In short
Most staff already have access to AI tools, through free chatbots, browser extensions and features built into everyday software. An acceptable use policy turns that from an unmanaged risk into something you can control. It sits alongside your data protection, information security and IT policies, and should be written in plain language that people will read.
What to include
| Scope | Who the policy covers (staff, contractors) and which tools count as AI, including AI features inside other software. |
|---|---|
| Approved tools | A named list of tools and accounts staff may use for work, and how to request a new one. |
| Data rules | What must never be entered: personal data about customers or staff outside approved tools, confidential client information, passwords, financial details. |
| Checking output | A person must review AI output before it is sent, published or relied on, and remains responsible for it. |
| Prohibited uses | For example, making decisions about individuals without human review, or giving regulated advice. |
| Transparency | When customers should be told AI was used, for example on a chat or phone line. |
| Reporting | How to report a mistake or a data incident, and who owns the policy. |
Why data rules matter most
The most common problem is staff pasting customer emails, contracts or spreadsheets into a free consumer tool to save time. Depending on the tool and its settings, that information may be stored by the provider and in some cases used to improve its models. Terms differ between consumer and business plans and change over time, so check them for each tool you approve.
Under UK GDPR you remain responsible for personal data you share with a supplier. Approving business accounts with appropriate contract terms, and blocking or discouraging the rest, is usually the simplest way to stay in control.
How long should it be?
Short enough that people read it. Two pages is plenty for most small businesses, with a one-page summary of dos and don’ts that can be pinned up or added to onboarding. Long policies written in legal language tend to be signed and forgotten.
Use examples from your own work. “Do not paste a client’s contract into a chatbot to summarise it; use the approved tool” is clearer than a general statement about confidential information. A short list of allowed examples helps too, such as drafting a first version of a marketing email or tidying the wording of an internal note.
Rolling it out
Ask staff which AI tools they already use before you write the policy, so it reflects reality. Explain the reasons behind the rules in a short session, and give people an approved tool that meets their needs. A policy that bans everything without offering an alternative pushes use out of sight.
Review the policy every six to twelve months, and whenever you adopt a significant new tool. Keep a simple record of approved tools and who owns each one.
How it fits with the law
The policy is an internal rule. It does not replace your legal duties under UK GDPR and the Data Protection Act 2018, such as having a lawful basis and doing a data protection impact assessment for high-risk processing. The ICO publishes guidance on AI and data protection that is worth reading alongside it. This page is general guidance, not legal advice.
When this matters
Relevant as soon as anyone in the business uses AI for work, which in most businesses is already the case. New Era AI helps clients agree the policy and the approved tools as part of a consulting engagement, and covers it in staff training.
Questions
Do small businesses need an AI policy?
If staff use AI tools for work, yes. A short policy is one of the cheapest ways to prevent customer data ending up in tools you have no agreement with.
Should we ban ChatGPT and similar tools?
Outright bans tend to push use out of sight. Approving a business account with suitable terms and clear rules usually works better.
Is there a legal requirement to have an AI policy in the UK?
There is no general UK law that requires one by name. It helps you meet existing duties, such as those under UK GDPR. Take advice for your circumstances.