Picture it: it’s Friday afternoon, and a member of your team has a long customer email to answer. They paste it into a free AI tool to save time. The reply comes back sounding great, and nobody thinks any more about it.
Nothing obviously went wrong. But that email held a customer’s name, address and a complaint, and it now sits in a free account your business can’t see or control. That’s the gap an AI policy closes.
The good news is that it doesn’t need to be long or complicated. If anyone on your team uses AI and handles customer, staff or financial information, a single clear page will do the job.
Why banning AI doesn’t work
Many owners respond by saying “no AI at work.” Staff tend to carry on, just on personal phones where you can’t see it. Without written guidance, your real policy is whatever each person decides on the day.
It’s an understandable muddle. Only 19% of small business owners say they’re very confident using AI day to day, and 46% of small firms say they lack the knowledge to use it well. A short, sensible policy takes the guesswork out and keeps the benefits.
What the law says, in plain English
If anyone puts personal data into an AI tool, UK GDPR applies, and your business is responsible for it, not the AI provider. There’s no separate UK AI Act. Existing data protection rules still apply to AI.
Three questions to ask before anyone pastes anything
- Is it personal or confidential? Names, contact details, contracts, prices, financial records and anything under an NDA stay out.
- Is this an approved tool and account? A business account with clear data terms is a very different risk from a free personal one.
- Will a person check the answer? AI can sound confident and still be wrong, so nothing goes out unchecked.
Sort your data into three piles
- Public: already on your website or in your marketing. Fine to use with AI.
- Internal: everyday information that isn’t secret. Use only in approved tools.
- Confidential: customer personal data, contracts, pricing and financials. Keep it out of AI tools unless you’ve checked the provider’s terms.
What a good one-page policy covers
- Approved tools: which ones, and which type of account.
- Never-enter data: the confidential pile above.
- Checking the output: a person reviews anything before it’s sent or published.
- Being open with customers: decide when you’ll tell them AI played a part.
- Who owns it: one named person to ask when staff are unsure.
- When it’s reviewed: AI moves fast, so put a date in the diary.
Write it in plain English. If a new starter can’t read it in two minutes, it’s too long.
A starter policy you can copy
- We only use these approved AI tools: [list].
- We never enter customer personal data, contracts, pricing or financials.
- We check everything AI produces before it leaves the business.
- We tell customers when AI has played a significant part in what they receive.
- [Name] answers questions and reviews this policy every six months.
Five minutes to start today
- Ask your team which AI tools they already use. No blame, you’re just gathering facts.
- Decide which of those you’ll approve.
- List what must never go in.
- Name one person to answer questions.
- Put a review date in the diary.
Keep an eye on the rules
The ICO is still updating its AI and data protection guidance following the Data (Use and Access) Act 2025, so check ico.org.uk when you write or review your policy. This article is general information, not legal advice.
FAQs
Does a business with two or three staff need an AI policy?
If anyone handles customer or financial information and uses an AI tool, yes. It can be a few lines.
Can staff use ChatGPT for work?
Yes, if the tool and account are approved and no confidential or personal data goes in.
Who’s responsible if AI gets something wrong?
The business. That’s why a person always checks the output.
How often should we review the policy?
At least every six months, or whenever you start using a new tool.
Need a hand?
If your team handles a lot of customer data, or you’d like training so the policy actually sticks, DotScott helps Essex businesses put a practical AI policy in place in plain English.