The AI Barn

How to write an AI usage policy for a small UK team (with a template outline)

By Rob Falconer Published Updated

How this guide works: it’s based on guidance from the ICO, the National Cyber Security Centre (NCSC) and the CMA, checked 24 October 2026. It’s a starting point you adapt, not legal advice. If you handle sensitive data such as health or financial information, get professional advice on your policy. None of the links on this page are affiliate links.

Why a small team needs one

If your staff are using AI at work, and most probably are, you already have an AI policy. It’s just unwritten. Each person decides for themselves which tool to use and what to paste into it.

The NCSC calls this “shadow AI”: AI tools used for work that the organisation hasn’t approved. In a September 2026 blog it warns that this can expose sensitive information, lose you visibility and control of where your data goes, and create new openings for attackers. Its advice isn’t to ban AI, but to understand why people use it, offer approved alternatives and encourage open conversation (NCSC, The hidden risks of shadow AI, 7 September 2026).

A short written policy does that. It doesn’t need to be long. One or two pages that people actually read beats a 20-page document nobody opens.

The risks your policy should cover

  • Data leaks. Pasting customer details, contracts or financial information into a personal AI account can put it outside your control. On some personal plans, chats may be used to train models unless the user switches that off.
  • Wrong answers. The NCSC’s guidance on AI and cyber security notes that AI tools can “hallucinate”, presenting incorrect information as fact, and can reflect bias in their training data (NCSC, AI and cyber security: what you need to know).
  • Manipulation. The same NCSC guidance explains prompt injection, where hidden instructions in a document, email or web page trick an AI tool into doing something it shouldn’t. This matters more as tools gain access to your email and files.
  • Customer-facing mistakes. The CMA says businesses are responsible for what their AI agents tell customers, as they would be for staff (CMA guidance, 9 March 2026).
  • Data protection. Using personal data in AI tools is covered by UK GDPR: you need a lawful basis, transparency and appropriate security (ICO guidance on AI and data protection).

Template outline: what to put in each section

Copy these headings and write a few lines under each in your own words.

1. Purpose and scope

One paragraph: why the policy exists, who it covers (staff, contractors, anyone working on your behalf) and that it applies to any AI tool used for work, on any device.

2. Approved tools

List the tools people may use for work, and which account to use. Business versions usually have stronger data terms. For example, Microsoft says prompts and responses in Microsoft 365 Copilot aren’t used to train the underlying models, and Google says Workspace business content isn’t used to train generative AI models outside your domain without permission (see our Copilot vs Gemini comparison). Say how someone can ask for a new tool to be approved.

3. Information that must never go into an AI tool

Be specific. A typical list: customer and staff personal data (unless the tool is approved for it); special category data such as health information; passwords, bank details and card numbers; confidential client documents; and anything covered by a non-disclosure agreement.

4. Checking AI output

Make a person responsible for anything AI helped produce. Facts, figures, prices, legal or tax statements, and anything sent to a customer must be checked before use. The ICO’s own privacy notice for its use of Microsoft 365 Copilot is a useful model: it says no decision affecting a customer is taken based solely on Copilot output, and its policy and training require human oversight to verify outputs (ICO, Microsoft 365 Copilot privacy notice).

5. Decisions about people

State that AI won’t be used to make decisions about customers or staff, such as hiring, discipline, credit or refunds, without meaningful human review. If you plan to do this, you’ll likely need a data protection impact assessment first; the ICO’s AI guidance explains when.

6. Telling customers

Say when customers will be told that AI is involved, for example in a website chatbot. The CMA expects businesses to be clear when customers are dealing with AI if that could affect their decisions. Update your privacy notice if AI tools process customers’ personal data. Our AI chatbots guide covers this.

7. Marketing and content

No AI-generated reviews or testimonials, which are banned under consumer law; no AI images that could mislead customers about your products or work; and copy checked for accuracy before publishing. See our social media guide for the ASA rules.

8. Copyright and confidentiality

Don’t ask AI to copy other people’s work or imitate brands. The UK government’s March 2026 Report on Copyright and Artificial Intelligence notes that the law on purely computer-generated works is uncertain, so treat important creative work as needing real human input (GOV.UK).

9. Security

Use business accounts with two-step verification, don’t connect AI tools to email or file storage without approval, and report anything odd, such as an AI tool behaving unexpectedly after opening a document or link.

10. Reporting problems

Who to tell if something goes wrong, such as personal data pasted into the wrong tool. Make it clear people won’t be blamed for reporting honestly; the NCSC stresses that open reporting culture helps. Remember that some personal data breaches must be reported to the ICO within 72 hours.

11. Owner and review date

Name the person responsible for the policy and set a review date, such as every six months. AI tools and their terms change quickly.

Rolling it out

  1. Ask first. Find out which tools people already use and why. The NCSC’s point is that understanding the reasons helps you offer something better.
  2. Pick approved tools that meet those needs, ideally business versions with clear data terms.
  3. Write the policy using the outline above, in plain English.
  4. Walk through it with the team in a short meeting, with real examples from your business.
  5. Review it on the date you set, and whenever you add a new tool.

For the data protection side in more depth, read AI and UK GDPR for small businesses. For tools and prices, see AI tools for UK small businesses.

FAQ

Do small businesses legally need an AI policy?

There isn’t a specific UK law requiring one. But UK GDPR requires appropriate measures to protect personal data, and consumer law makes you responsible for what your AI tells customers. A written policy is a simple way to show you’ve thought about both.

Should we just ban AI tools?

The NCSC says it isn’t recommending that people stop using AI. Its shadow AI blog warns that where policies can’t meet business needs, staff are likely to keep using unapproved tools, and recommends providing secure, approved alternatives instead.

How long should the policy be?

Short enough that people read it. One or two pages, with clear examples, works for most small teams.

Sources

All checked 24 October 2026 unless stated. Prices change, so check before you buy.

  • NCSC, The hidden risks of shadow AI (7 September 2026): ncsc.gov.uk
  • NCSC, AI and cyber security: what you need to know: ncsc.gov.uk
  • ICO, Guidance on AI and data protection: ico.org.uk
  • ICO, Microsoft 365 Copilot privacy notice: ico.org.uk
  • ICO, Personal data breaches: a guide: ico.org.uk
  • CMA, Complying with consumer law when using AI agents (9 March 2026): gov.uk
  • GOV.UK, Report on Copyright and Artificial Intelligence (18 March 2026): gov.uk
  • Microsoft Copilot business pricing and data protection FAQ (UK): microsoft.com/en-gb
  • Generative AI in Google Workspace Privacy Hub: knowledge.workspace.google.com

Get new guides by email

New guides, UK price changes and reality checks on AI tools, sent when there’s something worth reading.

Sign up to the newsletter