Services
Explore
Free AI assessmentAnswer 15 questions about one process and see where AI could help.
Start an assessmentHow do I write an AI policy for my team?
A starting policy template for small businesses, with what to include, what to prohibit and how to introduce it to your team.
How To
How To
Adapt a seven-section starting template to your tools, data and clients, then introduce it to your team with a draft, a short session and a review date.
List of AI tools currently used by your team
Awareness of any client contract AI clauses
Time to adapt the template with whoever is responsible for data protection
Write down the AI tools your team currently uses. Decide which are approved and for what purposes. This becomes your approved tools list.
Define what data may go into which approved tools. Be specific, for example: no client personal data unless the tool is approved for it, no NDA-covered material, no financial statements with sensitive figures.
Define what 'reviewed before use' means for your business. Who reviews? What do they check? How is AI output handled in client-facing documents?
List the specific things that are not permitted. Be concrete: write 'do not input personal data of clients, staff or third parties into unapproved tools' where a vaguer policy might say 'use responsibly'.
Use the template below, fill in your details and share it with your team. Run a short session explaining why the policy exists as well as what it says.
What this guide covers
Intro
An AI use policy for a small business can be short. It needs to be specific enough that people know what is allowed and short enough that they read it. This guide covers the sections in the starting template, the prohibitions that matter most, how to introduce the policy to your team, and a template to copy and adapt.
The guide is for a business owner who uses AI and wants to give a small team clear, practical guidance in a short document they will read and refer back to.
The policy has three jobs: make clear what is allowed, prevent the misuses that carry the most risk, and give everyone the same answer when clients ask about AI. It will not settle every situation, so it names an owner who answers questions and reviews it.
What to include
The core sections of the template
The starting template has seven sections. The five below set out the main rules. Prohibited uses are covered in the next part of this guide, and the final section of the template says who to contact with questions, updates or mistakes.
Explains why the policy exists: to protect the business, its clients and the people who work there.
What- Who the policy applies to (employees, contractors, freelancers)
- Which activities it covers (client work, internal work, or both)
- What happens if the policy isn't followed
- When it was last reviewed and who owns it
Example wordingThis policy applies to team members and contractors of [Business Name] when using AI tools in connection with their work. It is reviewed [every three months / every six months] by [Role].
Stops people using AI tools with unsuitable data handling without realising it, and records which tools the business has checked and approved.
What- List each approved tool by name (for example, a business ChatGPT plan or Copilot for Microsoft 365)
- Note the approved uses for each (writing, research, coding, analysis)
- State that unlisted tools need approval before use
- Include a process for requesting a review of a new tool
Example wordingApproved tools: [Tool A] (writing, research, drafting), [Tool B] (analysis, long-form writing). Tools not on this list need approval from [role] before use on client work.
The section where specific rules matter most. General 'be careful' wording gives people nothing to act on, so name the types of data and which tools, if any, may receive them.
What- Personal data of clients, staff or third parties: only in tools approved for it, with a lawful basis
- NDA-covered material: check the NDA before inputting anything covered by it
- Financially sensitive information: no internal forecasts, management accounts or client financial statements
- Commercially sensitive information: pricing models, strategic plans, M&A-related material
- Material covered by legal privilege
Example wordingUnless [Role] has approved the tool for it, do not input: personal data of any individual, NDA-covered material, internal financial data, client financial statements, or any material you would not be comfortable seeing in a data breach.
AI output needs checking before it is used, particularly in client-facing work. This section defines what 'reviewed' means in practice.
What- AI-generated content used in client deliverables is reviewed and approved by a named team member
- Factual claims, statistics and references are checked against their sources
- Legal, financial or regulatory statements are reviewed by the relevant qualified person
- Internal use has a review standard too, even if a lighter one
Example wordingAI-assisted content in client deliverables must be reviewed by the responsible team member before submission. Factual claims and statistics must be checked against source material.
Gives the whole team the same answer to 'did you use AI on this?' across different client relationships.
What- Your default position: whether you disclose AI use proactively or on request
- How to handle a direct client question
- What to do if a client contract includes AI restrictions
- Where to find your standard disclosure language
Example wordingOur position: we use AI tools as part of our standard process, and work is reviewed and approved by a qualified team member before it is sent. If a client asks directly, answer accurately and specifically. AI clauses in client contracts take precedence over this policy.
What to prohibit
Seven specific prohibitions
A general instruction to use AI responsibly gives people nothing specific to follow. Each of the seven prohibitions below addresses a particular risk, with a short explanation.
UK GDPR requires a lawful basis for processing personal data, and a tool's terms affect how that data is handled. Agree with whoever is responsible for data protection which tools, if any, may receive it.
AI produces plausible content that is sometimes wrong. Sending it to a client unchecked creates a professional liability risk, and an error the client finds undermines trust in your review process.
Unapproved tools may handle data in ways that are unsuitable for your sector. A risk you do not know about is one you cannot manage.
This is a misrepresentation risk. Choosing not to volunteer information differs from giving a false answer to a direct question, and the second creates legal and reputational exposure.
Decisions about hiring, credit, performance or access to services have a significant effect on people. UK GDPR has specific rules on decisions made solely by automated means, so take advice before using AI in this way.
Breaching a contract clause, however minor it seems, can create liability and damage the client relationship, whatever drafting time it saves.
Uploading privileged communications to a third-party platform could put privilege at risk. NDA terms vary, so check them before inputting anything they cover.
Rollout in five steps
How to introduce the policy to your team
A policy emailed with no context leaves people guessing why it exists, and some will assume it means monitoring or changes to their jobs. These steps explain the purpose and give the team a say before the policy is final.
| Title | Step | Detail | Tip |
|---|---|---|---|
| Share a draft before it's final | 1 | Send the draft to your team and ask two questions: 'Is anything here unclear?' and 'Is there anything you think we've missed?' You still make the final decision, and people who helped shape the document are more likely to follow it. | Asking for comments shows the team their questions are taken seriously, even if the wording stays the same. |
| Run a short session explaining why | 2 | Alongside the document, run a short session explaining the reasons the policy exists: protecting client data, managing professional liability, keeping standards consistent and meeting client expectations. Rules are easier to follow when people understand the reason for them. | Expect questions about how AI will affect people's roles, and answer them directly. Say what the business has decided, what it has not decided yet, and how the team will be involved. |
| Publish it somewhere permanent and findable | 3 | Put it in your shared drive, Notion or intranet, wherever your team looks for reference documents, and link to it from your onboarding checklist. A policy people cannot find when they need it will not be followed. | |
| Set a review reminder | 4 | Add a recurring calendar event for a policy review at an interval you choose, such as every three months. AI tools and their terms change often, so check whether the approved tools are still current, whether client requirements have changed and whether the data rules still fit. | |
| Lead by example | 5 | Talk openly about how you use AI in your own work: what you use it for, where you do not trust it and where it has saved you time. Seeing you use AI openly and carefully shows the team how the policy works in practice. |
Free template
Copy-paste AI policy starting template
This is a starting template. Tailor it to your business: name an owner, list your approved tools, uses and data, set review expectations and a route for reporting mistakes, and add a review date. Keep it short and specific so people read it. One or two pages is usually enough.
This template is a starting point and does not constitute legal advice. If your business operates in a regulated sector (financial services, healthcare, legal, HR), or if your client contracts include specific AI obligations, have the policy reviewed by a legal professional before publishing it. The data rules section in particular may need more detail for regulated activities.
Common questions
FAQs
Does a small business need an AI policy?
If your team uses AI tools for client-facing work such as writing, research, analysis or reporting, a short policy helps for three reasons. It shows the oversight you had in place if AI output causes a problem for a client. It reduces the chance of someone pasting client data into a tool that has not been approved for it. And it gives you an answer when a client or procurement team asks whether you have one. A one-page policy records who can use which tools, what data is allowed and what review is required.
What if my team is just me?
It is still worth writing, for two reasons. It makes you think through what is appropriate for your business and your clients before each decision comes up. It also gives you a document to share with clients who ask about your AI use, so you do not have to explain your position from scratch each time. A one-page document covering approved tools, data rules and your review standard is enough.
Can I copy a policy from the internet?
You can use a template as a starting point, then adapt it to your tools, your sector and your client obligations. A generic policy that says 'use AI responsibly' does not tell your team what they can and cannot do. A policy that is specific about which tools are approved, what data may go into them and what review applies to outputs is more useful to your team and easier to explain to a client.
How do I handle team members who resist using AI?
The policy sets out how to use AI safely when people use it. Whether to require AI use is a separate decision for the business. Hesitation often comes from uncertainty about what is expected or concern about how roles will change. In the rollout, explain what the policy covers, answer questions about roles directly, and involve the team in deciding where AI helps. Using AI visibly yourself, and talking about where you do and do not trust it, also helps.
How often should I update the policy?
Set a regular interval, such as every three months, because AI tools and their terms change often and a policy can fall behind the tools people use. Also review it when a new tool is adopted, when a client contract includes specific AI terms, and when a provider you use changes its data handling terms. Keep a version number and date on the document so everyone knows which version is current.
What if a client contract includes a no-AI clause?
A no-AI clause in a signed contract governs that engagement. Your policy should say that client contract terms take precedence over its general permissions, and your team should check the contract before using AI tools on an engagement. If you rely on AI tools in your work, review any no-AI clause before you sign.
Talk to us
We help small businesses choose approved tools, train staff and agree disclosure wording
Alongside the policy document, we work with businesses on approved tool selection, staff training, client disclosure wording and the rules that apply in their sector. We identify those rules with you and agree the safeguards and checks before anything goes live. Send us your current list of AI tools and any AI clauses in your client contracts.