AI Policy for Small Business: Simple UK Starter Guide
Set approved tools, prohibited data, human checks and incident reporting before staff use generative AI for customer work.
BMR Digital · Source review 2026-11-06 · UK English
A useful policy starts with real tasks
An AI policy for a small business should describe how people actually work. List the tasks staff want to speed up: drafting an appointment reminder, summarising public guidance, producing a first marketing outline or turning non-sensitive notes into a checklist. Then identify what information those tasks involve. A public service description is different from a customer complaint, payroll file or medical record. Ask staff where they already use AI so that the policy addresses reality rather than an ideal workflow. Keep the first version short enough to read and assign a named person to answer questions. A policy is not a certificate of UK GDPR compliance and does not remove the need for suitable contracts, lawful processing and security. If your work involves regulated or sensitive information, seek appropriate advice before introducing a tool, rather than treating an ordinary subscription as permission to upload everything.
Name approved accounts and tools
Approval should refer to a specific service, account type and permitted task, not a broad statement that “AI is allowed”. Personal, business and enterprise plans may have different data terms. Confirm who owns the account and how access is removed when someone leaves. Shared passwords make responsibility and access control harder, so use individual accounts where possible. Check authentication options and avoid connecting business mail or document drives without authorisation. Record supplier terms, important settings and a review date. If an employee cannot tell whether a tool is approved, the default should be to ask before uploading business material. Keep a route for requesting a new tool so that staff are not forced to improvise secretly. Approval can be limited: a tool may be suitable for brainstorming public content but not suitable for processing customer records or confidential supplier agreements.
Example policy: permitted and prohibited use
A practical starter statement is: “Staff may use named approved AI services for drafting non-confidential material. They must not upload passwords, payment card details, identity documents, customer personal information, payroll data or confidential agreements without a separately approved process. AI output must be checked by a responsible person before it is sent to a customer or used for a decision. New tools and connections need manager approval. Suspected disclosure or fraud must be reported promptly.” Adapt this to your actual business rather than copying it unchanged. For instance, a garage may need a rule about registration plates and customer invoices; a booking company may need a rule about guest details. Define exceptions carefully and document who authorises them. An employee cannot make a sensitive upload acceptable merely by deleting one name if the remaining details still identify a person.
Use realistic data-handling examples
Suppose a customer email asks about a missed delivery. Instead of pasting the entire thread, write a neutral prompt: “Draft a polite apology for a delayed item and explain that we will confirm a revised date.” Add the actual customer details later in your normal business system. For a staff rota, do not upload a spreadsheet containing home addresses and emergency contacts simply to improve the layout. Create a blank example with fictional names. When summarising a contract, recognise that removing contact details does not remove commercial confidentiality. The substance of prices, negotiations and obligations may still be sensitive. Teach staff to separate the drafting task from the real records used to complete it. This preserves much of the time saving while limiting unnecessary disclosure. Keep data minimisation part of the workflow rather than hoping an end-of-month privacy check catches every upload.
Human checking needs an owner
“Check the answer” is weak unless someone knows what they are checking. For customer messages, verify factual statements, dates, prices and promises. For technical instructions, use a person with the relevant competence and the original manufacturer or professional source. For public marketing, check copyright, misleading claims and any invented testimonials. Do not let an AI draft automatically change a quote, approve a refund or provide regulated advice. Assign responsibility to the person who releases the output, not to the software. Keep records proportionate to the risk; a public wording suggestion needs less documentation than a decision affecting someone’s rights. Encourage staff to say when an answer is uncertain. A polished paragraph can conceal a wrong assumption, and repeated use of the same tool does not establish that its next answer will be correct.
Build a practical incident route
Tell staff what to do if private information is uploaded or a suspicious AI-assisted payment instruction arrives. The first step is to stop further sharing and report the issue to the named responsible person. Note the service, account, time, information involved and whether any connection was enabled. Do not copy the leaked information into multiple messages while describing the incident. Change compromised credentials promptly and assess whether other parties need to be informed. A personal data incident may require a UK GDPR assessment and, in some cases, reporting within statutory time limits; consult current ICO guidance rather than assuming every incident has the same response. For payment fraud, contact the bank through an established route and preserve useful evidence. A short, rehearsed process is more valuable than a policy file that nobody can find when a staff member needs help.
Review suppliers and keep the policy alive
Set a review when the business adds a tool, changes a plan or connects a new data source. Ask where information is processed, how long it is retained, what training controls apply and what contractual protections exist. Do not equate a familiar brand with suitability for every task. Explain changes to staff and test the workflow with fictional examples before real records. Record unresolved questions and limit use until they are answered. The Small Business guide brings together policy and response templates, but each template still needs adaptation to the organisation. The free checklist is useful for an individual user and should not be mistaken for a full workplace governance process. A good policy enables sensible low-risk use while clearly stopping uses that need deeper review, so that staff can benefit from AI without turning customer trust into an experiment.
Official sources and further checks
Provider settings can change and differ by account, plan and location. Check the current official instructions for the service you actually use. This is independent educational guidance, not a safety or legal compliance guarantee.
A printable next step
Compare AI Safety for Small Business for the stated printable guidance, or start with the free checklist. Only genuine uploaded files are offered for download.
View AI Safety for Small BusinessUseful AI safety reading
All resourcesChatGPT Privacy Settings: What Each Control Does
Training, history, memory and connected apps are separate ChatGPT controls. Review each one before sharing personal or customer information.
AI Safety for Children: A Parent's Starting Guide
Begin with age rules, private information, supervised chatbot use and calm family conversations about deepfakes and misleading answers.
AI Policy for Small Business: Simple UK Starter Guide
Set approved tools, prohibited data, human checks and incident reporting before staff use generative AI for customer work.
AI Voice-Cloning Scams: How to Check a Fake Call
Do not rely on a familiar voice alone. End the call and independently contact the person or business through a known route.
What Not to Share With AI: Practical Examples
Keep passwords, identity documents and unnecessary personal or confidential details out of AI prompts. Use fictional examples and minimise data.
Gemini Activity & Privacy Settings Explained
Review Gemini Keep Activity, deletion, connected services and account type separately; switching off activity does not mean no processing or retention.
Claude & Copilot Privacy Controls Compared
Compare account type, training preferences, history, memory and connections rather than assuming Claude or Copilot is completely private.