The short answer
Yes, almost certainly. If your staff use ChatGPT, Copilot or any AI tool for work, you need a short policy that says which tools are approved, what data must never go into them, and who to ask when unsure. It does not need to be long. One page in plain English beats a forty-page document nobody reads.
Here is the uncomfortable part. Your staff are probably using AI already, and most of them have not asked. McKinsey found the share of employees using AI at work jumped from 30 percent in 2023 to 76 percent in 2025. Meanwhile the CIPD found only 31 percent of UK employers have a formal AI policy. That gap, between what people are doing and what you have agreed they can do, is exactly where the risk lives.
An AI policy is not about slowing your team down. It is about giving them permission to use AI with confidence, and drawing a clear line around the few things that could genuinely hurt you.
Do you actually need one?
Ask yourself one question: could someone on my team paste a customer's details, a contract, or something commercially sensitive into a free AI tool this afternoon? If the answer is yes, and for almost every business it is, you need a policy. Not because your people are careless, but because nobody has told them where the line is.
This is often called shadow AI. Quiet, well-meaning use that nobody signed off and nobody can see. A policy turns it into something open and safe.
What happens without one?
The failures are predictable. Confidential client data ends up training a model you do not control. A confident, wrong answer goes out in an email over your letterhead. Two people use two different tools and produce work that contradicts itself. And when something does go wrong, there is no agreed standard to point to, which makes it far harder to deal with fairly.
What should an AI policy cover?
A good policy is short and specific. These are the points worth nailing down:-
The seven things a good AI policy settles
- Approved tools. Which AI tools are signed off, and on which accounts (a paid business plan behaves very differently from a free one).
- What must never go in. Client data, personal data, anything under NDA, anything you would not email to a stranger.
- The human check. A person is responsible for anything AI helps produce before it leaves the building.
- Transparency. When and how you tell clients or colleagues that AI was involved.
- Ownership and accuracy. Who owns AI-assisted work, and who is accountable if it is wrong.
- Who to ask. One named person for the grey-area questions.
- Review date. When you will look at it again, because the tools move fast.
Isn't the law enough?
No. UK data protection law, the pending rules around AI, and the EU AI Act where it reaches UK firms all set the legal floor. Your policy is the house rules on top of that. The UK has taken a lighter, pro-innovation line rather than a single AI statute, which means the responsibility to set sensible internal standards sits squarely with you. A policy is how you meet it.
How long should it be, and who writes it?
One page. Plain English. Written with a couple of the people who actually use the tools, not just handed down from on high, because a policy your team helped shape is a policy your team will follow. Review it every quarter. That is the whole job.
Four triggers that mean you need one now
"Eventually" is the honest answer for a lot of businesses. But there are four situations where the question stops being a judgement call, and it is worth checking whether any already apply to you.
A customer or contract asks for it. This is now the most common trigger, and it arrives without warning. Enterprise procurement questionnaires, public sector tenders and supplier assurance packs increasingly include a question about AI governance. If you cannot point to a document, you either lose marks or lose the bid, and writing one under deadline pressure produces a worse policy than writing one calmly.
Your staff are handling other people's personal data. If your team works with client records, patient information, employee files or anything about identifiable individuals, the gap between what people are doing with AI tools and what you have agreed they may do is a live UK GDPR exposure rather than a theoretical one.
You are in a regulated sector. Financial advice, law, healthcare, education, insurance. Your regulator's existing rules on competence, record-keeping and client care already cover AI use, whether or not they mention it by name. A policy is how you demonstrate you have thought about it.
You have discovered someone already using it. Not hypothetically — actually found out. At that point you have shadow adoption, and a policy written afterwards is far easier than a conversation about something that has already gone wrong.
What a policy will not do for you
It is worth being clear about the limits, because policies are sometimes treated as the whole answer and they are closer to a quarter of it.
A policy does not stop anybody doing anything. It has no technical force. If a tool is accessible in a browser and someone is under pressure, the document in the shared drive will not intervene. Technical controls do that, and for most small businesses there are fewer of those available than they would like.
A policy does not create competence. Telling people what they may not paste into a chatbot leaves them no better at using the tools well, and a team that is forbidden from the risky things but never taught the useful ones has absorbed all the cost of AI adoption and none of the benefit. This is the most common pattern we see, and it is why policy and training belong together rather than in sequence.
A policy does not survive being written once. The tools change every few months, and a document referring to capabilities and settings that no longer exist quietly loses authority with the people meant to follow it.
What a policy does do is decide things in advance, in daylight, so that nobody has to improvise — and give you something to point at when a customer, an auditor or an insurer asks.
Signs the policy you already have is not working
Plenty of businesses have a policy and still have the problem. The symptoms are fairly consistent.
Nobody can tell you what is in it. Ask three people what tools are approved. If you get three answers, the document exists but the policy does not.
It says "use your judgement" about data. That is not guidance, it is a transfer of risk onto people who have not been given the information to carry it. Staff need concrete categories: this is fine, this never goes in, ask if unsure.
It bans tools people are visibly using. A prohibition everyone quietly ignores is worse than no rule, because it teaches the team that the whole document is decorative.
It has no named owner and no review date. Unowned policies rot. One person, one date in the diary, one short review.
Do You Need an AI Policy? – frequently asked questions
Do we legally need an AI policy in the UK?
There is no single UK law that says you must have one. But data protection law, employment law and consumer law all still apply to AI use, and a policy is how you show you are managing those responsibilities sensibly. In practice, any business whose staff use AI needs one.
What should an AI policy include?
Approved tools, what data must never be entered, a requirement for a human to check output, rules on transparency, who owns AI-assisted work, one named person for questions, and a review date. Keep it to a page.
How long should an AI policy be?
One page is ideal. A short, clear policy that people read and follow beats a long legal document that sits unread in a shared drive. You can always link out to more detail where it is genuinely needed.
Who should own the AI policy?
Someone senior enough to make the call, usually an owner, operations lead or head of a function, with input from the people who actually use the tools. Name one person staff can go to with grey-area questions.
Do small businesses need an AI policy?
Yes. Small teams often have less oversight, not more, so a clear line on what is safe matters just as much. The good news is a small business policy can be genuinely short.
Does the EU AI Act apply to UK companies?
It can, if you offer AI-driven products or services to people in the EU, or your systems are used there. Most UK small businesses are more affected by UK data protection rules day to day, but the EU AI Act is worth checking if you trade into Europe.
Will customers or tenders ask whether we have an AI policy?
Increasingly, yes — and this is now the most common reason small businesses write one. Procurement questionnaires, public sector tenders and supplier assurance reviews have started including questions about AI governance and data handling. Having a short, genuine policy ready is far easier than producing one against a bid deadline.
Is an AI policy enough on its own?
No. A policy decides things in advance and gives you something to show when asked, but it has no technical force and it does not make anyone better at using the tools. Pair it with training, so the team knows both what the rules are and how to get real value inside them. A policy without training tends to deliver all the caution and none of the benefit.
How do we know if our existing AI policy is working?
Ask three people which AI tools are approved and what data must never go into them. If you get three different answers, you have a document rather than a policy. Other warning signs: it tells staff to 'use their judgement' about data, it bans tools people are visibly still using, or it has no named owner and no review date.
Which Oxford AI School training fits this need?
Turn the answer into a policy your team will follow, then build the habits behind it. Available in Oxfordshire, London, across the UK and online.
Want a policy your team will actually use?
Our AI Policy Workshop helps UK teams agree a clear, one-page policy and the practical habits behind it, in a single half-day session. No jargon, no box-ticking.
Book the AI Policy Workshop Training for your team
Harry Lang runs The Oxford AI School, teaching teams and businesses the basics of AI in a fun, easy and practical way. A marketing leader turned AI trainer, he can be reached at Learn@TheOxfordAISchool.com.