# The AI Policy Template a UK Small Business Can Copy

Canonical URL: https://business.theaieducator.io/posts/uk-small-business-ai-policy-template
Publication: Dan Fitzpatrick Insights
Author: Dan Fitzpatrick
Topic: AI Governance and Risk
Published: 2026-10-07T15:50:03.000Z
Modified: 2026-10-07T15:50:05.383Z

A complete AI use policy for a UK small business, free to copy and issue this week: nine clauses in full wording, the four choices only you can make, and what UK law actually requires behind each one.

## In brief

A UK small business AI policy needs nine clauses: scope, approved tools, what never goes in, what staff are encouraged to use AI for, the human check before work goes out, no AI decisions about people, customer disclosure, how to report mistakes, and who owns the policy. Four of those clauses depend on your business and nobody can decide them for you.

## Key takeaways

- A one-page AI policy a team can remember beats a long one nobody reads; the test is whether a member of staff could read it and know what to do differently on Monday morning.
- Office for National Statistics figures published on July 20, 2026 show around 35% of UK businesses with 10 or more employees using at least one AI technology in June 2026, up from around 12% when the series began.
- The scope clause must cover free tools on personal devices, because that is where most unapproved AI use in a small business actually happens.
- A policy made only of prohibitions stops the careful staff and not the confident ones; the clause saying what people are encouraged to use AI for is what makes the rest credible.
- Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR and attaches safeguards to significant decisions taken with no meaningful human involvement, so the simplest rule for a small business is that AI never decides about a person.
- Four clauses are genuine choices: the approved tool list, whether identifiable client data may ever go in, when customers are told, and who owns the policy.
- Without a clause promising that prompt, honest reporting of an AI mistake carries no discipline, a policy produces silence rather than compliance.

Most small businesses do not need a long AI policy. They need a short one that exists. Below is a complete AI use policy for a UK small business, written to be copied, pasted into a document with your company name at the top, and issued this week. Nine clauses, plain wording, nothing behind an email form. Four of them you must decide for yourself, and those are marked.

*Last checked: October 7, 2026.*

## Why does a small business need the policy written down at all?

Because your staff are already using AI, and the question is only whether they are doing it inside rules you set or outside them. Office for National Statistics figures published on [July 20, 2026](https://www.ons.gov.uk/businessindustryandtrade/business/businessservices/articles/artificialintelligenceinukbusinesses/2023to2026) show around 35% of UK businesses with 10 or more employees reporting use of at least one AI technology in June 2026, up from around 12% when the series began, with 28% of micro businesses of 0 to 9 employees reporting the same. Large language models were the single most common application, at 18%.

That is adoption without instruction. In the businesses I work with, nobody has banned AI and nobody has explained it, so each person has quietly invented their own rule about what is acceptable to paste into a chat window. A written policy replaces nine private rules with one shared rule, and it takes an afternoon.

The test the policy has to pass is not legal. It is this one:

> "The Monday Test is a single question to ask of any AI strategy before it is signed off: could a member of staff read it and know what to do differently on Monday morning?"

A policy that fails the Monday Test is a document that protects nobody. If you want the argument for having one at all, including whether your business is small enough to skip it, I have written separately on [whether a small business needs an AI policy](https://business.theaieducator.io/posts/does-a-small-business-need-an-ai-policy). This article is the document itself.

## The template: a one-page AI use policy you can copy

Copy everything in the quoted blocks. Replace anything in square brackets. Keep the numbering, because people refer to clause numbers when they ask questions.

### 1. Scope

> "This policy applies to everyone who works for [Company], including employees, directors, contractors, freelancers and temporary staff. It covers any use of an AI tool for [Company] work, whether the tool is one we pay for or a free one you use in your own browser, and whether you are on a company device or your own."

The free-tool-on-a-personal-device sentence is the one that matters. That is where most unapproved use actually happens, and a policy that only covers company accounts is a policy that misses it.

### 2. Approved tools

> "You may use the following AI tools for [Company] work: [list them]. You may not use any other AI tool for work that involves customer information, staff information, supplier contracts, pricing, or anything we would not publish on our website. If you want to use a tool that is not on this list, ask [name] first. The list is reviewed on the first working day of each quarter."

### 3. What never goes into an AI tool

> "Never enter the following into any AI tool, including approved ones, unless [name] has confirmed in writing that the tool is covered by a business agreement that permits it: customer names, contact details or account information; staff personal data, including anything about health, pay or performance; anything marked confidential by a client; login details or passwords; the text of signed contracts; and anything that would identify a named individual."

### 4. What you are encouraged to use AI for

> "You are encouraged to use approved AI tools to draft, summarize, rewrite, translate, plan, brainstorm, explain, check your own writing and prepare for meetings. Using AI for these jobs is not cutting corners, and nobody at [Company] will be judged for using it well."

Most policies stop after the prohibitions. A policy that only says no teaches staff that AI is a risk to be avoided, and the practical result is that the careful people stop and the confident ones carry on. The permission clause is what makes the rest of the policy credible.

### 5. The human check before anything goes out

> "AI output is a draft, never a final answer. Before anything produced with AI leaves [Company], a named person reads it in full and is responsible for it. That person is responsible for the content whether or not AI was used. If you cannot personally confirm that a fact, figure, quotation, legal statement or client detail is correct, remove it or check it at source before it goes out."

Before you accept "a human checks it" as a safeguard, run it through the question I put to leadership teams:

> "The Loop Test is three questions I ask before accepting 'a human checks it' as an answer: Would that person notice a wrong result without being told to look for it? Would they notice in time to stop it mattering? And if they missed it, could the work be put back? Oversight that survives all three is a safeguard. Oversight that fails any of them is a signature."

### 6. Decisions about people

> "An AI tool must not decide anything about a person on its own. This includes hiring, rejecting an application, promotion, pay, discipline, dismissal, rostering, and any decision about a customer's account, credit or eligibility. AI may help a person prepare, sort or summarize. The decision is made by a person who can explain it, and who can show what they considered."

This clause is doing legal work as well as ethical work. Section 80 of the [Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/section/80) replaced Article 22 of the UK GDPR with a new framework for significant decisions taken with "no meaningful human involvement". Where such a decision produces a legal effect or a similarly significant effect for someone, the controller must put safeguards in place: information about the decision, a route to make representations, a route to obtain human intervention, and a route to contest it. The simplest way for a business of 20 people to stay clear of all of that is not to let software decide about people in the first place.

### 7. Telling customers

> "[Choose one, see the decision table below.] We tell customers when AI has been used in work they receive, in the following cases: [list]. Where a client's own contract or policy requires disclosure, that comes first and you must check before the work starts."

### 8. Mistakes

> "If an AI tool gets something wrong and it reaches a customer, or if you put something into a tool that this policy says should not go in, tell [name] the same day. Nobody will be disciplined for reporting an AI mistake promptly and honestly. The purpose of this clause is to let us correct the work and fix the rule, which we cannot do if we do not know."

A policy without an amnesty clause produces silence rather than compliance. If the only thing a member of staff can do after a mistake is conceal it, that is what will happen.

### 9. Questions, ownership and review

> "[Name] owns this policy. Ask them anything, including questions you think are obvious. This policy is reviewed on [date, six months from issue] and whenever we add a tool to the approved list. Version [1.0], issued [date]."

## Which four choices can nobody make for you?

These are the clauses where the right answer depends on your business rather than on the law, and where a downloaded template usually goes wrong by answering them for you.

| Choice | Option A | Option B | What decides it |
|---|---|---|---|
| Approved tools (clause 2) | A short named list: one assistant, one meeting tool | Any tool from an approved category, checked with the owner first | A short list is easier to govern and slower to adapt. Choose the short list unless your work genuinely varies by client |
| Client data (clause 3) | Nothing identifiable goes in, ever | Identifiable data permitted only in tools covered by a business agreement, listed by name | Option B needs someone to read the contract terms. If nobody will do that this month, choose A |
| Disclosure (clause 7) | Tell customers whenever AI materially shaped the work | Publish a general statement on your website, and tell customers only when they ask or when the contract requires | Your client contracts and your sector. Professional services firms should look hard at Option A |
| Who owns it (clause 9) | The owner or managing director | A named manager, with the owner signing off changes | Whoever will actually answer the questions on a Wednesday afternoon |

**The verdict for most businesses under 50 people:** Option A, Option A, Option B, and the owner. That combination is the one a small team can hold to without anybody needing to interpret it, and it can be loosened later once you can see how AI is really being used. The hardest clause to get right is disclosure, and I have set out the full argument on [when to tell customers you use AI](https://business.theaieducator.io/posts/ai-disclosure-small-business).

## What does the law actually require of a UK small business here?

Less than most owners fear, and in a different place than they expect.

On personal data, the Information Commissioner's Office [guidance on AI and data protection](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/) applies the ordinary UK GDPR principles to AI systems: a lawful basis, transparency, accuracy, fairness, and a data protection impact assessment where the processing is high risk. The guidance carries a last-updated date of March 15, 2023 and states that it is under review following the Data (Use and Access) Act, so treat the principles as settled and the detail as moving.

On AI literacy, Article 4 of the EU AI Act has applied since February 2, 2025 and reaches providers and deployers of AI systems. The European Commission's [AI literacy questions and answers](https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers), last updated July 27, 2026, confirms that the duty is to take measures to support staff AI literacy appropriate to their knowledge and context, not to certify anyone or guarantee a level, and that after the Digital Omnibus the emphasis moved toward Commission and member state support rather than a prescriptive standard on organizations. A UK business is caught only where it places an AI system on the EU market or its output is used in the EU, which I have set out in full on [what the EU AI Act means for a small business now](https://business.theaieducator.io/posts/eu-ai-act-small-business).

Three practical consequences for the document above. Clause 3 is your data protection clause. Clause 6 is your automated decision-making clause. And the act of issuing the policy, with a named owner and a review date, is a large part of how a small business demonstrates the accountability the ICO expects, because for a business of this size there is rarely anything else written down.

## What I Tell Business Owners

The policy is not the hard part. Every owner I work with can produce one in an afternoon, and many already have a draft sitting in a folder. The hard part is that a policy only changes behavior if people can remember it without reading it.

So when a leadership team asks me to review their AI policy, the first thing I do is not read the document. I ask three people who do not sit in that room whether they know what they are allowed to use AI for. If the answers do not match, the document is not a policy yet; it is a file. The fix is almost never more clauses. It is fewer clauses, said out loud in a team meeting, by the person named in clause 9.

The second thing I look for is whether anyone has written down what staff are encouraged to do. A policy made only of prohibitions reads as a warning, and the people most likely to obey a warning are the careful ones you least needed to warn.

## What should you do this week?

1. Copy the nine clauses into a document, put your company name in, and answer the four bracketed choices using the table above. Forty minutes.
2. Name the person in clauses 2, 3, 8 and 9. One name throughout, not a committee.
3. Write the approved tool list from what people are actually using, not from what you have paid for. If you do not know, ask, and promise in advance that nobody is in trouble. That conversation is the [shadow AI](https://business.theaieducator.io/posts/shadow-ai-small-business) problem solving itself.
4. Read it out in your next team meeting, including clause 4. Ten minutes.
5. Put the review date in the calendar before you issue it.

## Where to go next

A policy tells your team what they may do. It does not tell you whether the rest of your business is ready for them to do it. If you want to see where the gaps are before you spend another quarter experimenting, the free [Workplace AI Readiness Check](https://theaieducator.io/workplace-ai-readiness?utm_source=business.theaieducator.io&utm_medium=referral&utm_campaign=uk-small-business-ai-policy-template) scores seven dimensions in about eight minutes, and the [seven dimensions of AI readiness](https://business.theaieducator.io/posts/how-ready-is-your-business-for-ai) explains what each one means.

If your team now has permission on paper but nobody has shown them how to use AI well on their own work, that gap is exactly what my [AI training for business teams](https://theaieducator.io/ai-training-for-business?utm_source=business.theaieducator.io&utm_medium=referral&utm_campaign=uk-small-business-ai-policy-template) is built for. If the harder question is governance rather than skills, that is the [AI strategy and governance](https://theaieducator.io/ai-strategy-and-governance?utm_source=business.theaieducator.io&utm_medium=referral&utm_campaign=uk-small-business-ai-policy-template) work.

## Sources and further reading

- [Artificial intelligence in UK businesses: 2023 to 2026](https://www.ons.gov.uk/businessindustryandtrade/business/businessservices/articles/artificialintelligenceinukbusinesses/2023to2026), Office for National Statistics, July 20, 2026 (reference period June 15 to 28, 2026)
- [Data (Use and Access) Act 2025, section 80](https://www.legislation.gov.uk/ukpga/2025/18/section/80), UK Parliament, 2025
- [Guidance on AI and data protection](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/), Information Commissioner's Office, last updated March 15, 2023 (under review)
- [AI literacy: questions and answers](https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers), European Commission, last updated July 27, 2026

*Dan Fitzpatrick is [The AI Educator](https://theaieducator.io/about?utm_source=business.theaieducator.io&utm_medium=referral&utm_campaign=uk-small-business-ai-policy-template): a Forbes contributor, international keynote speaker and bestselling author who helps businesses use AI well, safely and every day.*


## Frequently asked questions

### What should a small business AI policy include?

Nine things: who it applies to, which tools are approved, what must never be entered into any tool, what staff are encouraged to use AI for, who checks output before it goes out, a rule that AI never decides about a person, when customers are told, how to report a mistake, and who owns and reviews the policy.

### Is there a free AI policy template for UK small businesses?

Yes. The nine clauses in this article are written to be copied word for word into your own document, with nothing behind an email form. Replace the bracketed names and dates, answer the four marked choices, and the policy is ready to issue.

### Does a UK small business legally need an AI policy?

No single UK law requires an AI policy by name. UK GDPR duties on lawful basis, transparency, accuracy and accountability still apply to AI that touches personal data, and for a small business a written policy with a named owner is usually the clearest way to show those duties are being met.

### Can AI be used to make hiring decisions in a small business?

It should not decide. Section 80 of the Data (Use and Access) Act 2025 attaches safeguards to significant decisions taken with no meaningful human involvement, including information, representations, human intervention and a route to contest. Keeping the decision with a person who can explain it avoids all of that.

### How long should a small business AI policy be?

One page. A policy that cannot be read aloud in a team meeting will not be remembered, and a policy nobody remembers changes nothing. Depth belongs in the approved tool list and the review date, not in extra clauses.

### Who should own the AI policy in a small business?

One named person, not a committee, and whoever will actually answer questions during the working week. In most businesses under 50 people that is the owner or managing director; in larger teams it can be a manager with the owner signing off changes.

---
Source: [The AI Policy Template a UK Small Business Can Copy](https://business.theaieducator.io/posts/uk-small-business-ai-policy-template)
Publisher: [The AI Educator](https://theaieducator.io)