy: contact [Role/Name] at [email]. To suggest an update or flag a tool not on the approved list: [process or contact]. This policy is reviewed quarterly. The current version is always available at [location].
This template is a starting point, not legal advice. If your business operates in a regulated sector (financial services, healthcare, legal, HR), or if your client contracts include specific AI obligations, review the policy with a legal professional before publishing it. The data rules section in particular may need to be more detailed for regulated activities.
Need more than a template?
We help small businesses build AI governance frameworks that work in practice
Beyond the policy document, we work with businesses on approved tool selection, staff training, client disclosure language, and sector-specific compliance considerations. If you're in a regulated industry or work with enterprise clients who are asking harder questions about your AI governance, talk to us.
Common questions
FAQs
Get in touch