Free template
A one-page staff AI policy
you can actually use.
Free, no sign-up, no email required. Copy it, put your own name on it, hand it round. It fits on a single side of A4 because a five-page policy protects nobody — the ones that work are the ones people read.
A staff AI policy is not legally required, but UK GDPR expects appropriate organisational measures to protect personal data and a written policy is the cheapest example of one. It should fit on a single page and cover: which accounts to use, what must never be put into an AI tool, who checks the output, and what to do if something goes wrong.
Published
Why a one-page policy is worth the afternoon
No law says you must have an AI policy. But UK GDPR does expect you to have appropriate organisational measures in place to protect personal data, and a written policy that staff have read is about the cheapest and most obvious example of one you can produce.
The better argument is practical rather than legal. The most common real-world data exposure in small business is not hacking. It is somebody pasting a customer's details into a free AI tool because they were busy and no one had ever said not to. That person is not being reckless. They are filling a gap where a rule should have been.
A page of clear guidance closes that gap for the cost of an afternoon. It is the highest return on effort available anywhere in this subject.
Copy and adapt
The template
Anything in square brackets is for you to fill in. Delete anything that does not apply to your business — a policy with irrelevant clauses in it teaches people to skim.
AI USE POLICY
[Your business name] — version 1.0 — [date]
Review date: [date + 12 months]
1. WHY THIS EXISTS
We use AI tools because they save time and do useful work. This
policy is not here to stop you using them. It is here so that using
them does not put our customers' information at risk, or land the
business in trouble. If in doubt about anything below, ask
[name] before you do it — you will never be in bother for asking.
2. APPROVED TOOLS
Use these accounts for any work involving customer or company
information:
- [Tool name] — [business/enterprise account]
- [Tool name] — [business/enterprise account]
Do not use personal accounts or free tiers for work involving
customer information. Paying for a personal plan does not make it a
business account — the difference is the account type, not the price.
If you want to use a tool that is not on this list, ask first.
The answer is usually yes once we have checked how it handles data.
3. WHAT MUST NEVER GO INTO AN AI TOOL
Never, on any account or tier:
- Health or medical information about anyone
- Ethnicity, religion, sexual orientation, political opinions,
trade union membership, biometric or genetic data
- Anything covered by a confidentiality agreement
- Client data where our contract with them restricts processing
- Passwords, bank details, card numbers or API keys
If you are not sure whether something falls into this list, it
probably does. Ask.
4. WHAT TO BE CAREFUL WITH
Customer names, addresses, phone numbers, email addresses and job
details are personal data. You may use them in an approved account
where it is genuinely necessary for the work. Prefer to remove
identifying details first where the task does not need them — it
takes seconds and removes the question entirely.
5. YOU ARE RESPONSIBLE FOR THE OUTPUT
AI makes things up, confidently. Anything that goes to a customer,
into a quote, or into a document with our name on it must be read
and checked by a person first. If it is wrong, it is our mistake,
not the tool's.
Never let an AI tool make a final decision about a person —
hiring, dismissal, pricing that materially affects someone. A human
makes that call and must be able to explain it.
6. TELL PEOPLE WHEN IT IS AI
If a customer is talking to an AI assistant, it must say so before
they start. Do not give an assistant a human name without making
clear it is an assistant.
7. IF SOMETHING GOES WRONG
If you think customer information has gone somewhere it should not
have, tell [name] the same day. Do not try to quietly fix it.
Reporting it early is almost always the difference between a small
problem and a serious one. Nobody gets in trouble for reporting.
8. SIGN-OFF
I have read and understood this policy.
Name: ......................................
Signed: .................................... Date: ...............What to change for your business
Name a real person in sections 1 and 7
"Ask someone" means nobody gets asked. A named person, ideally you, turns an abstract instruction into an actual route. If it is a small team, it is you.
Fill in the approved tools properly
List the actual accounts, and specify that they are business tier. If you have not set those up yet, that is the first job — the policy is only as good as the accounts it points at.
Add anything specific to your trade
If you hold client data under contract, add a line naming those clients or contracts. If you work anywhere near health, care or children's services, get section 3 reviewed by someone qualified.
Delete section 6 if you have no customer-facing AI
No chatbot, no assistant, no automated replies? Cut it. Add it back the day you switch one on. Every clause that does not apply makes the ones that do less likely to be read.
Getting people to actually read it
A policy sitting unread in a shared drive protects nobody and would impress no regulator. Ten minutes spent talking it through is worth more than the document.
Walk through it in a team meeting rather than emailing it. Lead with why it exists, not with the rules — people follow a rule they understand the reason for. Get the sign-off sheet signed, because that is your evidence that the organisational measure was actually implemented rather than merely written. Then put a review date in the diary for twelve months, and move it forward if you adopt a new tool.
And make the reporting line in section 7 genuinely safe. If the first person who owns up gets a rollicking, it is the last time anyone tells you anything, and you have made your own visibility worse than before you had a policy at all.
What this does not cover
Being straight about the limits, because a template that claims to do everything is a template you should not trust.
This is a staff conduct policy. It is not a privacy notice, and it does not update yours — that is a separate document your customers read, and it needs its own paragraph about AI. It is not a DPIA, which you may need if you are profiling or scoring people. It does not make you compliant with the EU AI Act if you serve EU customers. And it is not legal advice for a regulated sector.
What it does is stop the thing that actually goes wrong in most small firms. That is a narrow claim and a true one. The wider picture is inthe AI rules UK businesses need to follow.
Where this comes from
- OpenAI — Business data privacy, security and compliance ↗
- Article 50, Regulation (EU) 2024/1689 — transparency obligations ↗
This is plain-English guidance for small businesses, not formal legal advice. Where something genuinely needs a solicitor or a data-protection specialist, I'll tell you straight.
Straight answers
- Is this template free to use?
- Yes. Copy it, change it, put your own name on it, give it to your staff. No sign-up, no email required. If it saves you an afternoon, that is the point of it.
- Is a staff AI policy a legal requirement?
- No. There is no law that says you must have one. But UK GDPR does require you to have appropriate organisational measures for protecting personal data, and a written policy is the cheapest, most obvious example of one. It is also the thing that actually prevents the incident.
- Will a policy stop staff using AI?
- A good one will not, and should not try. Banning AI outright pushes people onto their phones and personal accounts, which gives you the same exposure with none of the visibility. The aim is a clear route to doing it safely, not a wall.
- How long should it be?
- One page. If it runs to five, nobody reads it and it protects nobody. The template below fits on a single side and covers what actually goes wrong.
- Do I need a lawyer to check it?
- For a small business using AI for ordinary admin and drafting, no. If you handle special-category data, work in a regulated sector, or your contracts with clients restrict how their data is processed, get it reviewed. The template tells you where those lines are.
- What do I do once it is written?
- Circulate it, get people to confirm they have read it, and put a review date in the diary. An unread policy in a shared drive is worth nothing. Ten minutes in a team meeting is worth more than the document itself.
Read next
Can I put customer information into ChatGPT?
The single most common way small firms leak data. When it is fine, when it breaches UK GDPR, and how to make it safe.
Do I have to tell customers they are talking to a bot?
No single UK law says so. EU law now does. Where the line sits, and why one sentence solves it either way.
Want the rest of it sorted too?
The policy is one of four things most small firms need: the privacy notice wording, the staff policy, a human check on AI output, and staff off consumer accounts. A fixed-price readiness check does the lot with you.
Ask about a readiness check