Guides / Writing an AI policy
Guide · Adoption
Writing an AI Policy for Your Business
The short version: if anyone in your business uses AI — and they probably do — you need a short, written policy. Not a legal tome: one page covering which tools are approved, what information never goes in, who checks the output, and who to ask. It protects your data, gives your team confidence to use AI openly, and takes about an hour to write. There's a template below you can copy.
01Why bother?
Without a policy, you get one of two outcomes. Either people avoid AI because they're not sure they're allowed — and you miss out on the time savings — or they use it quietly on personal accounts, and you carry the data risk without knowing it. In 2026 surveys, around a quarter of UK small firms using AI had already found staff using tools nobody had approved.
A policy fixes both. It says yes, use it — here's how. That's the difference between permission and a trap, which we cover in Getting Your Team Actually Using AI.
02What a good policy covers
Keep it to a page. If it needs a contents table, nobody will read it. The essentials:
- Approved tools — named, with which account to use. Business-tier tools come with the data protections free ones lack (see Is AI Safe to Use With My Business Data?).
- What never goes in — personal data, passwords, confidential material.
- Human checking — who checks AI output, and when.
- Decisions about people — a person, not software, makes decisions that significantly affect someone. That keeps you comfortably within the 2026 rules on automated decision-making.
- Recording and transparency — consent for AI note-takers; honesty with customers.
- Who to ask, and what to do if something goes wrong.
03A template you can copy
[Business name] — AI use policy (reviewed [date])
1. Why we use AI. We encourage everyone to use AI tools to save time on drafting, summarising and admin. You remain responsible for anything you produce with AI's help.
2. Approved tools. Use only: [list, e.g. "ChatGPT Business via your work login", "Microsoft Copilot in 365"]. Want to try something new? Ask [name] first — we'll usually say yes.
3. What never goes into AI tools. Customer or staff personal details (names, contact details, health, financial information) unless the tool is on the approved list for that purpose; passwords; anything covered by a confidentiality agreement. When in doubt, anonymise or leave it out.
4. Check before it leaves the building. AI can be confidently wrong. A person checks every fact, figure, price and legal or safety statement before anything goes to a customer, supplier or the public.
5. Decisions about people. AI may help prepare, but a person makes any decision that significantly affects a customer, applicant or employee.
6. Recording and note-takers. Tell everyone before using AI to record or transcribe a call or meeting, and don't record if anyone objects.
7. Being open. We don't pass off AI-generated images or reviews as real, and we're honest with customers if they ask how we use AI.
8. Mistakes happen. If something goes wrong — sensitive data pasted in, an error sent out — tell [name] straight away. Reporting quickly is what matters; no one will be blamed for being honest.
Adapt it freely. A design studio might add rules on AI-generated images and client copyright; a care provider will want much stricter rules on health information.
04Rolling it out
- Introduce it in person, in a team meeting, as permission rather than restriction. Lead with "we want you to use this".
- Set up the approved tools first, so following the policy is the easy option.
- Ask everyone to read and sign it, and include it in new-starter paperwork.
- Mention it in your privacy notice if AI becomes part of how you handle customer data.
05Keep it alive
AI tools change quickly, so put a review date in the diary — every six months is plenty. Ask the team what's working, what's unclear and what they'd like added to the approved list. A policy that changes with the tools stays useful; one written once and filed is just paperwork.
Want help putting this in place?
Our hands-on AI training includes setting up your approved tools, tailoring the policy to your business, and showing your team how to use AI confidently within it.
Get in touch →