AI policy for small businesses

An AI policy for a small business should answer the questions your team meets during a normal working day: which tools can we use, what information can we enter, what must a person check and who do we tell when something goes wrong?

It does not need to begin as a twenty-page compliance manual. A useful first policy can fit on two pages if it gives people clear boundaries, names an owner and connects to the way your business already handles security, personal data and customer communication.

The aim is not to stop sensible experimentation. It is to let people use approved AI tools without guessing where the line is.

What an AI policy should do

The UK government’s AI Management Essentials guidance is intended primarily for small and medium-sized businesses and start-ups. It treats an AI policy as one part of a wider management system that also includes an inventory of AI systems, risk management and communication.

That is an important distinction. A policy states the rules, but it cannot replace an approved-tools list, staff training, access controls, review records or a process for reporting problems.

For a small firm, the policy should do five jobs:

explain why the business uses AI and what it expects to improve;
identify the tools and accounts people may use for work;
set boundaries for data, decisions and customer-facing output;
say who approves new uses and who owns each live workflow;
give staff a simple route for questions, mistakes and incidents.

Write it for the people doing the work. If a rule cannot help somebody decide whether to paste an enquiry into a tool or send an AI-assisted email, it is probably too vague.

Start with scope, purpose and ownership

Open with three short statements.

Scope: State who and what the policy covers. Include employees, contractors and temporary staff using standalone AI services, AI features inside existing software and automated agent workflows for company work.

Purpose: Explain the positive use you are trying to support. For example: “We use approved AI tools to reduce repetitive work and improve preparation. People remain responsible for decisions, promises and published work.”

Owner: Name the role responsible for keeping the policy and approved-tools list current. In a small business this could be the managing director, operations lead or data protection lead. Also make each AI workflow the responsibility of a named business owner rather than leaving accountability with “the team”.

The government’s AI Management Essentials self-assessment asks organisations to maintain an up-to-date record of the AI systems they develop and use. A simple register can record the tool, purpose, owner, users, data involved, supplier, approval date and next review.

This is worth doing before writing detailed rules. You cannot apply a policy consistently if nobody knows which AI tools are already in use.

Define approved AI tools and accounts

Your policy should tell staff where the approved list lives and how to request another tool. Do not rely on memory or a message buried in a chat channel.

For each approved tool, record:

the permitted business purpose;
which company account or subscription must be used;
who may access it;
whether it can receive personal, confidential or commercially sensitive information;
what connected files, inboxes or systems it can reach;
any mandatory settings, such as multi-factor authentication;
who reviews supplier or product changes.

A familiar brand name is not enough to approve every feature. A writing assistant that only sees text pasted by a user presents a different access question from an agent connected to email, customer records and cloud storage.

The National Cyber Security Centre’s secure AI development guidance recommends identifying and protecting AI-related assets, including data, prompts, documentation and logs. It also recommends controls over the data AI systems can access and over generated content according to its sensitivity.

Make the request route easy. If approval takes weeks and the rule only says “ask IT”, people may reach for a personal account instead. A short form that captures the job, tool, information and intended output is usually enough for an initial decision.

Set a simple data rule people can remember

“Be careful with data” is not an instruction. Give the team categories and examples.

A workable starting point is:

Public: published website copy, public product details and approved public reports. These may be used in an approved tool for an approved job.
Internal: plans, draft campaigns, internal procedures and non-public performance figures. Use only where the tool and account have been approved for internal data.
Confidential or personal: customer records, employee information, contracts, credentials, financial details, sensitive commercial information and special category data. Do not enter these unless the specific use has been assessed and explicitly approved.

Add a redaction rule. If a task can be completed without names, email addresses, account numbers or identifiable details, remove them before using the tool.

The Information Commissioner’s Office says that if an AI system processes personal data, the organisation must comply with data protection by design and by default. Its AI and data protection guidance should be read alongside your existing privacy and security obligations. This article is operational guidance, not a substitute for data protection or legal advice about a particular use.

Separate assistance from decisions and actions

Your AI policy for a small business should distinguish between preparing work and taking action.

An approved tool might be allowed to:

summarise public research;
suggest headline options;
format an internal report;
prepare a first draft from approved source material;
group feedback for a person to assess.

The same policy might require explicit review before anyone:

publishes content;
sends a customer communication;
changes a price, offer, deadline or contract term;
makes a claim about a product or result;
uses an output to make a decision about a person;
allows an agent to edit records or trigger an external action.

Write the approval point beside the task. “Human review required” is weak unless the policy says who reviews, what evidence they see and whether they can reject or escalate the work.

Our human-in-the-loop AI marketing workflow provides a six-field approval gate for this. For higher-impact uses, complete a specific risk and data protection assessment rather than assuming a general content check is enough.

Include accuracy, disclosure and ownership rules

People remain responsible for the work they use. Your policy should require them to check material facts, dates, calculations, links, quotations and commitments against a reliable source before relying on an AI output.

It should also answer three practical questions.

When should AI use be disclosed?

Decide when customers, colleagues or suppliers need to know that AI contributed to a service or interaction. The answer depends on context and impact. At minimum, do not present automated contact as a named person’s considered response, and do not hide AI involvement where it would materially affect somebody’s understanding or choice.

Who owns the final work?

Name the person responsible for approving and maintaining it. Do not treat an AI tool as the author, decision-maker or accountable owner. Check supplier terms and your existing intellectual-property process for the particular material involved.

What must never be claimed?

Prohibit invented customer stories, quotations, qualifications, test results, statistics and first-hand experience. Require a source for material factual claims. If a claim cannot be verified, remove it or mark it clearly for further work.

These rules are especially important for marketing because polished language can make an unsupported statement look finished.

Add reporting, stopping and review instructions

A useful policy tells people what to do after a mistake. Staff should know how to report:

information entered into the wrong tool or account;
an output that exposes confidential or personal information;
an inaccurate or harmful customer-facing result;
unexpected access, actions or changes made by an AI agent;
a suspected security incident;
a new AI feature appearing inside approved software.

Give them one reporting route and tell them what to stop. For example: pause the workflow, do not delete relevant records, tell the policy owner and use the existing data-breach or security process where appropriate.

The NCSC’s secure deployment guidance recommends clear guidance on appropriate use, limitations, failure modes and the user’s security responsibilities. It also recommends planning for incidents and reassessing plans as systems and research evolve.

Review the policy on a fixed schedule and after a material incident, new tool, major supplier change, new data connection or higher-impact use case. A short policy that is reviewed is more useful than a comprehensive one that describes last year’s setup.

A two-page AI policy structure

Use this as a drafting structure rather than copying it without adapting the rules.

Purpose: why the business uses AI and the outcomes it wants.
Scope: people, tools, embedded features and automated workflows covered.
Approved use: where the live list sits and how staff request a new tool or use case.
Data: what may be entered, what needs approval and what is prohibited.
Review: which outputs, decisions and actions require a named person’s approval.
Accuracy and claims: checks required before work is used or shared.
Transparency: when AI involvement should be disclosed.
Security and access: company accounts, authentication, integrations and least access needed.
Incidents: how to pause, preserve evidence and report a problem.
Ownership and review date: policy owner, workflow owners and next review.

Attach two small working documents: the AI system register and the approved-tools list. Then test the draft against three examples from your business. Ask a team member to explain what they would do with a public research task, a customer email containing personal information and a request to connect an AI agent to the company inbox.

If the answers are still uncertain, make the policy more specific. An AI marketing audit can help identify current tools, workflows and data before rules are formalised. If the policy reveals a skills gap, practical AI marketing training can turn the written boundaries into everyday habits.

Frequently asked questions

Does a small business legally need an AI policy?

There is no single universal rule that every UK small business must have a document called an “AI policy”. Existing duties may still apply to how you use AI, including data protection, employment, consumer and sector-specific requirements. A policy is a practical way to communicate and support those responsibilities, but it does not create compliance by itself. Take appropriate advice for high-impact, regulated or unusual uses.

Should we ban staff from using free AI tools?

Set the rule by tool, account, data and task rather than price alone. A free personal account may lack the controls or contractual terms required for company information, but a blanket ban without an approved alternative can drive use out of sight. Give staff a permitted route for useful low-risk work and a quick process for requesting new uses.

Can our AI policy be part of another company policy?

Yes. It can sit within an acceptable-use, information-security or data-protection framework if staff can find and understand the AI-specific rules. Keep the approved-tools list and AI system register easy to update. The important result is a consistent decision process, not a separate document for its own sake.

How often should an AI policy be reviewed?

Set a routine review date that matches the pace and risk of your use, then review sooner after a new tool, important feature change, data connection, incident or expansion into a higher-impact task. The owner should also monitor whether staff understand the rules and whether repeated questions expose gaps in the wording.

Make the policy usable this week

Begin with the tools people already use, not the policy you imagine needing in two years. Name the owner, list approved accounts, define the data boundary and identify the work that cannot proceed without review.

Share the draft with the team and test it against real tasks. Record the questions people still ask. Those questions are not a failure of the exercise; they are the evidence you need to make the policy useful.

A good small-business AI policy creates enough clarity for responsible work to continue. It does not promise to remove every risk, and it should never be the only control.

Need clear rules around the AI tools already in your business? Start with an AI Marketing Audit →

Sources checked on 29 September 2026: UK Government AI Management Essentials guidance, AI Management Essentials self-assessment, ICO guidance on AI and data protection, and NCSC secure AI system guidance. This article provides general operational guidance, not legal advice.