A Simple AI Policy for a Small Business

Why it matters

Staff are often already using AI tools on their own. Without rules, customer details, prices or confidential documents can end up in tools you have never checked, and AI-written mistakes can reach customers. A one-page policy fixes most of that.

What to include

• Approved tools: the AI tools staff may use for work, and on which accounts.
• Never paste in: personal data about customers or staff, passwords, bank details, and anything marked confidential, unless the tool has been approved for that use.
• Always check: a person must read and check AI output before it goes to a customer, is published, or is used to make a decision.
• Be honest: do not present AI-written content as a personal guarantee or professional advice without checking it.
• Who to ask: the person responsible for AI questions in your business.
• Review date: when the policy will be looked at again.

A template you can adapt

1. We use AI tools to save time on drafting, summarising and research. Approved tools are: [list].

2. Do not enter personal data about customers or staff, passwords, payment details or confidential business information into any AI tool unless it is approved for that purpose.

3. Check everything an AI tool produces before it is sent to a customer, published or relied on. You are responsible for the final version.

4. Do not use AI to make decisions about people, such as hiring or disciplinary matters.

5. If something goes wrong, or you are unsure, ask [name].

6. This policy will be reviewed on [date].

Keep it alive

Go through the policy with your team in five minutes, pin it somewhere everyone can see it, and review it every six months. AI tools change quickly, so the approved list will change too.