AI policy template for small businesses (UK)

Here's the structure I'd use. It works for a firm of five or forty.

1. Purpose and who it applies to. One paragraph: why the policy exists and that it covers everyone, including contractors and anyone using personal devices for work.

2. Principles. Three or four lines you'd be happy to read out to a customer. For example: people stay responsible for anything AI helps with; we don't put customer data where we can't control it; we're honest when AI is involved.

3. Approved tools. Name each tool and the account type (company account, not personal). Add a short "not approved" list, such as personal accounts on free chat tools, browser extensions nobody has checked, or apps that record calls without telling people.

4. What AI may be used for. Be specific: drafting emails and quotes for a person to check, summarising internal meeting notes, tidying up job reports, searching your own documents.

5. What AI must not be used for. Making final decisions about customers' money, jobs or complaints; giving legal, medical or financial advice; anything that would go to a customer unread. My list of decisions you shouldn't hand over to AI is a good starting point for this section.

6. Customer and personal data rules. What can go into which tool. A simple rule many small firms use: no customer names, contact details or health or financial information in any tool that isn't on the approved list.

7. Human sign-off points. Where a named person must check before anything goes out: quotes, anything sent to a customer, anything about money or complaints. If you're adding a chat or voice agent, this is also where you say when it hands over to a person. Our guide on what website chat should handle before a person steps in covers that.

8. UK GDPR considerations. The data protection basics for any tool that touches personal data:

• your lawful basis for using the data this way;
• what you tell people (update your privacy notice);
• only using the data you need;
• the supplier's data processing terms, and whether your data is used to train their models (switch it off where you can);
• where the data is stored and whether it leaves the UK;
• security: company accounts, two-factor authentication, removing access when someone leaves;
• people's rights, such as access and correction;
• no significant decisions about people made solely by AI without the safeguards the law requires;
• a data protection impact assessment (DPIA) where the use is likely to be high risk;
• reporting a serious personal data breach to the ICO within 72 hours of becoming aware of it.

The ICO's guidance on AI and data protection is the reference, though the ICO has marked it as under review following the Data (Use and Access) Act 2025. The gov.uk factsheet on the Act's UK GDPR changes explains what changed, including the new rules on automated decisions. For the detail, see our UK GDPR checks before you plug AI into customer data.

9. If something goes wrong. Who to tell, how quickly, and what to do first: stop using the tool, note what happened, and check whether personal data was involved.

10. Training, review and acknowledgement. How new starters learn the policy, who reviews it and when (every three months is a good rhythm, because tools change fast), and a line for each person to sign.

Say you run a 14-person home maintenance firm. Your approved tools might be one business chat assistant on company accounts and the AI features in your job management system. AI may draft quote emails and summarise job notes; it must not set prices, reply to complaints or send anything to a customer unchecked. Customer addresses and phone numbers never go into the chat assistant. The office manager signs off every customer-facing message, and the policy is reviewed each quarter at the team meeting.

That's it. Two pages, and everyone knows where the lines are.

A policy only works if people use it. Keep it short, go through it at a team meeting rather than emailing it round, and put the approved tools list where people will see it. When someone asks "can I use this?", add the answer to the policy. And test any customer-facing AI before it goes live, as set out in how to test an AI agent before it talks to a customer.

The policy is also a sign you're ready for more. It's hard to roll out a chat agent or knowledge assistant safely if you haven't agreed the basics first. For where it fits in the bigger picture, see all our guides.