Home › Answers › Data, privacy and GDPR
Does my small business need an AI policy?
Short answer
There's no UK law that says every small business must have an AI policy. But if anyone besides you uses AI for work, a one-page policy is the quickest way to stop customer data ending up in the wrong tool and AI mistakes reaching customers. Even a sole trader benefits from writing down three or four rules.
When it matters most
- You employ staff or use subcontractors who write to customers
- You handle personal data (customer records, call recordings, CVs)
- You work in a regulated area (finance, health, legal, childcare)
- A client or main contractor asks how you use AI
What to put in a one-page policy
- Approved tools. Which AI tools staff may use, and on which accounts.
- Data rules. No customer names, addresses, bank details or health information in consumer AI tools; use placeholders. See can I put customer data into ChatGPT?
- Checking. A person reads and checks anything AI drafts before it goes out.
- No decisions about people. AI doesn't decide hiring, discipline, refunds or credit on its own.
- Settings. Model training switched off; two-factor authentication on.
- Honesty. No fake reviews, no AI photos passed off as real work.
- Who to ask. One named person for questions and for reporting a mistake.
Our AI policy template for UK small businesses has wording you can adapt.
Why it's worth twenty minutes
A policy turns "be careful with AI" into rules people can follow. It also helps you answer GDPR questions and shows customers you've thought about it.
Related questions
Does the EU AI Act require an AI policy?
The EU AI Act includes an AI literacy duty for providers and deployers of AI systems where it applies. A short policy and basic training is a sensible way to show it. Most UK sole traders aren't caught, but check if you sell into the EU.
Should the policy mention specific tools?
Yes. Naming approved tools and accounts is clearer than a general rule.
Sources
Checked 17 October 2026. Rules and prices change, so check the source before you rely on it. This is general information, not legal, tax or financial advice.
More on data, privacy and gdpr
- Are AI detection tools accurate?
- Are AI tools secure for business?
- Are ChatGPT chats private? Can OpenAI read them?
- Are Microsoft Copilot chats private?
- Can AI agents be trusted?
- Can I put customer data into ChatGPT?
All data, privacy and gdpr answers · All answers · Guides · AI tools directory
Get one useful AI tool in your inbox each weekday
Free, plain English, five minutes to read. Unsubscribe any time.
See our privacy notice.