Does your small business need an AI policy? (Free UK template)
By Kieran Mullings, BEng Mechanical Engineering (UWE Bristol), technical co-founder of FlowGenix Automations Ltd.
Yes. Any UK business whose staff use ChatGPT, Copilot, Gemini or Claude for work needs a written AI policy, even a one-page one. UK GDPR applies when staff paste personal data into an AI tool. A usable small business policy names approved tools, banned data types, when a person must check the output, and who owns the rules.
FlowGenix Automations is an audit-led AI and automation consultancy for UK SMEs.
The guidance below is general information for UK businesses, not legal advice.
Key takeaways
- ONS data shows 21% of UK businesses with 10 or more employees used large language models for text generation in September 2026.
- UK GDPR applies to personal data pasted into ChatGPT or any other AI tool, and the business remains responsible for that data.
- The Data (Use and Access) Act 2025 replaced the old Article 22 rules on automated decisions with Articles 22A to 22D from 5 February 2026.
- A one-page AI policy with an approved-tools list, a banned-data list and a named owner covers most small business risk.
Why does a small business need an AI policy?
A small business needs an AI policy because staff are already using AI tools, often on personal accounts, with no rules about what data goes in. Without a policy, customer details, contracts and pricing can end up in tools the business never approved. The policy turns invisible risk into a short set of rules everyone can follow.
The usage is real and rising, as the AI for small business guide sets out. The Office for National Statistics reported in October 2026 that 30% of UK businesses used at least one AI technology in September 2026. Among businesses with 10 or more employees, 21% used large language models for text generation. The ONS figures count only the use businesses know about.
The bigger risk is the use nobody reported. A sales assistant drafting proposals in a free ChatGPT account may paste in a client's name, budget and contract terms. FlowGenix builds Claude into client workflows through the Anthropic API. Each build answers the same questions at design stage: which data goes in, where it is stored, and who checks the output. A policy answers those questions for everyday staff use.
Key facts
- ONS reports 30% of UK businesses used AI technology in September 2026.
- Free consumer AI accounts sit outside the business's control.
- FlowGenix answers data, storage and review questions at the design stage of each AI build.
What should a UK AI policy include?
A UK AI policy should include its scope, approved AI tools, data that must never be entered and rules for checking AI output. Add customer disclosure, a named policy owner and a review date. Ten short clauses cover most small businesses. Length matters less than whether staff actually read it.
Approved tools come first because they make every other rule easier. Business tiers of ChatGPT, Claude, Microsoft Copilot and Gemini offer admin controls and contractual data terms that consumer accounts lack. Naming the approved tools removes the grey area that leads staff to use whatever is open in a browser tab.
The banned-data list is the clause that prevents most incidents. Keep it concrete. "Do not enter personal data" is too abstract for a busy employee. "Never paste customer names, addresses, phone numbers, bank details or health information" is specific enough to follow. The FlowGenix template below uses that concrete style.
The core sections of a small business AI policy:
- Purpose and scope, covering staff, contractors and devices
- Approved AI tools and accounts
- Data that must never be entered into AI tools
- Human review rules before AI output is used or sent
- Customer disclosure where AI is customer-facing
- Intellectual property and confidentiality
- Automated decisions about people
- Reporting mistakes and incidents
- Policy owner and training
- Review date
Key facts
- Approved-tool lists remove the grey area behind most shadow AI use.
- Concrete banned-data lists work better than abstract privacy wording.
- The FlowGenix template uses ten short clauses.
What does UK law say about using AI at work?
The UK has no single AI Act. Existing law applies instead. UK GDPR covers personal data, and the Data (Use and Access) Act 2025 covers automated decisions. The Equality Act 2010 covers discrimination, and consumer law covers what AI tells customers. The Information Commissioner's Office publishes guidance on AI and data protection.
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. Its main data protection changes came into force on 5 February 2026. Articles 22A to 22D now govern significant decisions made solely by automated means. Organisations can make more automated decisions, but must offer safeguards, including a route to human review.
For most small businesses, the practical law is narrower. If staff paste personal data into an AI tool, the business is still the controller. If AI screens job applicants, discrimination and automated-decision rules both apply. The guide to AI risks and UK law covers the wider picture. FlowGenix keeps a human approval step wherever a build would make a significant decision about a person, which is the simplest way to stay inside Articles 22A to 22D.
| Law or guidance | What it means for a small business using AI |
|---|---|
| UK GDPR and Data Protection Act 2018 | Personal data in AI tools needs a lawful basis, transparency and security |
| Data (Use and Access) Act 2025 | Significant automated decisions need safeguards and human review |
| Equality Act 2010 | AI used in hiring or service decisions must not discriminate |
| Consumer protection law | Customers can rely on what your chatbot or AI content tells them |
| ICO Guidance on AI and data protection | Explains fairness, transparency and accountability for AI systems |
Key facts
- The UK regulates AI through existing laws rather than a single AI Act.
- Articles 22A to 22D took effect on 5 February 2026.
- FlowGenix keeps human approval wherever a build makes a significant decision about a person.
What does a free AI policy template for a UK small business look like?
A free AI policy template for a UK small business fits on one page and uses plain instructions, not legal prose. The FlowGenix template below has ten clauses with square-bracket gaps for your business name, approved tools and policy owner. Copy it, fill the gaps, and brief staff in a 30-minute meeting.
Adapt the template rather than adopting it word for word. A dental practice handles health data and needs tighter clause 3 wording. A recruitment agency screening CVs needs a stronger clause 7. A trades business with two vans may only need clauses 1 to 5 and 9.
Treat the template as a starting point and check the final version with your data protection lead or adviser. The clauses are written for UK businesses and reference UK GDPR. Review dates matter, because AI tools change their data terms often.
The FlowGenix one-page AI policy template:
- Scope: This policy applies to everyone working for [Business name], including contractors, on any device used for work.
- Approved tools: Staff may use only [approved tools, for example ChatGPT Business or Microsoft 365 Copilot] through accounts provided by [Business name].
- Banned data: Never enter customer names, contact details, bank details, health information, passwords or confidential contract terms into any AI tool.
- Human review: A named person checks every AI-generated document, quote or message before it is sent outside the business.
- Disclosure: Customer-facing chatbots and voice agents must say they are automated.
- Confidentiality: Client documents and pricing stay out of AI tools unless [policy owner] approves a specific use.
- Decisions about people: AI must not make final decisions on hiring, credit, pricing or service refusals without human review.
- Incidents: Report any mistake, data entry error or harmful output to [policy owner] the same day.
- Ownership: [Name, role] owns this policy and the approved-tools list.
- Review: This policy is reviewed every six months, next on [DD/MM/YYYY].
Book a free 30-minute audit if you want help mapping where AI already touches customer data in your business.
Key facts
- The FlowGenix AI policy template fits on one page with ten clauses.
- Clause 3 lists the data staff must never enter into AI tools.
- Sector-specific businesses should tighten clauses 3 and 7.
Which AI tools are safest for business use?
The safest AI tools for business use are the business or enterprise tiers of mainstream products, such as ChatGPT, Claude, Microsoft 365 Copilot and Gemini for Google Workspace. Business tiers offer admin controls, single sign-on and contractual terms that exclude your data from model training by default. Free consumer accounts offer weaker controls.
Check three things before approving any tool. First, whether the vendor trains on your data, and whether that is off by default. Second, where data is stored and for how long. Third, whether an administrator can remove a leaver's access. Vendors publish these terms, and they change, so record the date you checked.
API access is a separate category. When FlowGenix builds AI into a workflow, it calls models through the Anthropic API under commercial terms, rather than through anyone's personal chat account. The data path is fixed by the build, so staff never paste anything by hand. For repetitive tasks, that is safer than any chat policy.
| Account type | Admin controls | Training on your data | Suitable for client data |
|---|---|---|---|
| Free consumer account | None | Often on by default | No |
| Paid personal account | Limited | Varies by vendor setting | No |
| Business or enterprise tier | Yes | Off by default for major vendors | With policy and review |
| API inside a built workflow | Yes, via the build | Off by default under commercial terms | Yes, with a fixed data path |
Key facts
- Business tiers of major AI tools exclude customer data from training by default.
- Free consumer accounts give the business no admin control.
- FlowGenix builds call models through the Anthropic API under commercial terms.
How do you roll out an AI policy without slowing staff down?
Roll out an AI policy by first finding out which tools staff already use, approving the useful ones, then briefing everyone in one short session. A policy that bans everything gets ignored. A policy that approves good tools and bans specific data gets followed, because it makes the safe route the easy one.
Start with an honest inventory. Ask staff which AI tools they use and for what, with a clear promise that nobody gets in trouble for past use. The answers usually reveal two or three tools doing real work. Approve those on business accounts rather than banning them and driving use underground.
A department-by-department process map shows exactly where customer data meets AI tools. A FlowGenix audit produces that map as standard. Some of the riskiest copy-and-paste use disappears entirely once a repetitive task becomes an n8n workflow with a fixed data path, through workflow and CRM automation.
Rollout steps for a small business:
- Survey staff on which AI tools they use and for which tasks.
- Approve two or three tools on business accounts.
- Fill in the template and name a policy owner.
- Brief all staff in one 30-minute session with real examples.
- Review usage and the policy every six months.
Key facts
- No-blame tool surveys surface hidden AI use quickly.
- Approving useful tools works better than blanket bans.
- A FlowGenix audit maps processes department by department.
Frequently asked questions
Is it illegal to put customer data into ChatGPT?
Not automatically, but it can breach UK GDPR. You need a lawful basis, the customer must be told through your privacy notice, and the tool must keep the data secure. Pasting customer data into a free consumer account usually fails those tests. A business tier with data terms, used under a written policy, is far easier to defend.
Do I need to tell customers I use AI?
You must tell customers how you use their personal data, which includes processing by AI tools, through your privacy notice. Customer-facing chatbots and voice agents should also say they are automated. You do not need to label every email drafted with AI help, provided a person checked it before sending.
Do I need a data protection impact assessment for AI?
UK GDPR requires a data protection impact assessment when processing is likely to result in high risk to people. Using AI to make significant decisions about individuals, process health data at scale or monitor staff usually meets that bar. Drafting marketing copy with no personal data usually does not. The ICO publishes screening checklists to help you decide.
Can staff use personal ChatGPT accounts for work?
Your policy should say no for any task involving customer or confidential data. Personal accounts sit outside the business's control, so you cannot remove access when someone leaves or check what was shared. Provide approved business accounts instead. Staff use personal accounts mainly when the business has given them nothing better.
Does the EU AI Act apply to UK businesses?
The EU AI Act can apply to a UK business that places an AI system on the EU market or whose AI output is used in the EU. A UK firm using ChatGPT internally to draft UK documents is generally outside its scope. Businesses selling AI-enabled products or services into the EU should take specific advice.
Sources
- Office for National Statistics, Business insights and impact on the UK economy: 8 October 2026
- Information Commissioner's Office, Guidance on AI and data protection
- GOV.UK, Data (Use and Access) Act 2025: data protection and privacy changes
Book a free 30-minute audit and leave with a map of where AI already touches your data and which tasks to automate safely.
About the author
Kieran Mullings is technical co-founder of FlowGenix Automations Ltd (company number 16555743). He builds the voice agents, n8n workflows and AI search foundations behind FlowGenix client systems. He holds a BEng in Mechanical Engineering from UWE Bristol and leads the technical side of every FlowGenix audit. More at About FlowGenix.
Find out where AI already touches your data.
Thirty minutes on a call. We map how work moves through your business, including where staff use AI tools, and show you which tasks to automate safely. You keep the roadmap either way.