Guides · Updated 2026-10-14

One-page AI policy template for UK small businesses

If you or your staff use ChatGPT, Claude, Gemini or Copilot for work, it's worth writing down a few rules. The question we see most from small businesses is simple: is it safe to put customer details into ChatGPT? A one-page policy answers that for everyone, and shows you've thought about it if a customer or the regulator ever asks.

The template below is a starting point, not legal advice. The UK's data regulator, the Information Commissioner's Office (ICO), publishes guidance on AI and data protection covering accountability, transparency, lawfulness and fairness. If you use AI to make decisions about people, such as hiring, read that guidance or take advice.

How to use this template

1. Copy the text below into a document.
2. Replace the [brackets] with your details.
3. Delete anything that doesn't apply.
4. Share it with staff and ask them to confirm they've read it.
5. Review it every six months, because the tools change quickly.

The template

[Business name] AI policy

Last updated: [date]. Owner: [name].

>

1. Approved tools. Staff may use these AI tools for work: [for example ChatGPT, Microsoft 365 Copilot]. Ask [owner] before using any other AI tool, app or browser extension for work.

>

2. Accounts. Use a work account where we provide one. [If relevant: switch off the setting that lets the provider use your chats to train its models.]

>

3. Never put these into an AI tool:

- customers' names, addresses, phone numbers or email addresses, unless the tool is approved for this

- bank, card or payment details

- health information or anything about a person's private life

- passwords, access codes or alarm codes

- anything we've agreed to keep confidential

>

Use placeholders instead, such as [Customer] or [Address].

>

4. Check everything. AI can be wrong while sounding certain. Read and check every AI draft before it goes to a customer, supplier or anyone outside the business. Check prices, dates, figures and anything legal or safety-related against the original source.

>

5. Decisions about people. Don't use AI alone to make decisions about customers or staff, such as hiring, pay or refusing a service. A person makes the decision.

>

6. Be honest. Don't present AI-written reviews, testimonials or photos as real. Tell customers if they're talking to an AI system when they ask.

>

7. Copyright. Don't paste in other people's work to copy it, and check that images you create are allowed for business use under the tool's terms.

>

8. Problems. If you think personal data has gone into the wrong tool, tell [owner] the same day so we can decide what to do.

>

Questions about this policy: [owner, contact].

Things to do alongside the policy

• Update your privacy notice if you use AI tools that process customer data, such as an AI receptionist or meeting recorder.
• Check each tool's data settings. Business plans often give you more control than free personal accounts.
• Keep a short list of which tools you use and what for. That is useful evidence of accountability under UK GDPR.

FAQ

Is it legal to use ChatGPT in a UK business?

Yes. UK GDPR still applies to any personal data you put into it, so the safest habit is to leave personal details out or use placeholders.

Do I need a data protection impact assessment?

The ICO's guidance says to consider one for AI uses that are likely to be high risk to people. Drafting a social post usually isn't; screening job applicants with AI may be.

Do sole traders need an AI policy?

It's less important if you're the only person using the tools, but writing down rule 3 (what never goes in) is still a good habit.