If your team is using AI tools, and it almost certainly is, you need some ground rules. A policy isn't about banning AI. Clear rules actually encourage sensible use, because people stop worrying about whether they're allowed and start focusing on doing it well.
Keep it short. A one-page policy that everyone reads beats a twenty-page one that nobody does. Here's a structure that works for most small businesses, with example wording to adapt.
1. Purpose
"We encourage everyone to use AI tools to work more efficiently, as long as we protect our customers' and colleagues' information and keep the quality our customers expect. This policy explains how."
2. Approved tools
List the tools people may use for work, and which accounts. Be specific, and say how someone can ask for a new tool to be added.
"Approved: [tool] using your work account. Other AI tools may be used only for tasks involving no personal or confidential information. To suggest a new tool, speak to [name]."
3. What must never go into an AI tool
This is the most important section. Make it concrete.
"Never enter: customer or staff personal details unless using an approved business tool for an approved purpose; health or other sensitive personal information; bank or card details; passwords; or confidential client documents. If in doubt, remove names and details first, or ask."
For the reasoning behind this, see using AI tools safely at work.
4. Checking the output
"AI can be wrong while sounding confident. You are responsible for anything you send or publish, whether or not AI helped write it. Check facts, figures, names and tone before anything goes to a customer."
5. Decisions about people
"AI must not be used to make decisions about individuals, such as recruitment, performance or customer eligibility, without a person reviewing and owning the decision."
6. Being open with customers
Decide how transparent you'll be. Many businesses tell customers when they're interacting with an AI assistant, and are happy to explain that AI helps draft some content.
"Where customers interact directly with an AI tool, such as a website chat assistant, we'll make that clear and offer a way to reach a person."
7. Intellectual property
"Don't ask AI to copy other people's content or reproduce copyrighted material. Treat AI-generated images and text as drafts to review, not finished work."
8. Who to ask, and review
"Questions go to [name]. Report any mistakes or data concerns straight away. Nobody gets in trouble for asking or reporting. We'll review this policy every six months."
Making it stick
- Talk it through in a 30-minute team session rather than just emailing it round.
- Share examples of good use, so the policy feels enabling rather than restrictive.
- Review it regularly. AI tools change quickly, and your policy should too.
This guide is general information rather than legal advice. If you handle particularly sensitive data or work in a regulated sector, have your policy reviewed by a qualified adviser.