AI policy · UK small businesses
An AI policy your staff will actually read
If anyone in your business uses ChatGPT, Gemini or Copilot for work, it's worth having some written rules. We'll write them with you: one page, in plain English, covering the tools you use and the mistakes that cost money. £295, including a staff guide and a short briefing, usually ready within five working days.
£295
Based in Kent, working with businesses across the UK: on site in Kent, by video anywhere else.
Do you need an AI policy?
Probably. There isn't a general UK law saying you must have something called an AI policy. But UK GDPR applies to every piece of personal data your staff type into an AI tool, and without written rules nobody knows where the line is.
The risk is rarely dramatic. It's a receptionist pasting a customer's complaint, name and address included, into a chatbot to help word the reply. On personal ChatGPT plans (Free, Go, Plus and Pro), conversations may be used to train OpenAI's models unless the user switches that off. On ChatGPT Business, Claude Team, and Microsoft Copilot Chat signed in with a work account, they aren't by default. Most staff don't know the difference. A policy tells them.
What goes in it, line by line
Seven short sections. The structure stays the same; the wording is written around your business.
| Section | What it settles | An example line |
|---|---|---|
| Approved tools | Which tools, on which accounts | Use ChatGPT Business with your work login. Don't use personal accounts for work. |
| What never goes in | What stays out of every tool | No customer bank details, health information, passwords or staff HR matters, in any tool. |
| What must be checked | Who checks AI output before it goes out | Every price, date, name and figure in an AI-drafted email is checked against the job file before sending. |
| Telling customers | Honesty with customers | We don't use AI to write reviews, or to pretend to be a customer. |
| Payment checks | Protection from fake requests | Any change of bank details or urgent payment request is confirmed by phoning a number we already hold. |
| Who to ask | One named person for questions and mistakes | Not sure? Ask Sam before you paste. Made a mistake? Tell Sam the same day. |
| Review date | When it's looked at again | Reviewed every six months, or sooner if we change tools. |
It fits on one side of A4. The staff guide turns it into everyday examples.
The rules behind it, in plain English
Data protection. When staff put a customer's details into an AI tool, your business is still responsible for that information. That's why the policy names accounts, not just tools.
The regulator. The ICO's guidance on AI and data protection is under review after the Data (Use and Access) Act 2025, and on 30 September 2026 the Information Commissioner became the Information Commission (still called the ICO). A review date is how changes like these get picked up.
Fake reviews. Since April 2025 the Competition and Markets Authority can fine businesses directly for breaking consumer law, and fake reviews are banned, including ones generated by software to look like real customers'.
Payments. AI makes fake emails and cloned voices more convincing. UK Finance recorded £41.3m lost to invoice and mandate scams in 2025, and CEO fraud cases averaged just over £28,000 each. A call-back rule costs nothing. More in scam and deepfake training for staff.
What you get for £295
- A one-hour callBy video, or at your premises in Canterbury, Whitstable, Herne Bay, Faversham or Thanet, going through your tools and how staff use them.
- The one-page policyThe seven sections above, written for your business and your tools, as an editable document you own.
- A one-page staff guideThe same rules as everyday examples, including what to do after a mistake.
- A 30-minute staff briefing by videoWe talk your team through it and answer questions.
- Usually within five working daysFrom the call to the finished documents. Cancel before the call for a full refund.
Writing it yourself
You can. My handbook, Getting Started with AI, Safely (£39.99), includes a one-page AI policy template among its 14 templates. For a sole trader, or two people using the same tool, that may be enough. My free guide, Is ChatGPT safe? Ten answers, covers the settings side.
A template's weak spot is the detail: which of your systems hold personal data, what staff already do, which accounts you pay for. And long templates written for big companies rarely get read in a five-person firm.
This is a practical workplace policy, not legal advice, and we're not solicitors. In a regulated profession such as law, accountancy or financial services, check it against your regulator's guidance and take legal advice where needed. For a wider look first, try the AI readiness review.
Questions people ask
Do we need an AI policy for a small business?
If anyone uses AI tools for work, even occasionally, yes. One page is enough to set out which tools are allowed and what stays out of them.
Is an AI policy a legal requirement in the UK?
There's no general requirement for a document with that name. But UK GDPR applies to personal data entered into AI tools, and a written policy shows you're handling it responsibly.
What should an AI acceptable use policy include?
Approved tools and accounts, what must never be entered, what a person checks, honesty with customers, a payment check rule, who to ask, and a review date.
What happens if an employee puts client data into ChatGPT?
Find out what was shared and on which account. On a personal plan it may be kept and, unless training was off, used to train models, so take advice on whether it's a data breach. The policy says who to tell.
Can we just ban AI tools instead?
You can, but a ban is hard to check and easy to ignore on a phone. Naming one approved tool on a business account usually works better.
How often should an AI policy be reviewed?
Every six months, and whenever you add a tool. Products change fast: OpenAI is retiring custom GPTs, starting with Enterprise in December 2026.
Who you'll work with
James Hayes Consulting is led by Ross Hayes, who builds software for his own businesses and uses AI tools in them every day. We set AI up on your real work, explain it in plain English, and tell you straight if something isn’t worth paying for.
Every project starts with a free 15-minute call, and prices are agreed in writing before you commit.
You might also like
AI audit and readiness review
£395 · half a day
Half a day looking at your jobs, software and data, with three quick wins set up and a written plan. Starts with a self-check you can do now.
Find out moreAI training for your staff
£195 to £795
Three ways to train your team on the AI tools you already pay for: a staff briefing, a hands-on workshop day, or coaching for owners.
Find out moreAI scam and deepfake training for staff
£295
A calm 90-minute session on cloned voices, deepfake calls and fake bank-detail changes, ending with a written payment-check rule. £295.
Find out more