Here's a fun fact. Whether you've given them permission or not, someone on your team is probably already using AI. That's not a disaster. But it does mean you need a few ground rules, and that's all an AI policy really is.
And no, it doesn't need to be 30 pages long. The best ones I've seen fit on two sides of paper.
Why bother?
Three reasons. It protects your customers' information. It gives your team confidence, because they know what's OK instead of guessing. And it shows clients you're taking this seriously, which more and more of them are asking about.
What to put in it
Keep it to these sections and you'll cover what matters.
- Why we use AI. One or two lines. We use AI to save time on routine work so we can spend more time with customers.
- Which tools are approved. Name them, and say which account to use. For example, Copilot through your work login, or ChatGPT on the company's business plan.
- What never goes in. Customer personal details, health or financial information, passwords, anything confidential.
- Check everything. AI can be confidently wrong. A person checks anything that goes to a customer or is used to make a decision.
- Be honest about it. When it matters, say when AI has helped. Never pass off AI content as something it isn't.
- People decisions stay with people. AI doesn't decide who gets hired, promoted or let go.
- Who to ask. Name a person your team can go to with questions.
- Training and review. Everyone gets trained, and the policy gets looked at every six months.
Example wording you can adapt
That's it. Five sentences that cover most of what goes wrong.
The mistakes I see most
Banning AI completely. It doesn't stop people using it, it just stops them telling you. Writing it and filing it. If nobody's walked the team through it, it doesn't exist. Making it too long. If it reads like a legal contract, people won't read it. Writing it without the team. Ask them what they're already using it for. You'll learn a lot.
How to roll it out
Talk it through in a team meeting. An email won't cut it. Give people real examples of good and bad use from your own business. Then back it up with training, because a policy tells people the rules but training shows them how to work within them.
If you're still working out the safety side, have a read of is it safe to use ChatGPT at work? And if you'd like help shaping a policy that fits how you actually work, our bespoke AI training can build it in. Our AI and ethics training covers the responsible use side in more depth.
Quick answers
Does a small business legally need an AI policy?
There's no UK law that specifically says you must have one. But if your team uses AI with customer information, UK GDPR still applies, and a short policy is the easiest way to show you've thought about it.
How long should an AI policy be?
One or two pages is plenty for most small businesses. If it's too long, nobody reads it.
How often should we review our AI policy?
Every six months is a good rhythm, or sooner if you bring in a new tool. AI changes quickly, so a policy from last year can already be out of date.