The short answer
A good AI usage policy for a small business fits on one page. It names the tools staff can use, lists what must never be pasted in, such as client data or anything confidential, requires a human to check AI output before it goes out, and says who to ask when unsure. You can copy the template below and adapt it in an afternoon.
Most AI policy templates you find online are written for large enterprises, run to twenty pages, and quietly terrify a five-person business. You do not need that. You need something short enough that everyone reads it and clear enough that everyone follows it.
Only 31 percent of UK employers have a formal AI policy, according to the CIPD, while staff use the tools daily. If you get a simple one in place, you are already ahead of two thirds of the market. Here is a template built for a small UK business. Copy it, change the bits in brackets, and you are most of the way there.
The one-page AI usage policy template
1. Purpose
[Company name] encourages the responsible use of AI tools to do better work, faster. This policy sets out how we use them safely. It applies to everyone, including contractors.
2. Approved tools
You may use [e.g. ChatGPT Team, Microsoft Copilot, Claude] for work, on your [company] account only. Do not use personal free accounts for company work, and check with [name] before using any tool not on this list.
3. What you must never put into an AI tool
Never paste in client or customer personal data, anything under a confidentiality agreement, login details or passwords, financial account details, or anything commercially sensitive that we would not want a competitor to read. If in doubt, leave it out.
4. Always check the output
AI can be confidently wrong. You are responsible for anything you produce with its help. Check facts, figures, names and quotes before anything goes to a client or the public.
5. Be transparent
Use judgement about telling clients when AI has played a meaningful part in work we deliver. Never present AI-generated material as something it is not.
6. Data and clients
Only use approved, paid business tools for anything involving client information, and only where the tool does not train on our data. When unsure whether a tool is safe for client work, ask [name] first.
7. Who to ask
[Name, role] owns this policy. Bring them any question you are not sure about. Asking is always the right call. We review this policy every [quarter].
What to change for your business
The brackets are the work. Name your real approved tools and the accounts they run on. If you handle health, legal or financial data, tighten section 3 and take advice on your sector rules. If you are a regulated firm, add a line pointing to the specific regulator guidance that applies to you.
How to roll it out so it sticks
A policy nobody reads changes nothing. Share it in a short team session rather than a silent email. Walk through section 3 with a couple of real examples from your own work. Put it somewhere people can find it in five seconds. Then, once it is agreed, pair it with a bit of hands-on training so people know not just what they cannot do, but what they very much can.
The three clauses businesses get wrong
Most one-page policies fail in the same three places. They are easy to fix once you can see them.
The blanket ban. "Staff must not use AI tools for work purposes." It feels safe and it is the least safe option available, because it drives use underground. People still have deadlines, the tools are still one tab away, and now nobody will tell you what they are doing. If you genuinely need to prohibit something, prohibit it narrowly — specific data, specific tasks — and say what people should do instead.
"Use common sense." This appears in an enormous number of policies and it does no work at all. Common sense does not tell a junior member of staff whether a client's name in a redraft request counts as personal data. Replace it with categories concrete enough to act on: what is fine, what never goes in, and who to ask when it is not obvious. Ambiguity resolved by the most junior person in the room is not a control.
No named person. Policies that say "management" or "the business" will decide things have not decided anything. Name a role and ideally a person: who approves a new tool, who answers the "is this allowed?" question, who reviews the document. If the answer takes more than a day to obtain, people will stop asking.
Wiring it into how you actually work
A policy that lives only in a shared drive is a policy nobody follows. Four small mechanical steps make the difference, and none of them take long.
Put it in induction. New starters get it in week one, alongside the other things they sign. Fifteen minutes with a real example beats a document they skim.
Keep the approved tool list somewhere current and visible. Not inside the policy PDF, which you will not want to reissue every time something changes, but a short living list in whatever your team actually reads — the intranet page, the pinned message, the shared doc. Date it.
Make asking easy. One named channel for "can I use this for that?", answered quickly and without eye-rolling. Most policy breaches are not defiance; they are someone who could not find out in time.
Say something when the tools change. A two-line note when a major tool adds a feature that affects your rules keeps the policy alive in people's minds and stops it dating quietly.
Reviewing it without rewriting it
Annual reviews of AI policies made sense when nothing moved. Twice a year is more realistic now, and the review should take half an hour rather than a fortnight, because you are checking a short list rather than starting again.
Work through five questions. Are the tools named in the policy still the tools we use? Has anything changed about what those tools do with our data — new settings, new terms, a new enterprise tier? Have we had any incidents, near misses or awkward questions worth turning into a rule? Do the people who joined since the last review know the rules? Is the named owner still in the role?
Change only what the answers demand, and record the date you checked even when nothing changed. That last habit is worth more than it looks: it demonstrates active governance rather than a document written once and forgotten, which is exactly the distinction a customer or an auditor is trying to draw.
AI Usage Policy for Small Businesses – frequently asked questions
What should be in an AI usage policy?
Purpose, approved tools, what must never be entered, a requirement to check output, rules on transparency, data and client handling, and one named owner with a review date. The template above covers all of these on a single page.
Is there a free AI policy template?
Yes. The seven-section template on this page is free to copy and adapt. Fill in the bracketed details with your real tools, contacts and sector rules, and you have a working policy.
What should employees never put into AI tools?
Client or customer personal data, anything confidential or under NDA, passwords and login details, financial account numbers, and anything commercially sensitive. The rule of thumb: if you would not email it to a stranger, do not paste it into a tool.
How do we get staff to follow the AI policy?
Involve a couple of them in writing it, launch it in a short session rather than a silent email, use real examples, and pair it with hands-on training so people know what they are allowed to do, not only what they are not.
How often should we update our AI policy?
Review it every quarter. AI tools change quickly, and a policy that named last year's tools loses authority fast. A short quarterly check keeps it credible.
Should our policy just ban AI tools altogether?
It is the most common mistake. A blanket ban does not stop use, it hides it — people still have deadlines and the tools are a browser tab away, but now nobody will tell you what they are doing. Prohibit narrowly and specifically where you must, say what staff should do instead, and approve at least one tool for general work so there is a legitimate route.
How often should we review an AI usage policy?
Twice a year suits most small businesses, with a short check rather than a rewrite: are the named tools still the ones we use, has anything changed in how they handle our data, have we had incidents worth turning into rules, do new starters know the rules, and is the owner still in post. Record the date you reviewed it even when nothing changed.
Who should own the AI policy in a small business?
One named person with the authority to approve a tool and answer questions quickly — often an operations lead, practice manager or the owner in a very small firm. Avoid assigning it to 'management' collectively, which means nobody. If a member of staff cannot get a yes or no within a day, they will make the decision themselves.
Which Oxford AI School training fits this need?
Get the template turned into your policy, agreed with your team and paired with practical training. In person or live online.
Want this done for your business, properly?
Our AI Policy Workshop turns this template into your policy, agreed with your team and paired with the practical habits that make it work. Half a day, jargon free.
Book the AI Policy Workshop Do you need a policy?
Harry Lang runs The Oxford AI School, teaching teams and businesses the basics of AI in a fun, easy and practical way. A marketing leader turned AI trainer, he can be reached at Learn@TheOxfordAISchool.com.