Free AI Acceptable Use Policy Template for UK Small Businesses (2026)

1. Purpose of this policy

[Company Name] encourages the safe, practical use of artificial intelligence (AI) to reduce repetitive administrative work. However, unapproved consumer AI tools pose serious risks to client confidentiality, UK GDPR compliance and professional accuracy. This policy sets out which AI tools staff may use, what data may never be entered into unapproved tools, and how AI outputs must be checked.

2. Approved AI tools only (No “Shadow AI”)

Staff may only use AI tools that have been formally approved by the Managing Partner / IT Lead and covered by a business Data Processing Agreement (DPA) where data is not used to train public models.

• Approved business tools: Microsoft 365 Copilot (signed in with your work account) and Claude for Work.
• Prohibited for client or personal data: Free or personal accounts on ChatGPT, Claude, Gemini, DeepSeek, Grammarly, Otter.ai or unverified browser extensions.

3. What you must never put into an unapproved AI tool

You must never type, paste or upload any of the following into a personal or non-approved AI tool:

• Client names, addresses, emails, phone numbers, matter references or financial details
• Special category personal data under UK GDPR (health, medical, biometric or criminal offence data)
• Employee HR records, payroll data or confidential commercial contracts
• Passwords, API keys or internal system credentials

4. Mandatory human review (“Human in the Loop”)

AI tools can produce plausible-sounding errors, fabricated citations or outdated figures (AI hallucinations). At [Company Name]:

• Every AI-drafted email, letter, report, minute or calculation must be read and verified by a qualified member of staff before it is sent to a client, filed on a matter, or relied upon internally.
• You remain personally responsible for the accuracy and tone of any work you send out, whether or not AI helped draft it.

5. Meeting recording and transcription

Do not invite third-party AI meeting bots (such as Read.ai, Fireflies or Otter) into Microsoft Teams or Zoom calls without approval. Only approved recording workflows configured by [Company Name] may be used, and participants must be informed before recording begins.

6. Requesting a new AI tool or workflow automation

If you spot a repetitive task that could be automated or want to test a new AI tool, speak to the Managing Partner / IT Lead first so it can be assessed for data protection and security before any live data is used.