Quick answer: If more than one person uses AI tools in your business — or you use them with client information — you need basic house rules, and a one-page policy is enough. Not a compliance manual: a short internal document that answers eight practical questions, from which tools are approved to what to do when someone is unsure. An hour to draft, an hour or so a year to maintain. Be equally clear about what it does not do: a policy by itself does not satisfy data protection law or the EU AI Act. What it does is replace silent, improvised habits with decisions your team can actually follow.
In most small businesses, AI arrives quietly. Someone starts drafting emails with ChatGPT. Someone asks Claude to summarise meeting notes. A contractor you work with pastes a messy client spreadsheet into Gemini to clean it up. Nothing announces this, and usually nothing goes wrong — until the day someone pastes the wrong thing into the wrong tool, or an unchecked answer reaches a client.
That is the gap a usage policy closes. Not by banning anything, but by deciding the borderline questions once, in advance, instead of leaving each person to improvise.
What a usage policy is — and what it is not
An AI usage policy is a short internal document — one page for most small businesses. It records the house rules: which tools are approved, what information may go into them, what checking is required before AI output is used, and who to ask when unsure.
It is not a legal compliance document. Data protection duties under UK GDPR and EU law, and the EU AI Act obligations already in force — AI literacy since February 2025, chatbot transparency since August 2026 — exist regardless of what your policy says. The legal side is covered properly in AI data security for small business and the EU AI Act for small businesses. A policy does not make you compliant by itself — anyone selling a template as "all you need" is overstating it. What it does is make expectations explicit and checkable, which is the part most small businesses are missing.
The checklist: eight decisions
Work through these with whoever will own the policy. Write one or two sentences per answer. If a decision starts an argument, that is the point — better now than after an incident.
1. Which tools are approved? Name them: ChatGPT, Claude, Gemini, Copilot, whatever your team actually uses. Data-handling terms differ between tools and between plan tiers — a consumer plan and a business plan are not the same arrangement — so approve each tool at the tier you have actually checked, and record that.
2. What may be pasted in, and what may not? A workable default: if you would not email it to a stranger, do not paste it into a tool. Client names, contract details, staff records, passwords and API keys — the credentials one program uses to talk to another — never go in. Anything else gets anonymised first — the task rarely needs real names anyway. When in doubt, describe the data in words instead of pasting it.
3. What checking does AI output need before it is used? Separate internal drafts from anything that leaves the business. A brainstorm nobody acts on needs little checking; a figure in a quote, a clause in a contract draft or a paragraph on your website needs someone to verify it before it counts. Match the check to the task: recalculate numbers, confirm legal or technical claims against a primary source, and read the final version as if a competitor had written it.
4. When do you tell clients? If a customer is talking to a chatbot, they should know — for businesses serving customers in the EU, telling people when they are dealing with a chatbot has been an EU AI Act requirement since August 2026, and honesty is a sensible default well beyond the legal minimum. Decide too whether AI-assisted deliverables (a report, a translation, a design) are disclosed, and note it where clients can see it if so.
5. Who owns the policy? One named person. They approve new tools, answer questions, and review the document every six months or whenever a tool changes its terms. Without an owner, a policy decays into a file nobody opens.
6. What does someone do when unsure? The default answer should be boring: do not paste it, do not send it, ask the policy owner first. Give people one obvious way to ask — the same chat or inbox for everyone — and make sure the owner actually answers.
7. What happens if something goes wrong? Decide the response before you need it: correct the record with the affected client, note what happened and why, adjust the rule that failed. No blame theatre — the aim is a habit, not an investigation.
8. How does a new tool get approved? Someone trials it, checks the data-use terms, and the owner adds it to the list or says no. This is the rule that stops quiet sprawl — the moment three people use three tools nobody vetted.
A one-page example (constructed)
To show the size of the thing, here is the entire policy for a fictional two-person bookkeeping practice, constructed for illustration:
We use ChatGPT and Claude, on the plans the practice owner approved. Nothing else is approved yet. Client names, identifiers and figures never go into AI tools; we describe the task in words or use made-up examples. Any AI output a client receives is checked line by line by the person sending it. Our website chatbot says it is a chatbot, in English and Portuguese. One partner owns this document, reviews it every six months, and answers questions in the team's shared inbox. New tools: one-week trial, check the terms, then ask the owner.
Twelve lines. It would need adapting for a regulated industry, and it is not legal advice — but everyone in the practice knows where the lines are, which is more than most teams can say.
When you genuinely do not need one
If you work alone, use AI for your own drafts only, and never paste client information, a formal policy is overhead. Write yourself three lines — which tools, what never goes in, what gets checked — and call it done. Revisit when you hire, or when client work starts carrying data.
Three questions that come up
Will a policy slow the team down? Less than guessing does. The rules that matter take seconds to follow — anonymise first, check before sending, ask when unsure — and they replace the slower, costlier process of finding out after the fact.
Tools change every month. Why write anything down? The policy governs decisions, not tool names. Tools come and go; the questions — what goes in, what gets checked, who decides — barely change. That is why decision 5 includes a review date.
We are only four people. Is this overkill? Four people is exactly when it is cheap: one conversation, one page, one afternoon. The cost of writing it grows with headcount; the value of having it grows faster.
The honest limitations
A one-page policy does not make you data-protection compliant, does not discharge any EU AI Act duty, and does not guarantee that mistakes never happen. It works only if the named owner keeps it current and the team can challenge it. Treat it as a living document, not a certificate.
Where a second pair of eyes helps
Writing rules is the easy part; knowing which of your actual workflows deserve them is the judgement call. That is what the Business Process & AI Diagnostic is for: a short discovery interview about how the work is done today, up to three named, bounded processes reviewed, and plain-language written findings you keep, with a prioritised list of improvements — including ordinary process fixes where AI is unnecessary. It costs £349 (399 € in Portugal), one-off, with nothing further to commit to.
Prefer to talk first? Book a free 30-minute call — no preparation needed, and if a diagnostic is not the right fit, we will say so.
Related reading: AI data security for small business, common AI mistakes small businesses make and the EU AI Act for small businesses.
Last updated: 25 October 2026