An AI policy for a small business: what to include (free template)

A small business AI policy is a short document that tells your team which AI tools they may use for work, what information must never go into them, how to check what AI produces and who to ask when they’re unsure. Two pages is enough. Below we explain what to include, then give you a template you can copy and adapt today.

Why a small firm needs one now

Free AI chatbots are a browser tab away, so it’s safest to assume some of your team already use them for work, whether or not anyone has said they can. Usually it’s with good intentions: tidying an email, summarising a long document, drafting a letter. The risk is what goes in. Paste a client’s email into a free chatbot on a personal account and that client’s information has left your control, and it may be used to train the provider’s models. Unapproved use like this is often called shadow AI.

Banning AI rarely works. People find it useful, and a ban just pushes it out of sight. A policy does better: it gives people approved tools and clear rules, so the useful work carries on safely. The National Cyber Security Centre advises against putting sensitive information into public AI tools, and both the Solicitors Regulation Authority and ICAEW have warned that entering client information into them can breach client confidentiality.

What your AI policy should cover

1. Approved tools. A short list of the AI tools staff may use for work, signed in with work accounts. Anything else needs approval first. Business versions are different from consumer ones: they’re normally covered by a data processing agreement, and the major providers say they don’t train their models on business customers’ data by default. If you’re choosing between the main options, see our Copilot and ChatGPT comparison.
2. What must never go into AI tools. Be specific. Client and personal information, financial details, passwords and anything confidential should never go into a tool that isn’t approved. Decide too what may go into approved tools, and whether anything stays out altogether, such as health information.
3. Checking AI output. AI can be confidently wrong, a problem known as hallucination. Anything going to a client, a regulator or into your records should be checked by someone who knows the subject, and whoever sends it is responsible for it.
4. Telling clients where relevant. Decide when clients should know AI was involved, for example when it summarises their calls or helps draft their documents, and make sure your privacy notice covers it.
5. Who to ask. Name one person who approves new tools, answers questions and hears about mistakes, such as client data pasted into the wrong place.
6. Training. A short session when someone joins and whenever the policy changes, so people know the rules and how to use the approved tools well.
7. A review date. AI tools change every few months. Review the policy at least once a year and whenever you add a tool.

Keep it to two pages

A policy nobody reads protects nobody. Write it in plain English, keep each rule short enough to remember, and put the detail (which tool for which job, which settings to use) in a separate how-to sheet you can update without rewriting the policy. Law firms and accountancy practices should also check it against their regulator’s guidance and their client engagement terms.

Free template: AI safe-use policy

Copy the sections below into your own document and replace everything in square brackets. It’s a starting point, not legal advice, so adapt it to how your firm actually works.

1. Purpose and scope

1. This policy explains how everyone who works for [Firm name], including partners, employees, contractors and temporary staff, may use artificial intelligence (AI) tools for work.
2. It applies on any device, including personal phones and home computers, whenever the work is for [Firm name].

2. Approved tools

1. You may use only these AI tools for work: [list each tool, for example Microsoft Copilot Chat signed in with your work account].
2. Always sign in with your [Firm name] account. Never use a personal account for work.
3. Ask [name or role] before using any other AI tool, including new AI features in software we already use. We will check how it handles our data before approving it.

3. Information you must never put into AI tools

1. Never put any of the following into an AI tool that is not on the approved list: client or customer information, personal information about anyone, financial or bank details, passwords or security information, or anything confidential to [Firm name] or its clients.
2. In approved tools, use only the information the task needs. Do not enter health information or other highly sensitive information about anyone without approval from [name or role].
3. If you are unsure whether information is safe to use, don’t enter it. Ask first.

4. Checking AI output

1. AI tools can produce answers that sound right but are wrong, including invented facts, figures and references. Check everything before you rely on it.
2. Anything AI has helped produce must be reviewed by a person with the right knowledge before it goes to a client, supplier or regulator, is published, or is added to our records.
3. You are responsible for the work you send, however it was produced.

5. Being open with clients

1. Our privacy notice [and engagement letter] explains how [Firm name] uses AI.
2. Tell [name or role] before using AI in a new way that involves client information, so we can check whether clients need to be told.
3. If a client asks us not to use AI on their work, we will respect that and note it on their file.

6. Questions, mistakes and concerns

1. [Name or role] is responsible for this policy. Ask them if you are unsure about anything.
2. If information goes into the wrong tool, or something inaccurate or harmful produced with AI has been sent out, tell [name or role] straight away. Reporting quickly matters more than blame.
3. Some data breaches must be reported to the Information Commissioner’s Office within 72 hours of us becoming aware of them, so never wait.

7. Training

1. Everyone receives short training on this policy and our approved tools when they join and whenever the policy changes.
2. [Name or role] keeps a record of who has completed the training.

8. Review

1. This policy was approved by [name] on [date]. It will be reviewed by [date, no more than 12 months later], or sooner if we add an AI tool or the law or guidance changes.
2. Breaking this policy may be dealt with under [our disciplinary procedure].

Signed: [name, role, date]. I have read and understood this policy: [staff name, signature, date].

How we set this up for clients

On our Monthly AI Support plans, an AI safe-use policy is set up for every client as part of your setup, tailored to the tools you actually use. The pack’s staff onboarding automation includes policy sign-offs, so new starters read and accept it as part of joining.

If you’d like to know where AI could save your team time, and what the data-protection points are before you start, book a free automation audit. The written report covers both.