AI Policy for Business: A One-Page Framework UK Companies Can Actually Use

Most AI policies in UK businesses get written after something has already gone wrong: customer details typed into a free chatbot, an AI-drafted figure sent to a client, or the discovery that half the team has been using tools nobody approved. The document that follows is usually long, defensive and read once.

This guide takes the other route. It sets out what an AI policy for business needs to cover on a single readable page, translates the UK GDPR touchpoints into plain language, and gives you a section-by-section structure to adapt. Treat it as a starting point rather than legal advice, and read the closing section carefully, because an AI policy for business only works when the training arrives alongside it.

Staff Are Already Using AI, With or Without Your Approval

Someone in your organisation pasted a customer email into a free chatbot this week to soften the tone. Someone else dropped part of a supplier contract into an AI tool for a plain English summary. Neither asked permission, because neither thought permission was required.

That is the honest starting point for any AI policy for business. The question was never whether your team would use these tools. They already are, on personal accounts and personal phones, often on free tiers. The only decision still open to you is whether that use is governed or ungoverned.

Business owners often assume they are choosing between allowing AI and prohibiting it. That choice does not exist. An AI policy for business turns invisible, unrecorded activity into something you can see, measure and correct.

What shadow AI looks like in practice

Shadow AI is the routine use of AI tools that sit outside your approved software list. It rarely looks like a security incident. It looks like a salesperson speeding up a proposal, a marketing manager rewriting product copy, a bookkeeper asking a chatbot to explain a VAT rule.

The risk is not the intent. It is the absence of a record. When nobody knows which tools are in use, you cannot say where the data went, who holds a copy, or whether any of it was personal data.

Free consumer tiers are where most of the exposure sits. The National Cyber Security Centre’s advice on public large language models is blunt: queries are visible to the provider and stored. Paid business accounts usually offer contractual commitments about data handling and retention. Free accounts frequently do not, and staff signing up with a work email address are agreeing to those terms without realising it.

Governed use versus ungoverned use

Ungoverned use means every employee makes their own call about what is safe to type into a text box. Some calls will be sound. Some will not, and you will find out afterwards.

Governed use does not mean slow use. A short, readable AI policy for business gives people a clear yes, a clear no, and a route to ask about anything in between. That removes hesitation for the low-risk work, which is most of it, and puts a check where the stakes are higher.

The organisations getting this right are not the ones with the longest documents. They are the ones where staff can recite the three rules that matter, usually because the policy landed alongside proper AI training for businesses rather than as an email attachment.

What a Workable One-Page AI Policy for Business Covers

A one-page AI policy for business is not a shortened version of a legal document. It is a different artefact with a different job: telling a busy person what to do in the next five minutes. Five elements do almost all of the work, and anything beyond them belongs in a supporting appendix rather than on the page people actually read.

Keeping it to a single page forces useful decisions. You cannot hedge on every clause, so you state the rule plainly and send edge cases to a named person.

Which tools are approved

Name them. An AI policy for business that says “use approved tools” without listing which ones has told nobody anything. List the specific products, the specific account type, and the tasks each one is cleared for.

Distinguish the paid business account from the free version of the same product, because they often carry different data terms. Staff assume the brand name is what has been approved, so spell out that approval attaches to the company account, not the free tier.

Add one line explaining how something new gets added to the list. A named owner, a short request, a decision within a week. Without that route, people will simply use the unapproved tool and say nothing.

What data must never be entered

This is the section staff will remember, so keep it to short, concrete categories rather than abstractions about confidentiality. Two categories cover most UK SMEs.

Customer and employee personal data comes first: names, contact details, addresses, payment information, health or HR records, anything about an identifiable individual. Commercially sensitive material comes second: unreleased pricing, tender responses, contract terms under negotiation, source code, acquisition discussions, anything covered by a non-disclosure agreement with a third party.

Give people the workaround alongside the rule, because a prohibition without an alternative gets ignored. Anonymise before you paste. Describe the situation instead of uploading the document. An AI policy for business that shows staff how to get the benefit safely will be followed far more often than one that only says no.

Where human review is required

AI output is fluent and confident regardless of whether it is correct, which is exactly why review points need naming in advance. Set the rule by consequence, not by tool.

Anything going to a customer, a regulator, a funder or the public needs a human read before it leaves. Anything touching a number, a quoted price, a tax figure, a measurement, needs checking against the source. Anything with legal, financial or employment consequences needs sign-off from someone qualified, and an AI policy for business should say who that is by role.

Make explicit what review actually means. Clicking approve on a suggestion you have not read is not review. The person signing off is accountable for the content, whether a machine drafted it or not.

How AI-assisted work is disclosed

Disclosure trips up more organisations than data rules do, mostly because they treat it as one question when it is really three: what clients need to know, what employees need to know, and what the public needs to know.

Set a threshold rather than a blanket rule. Using AI to tidy the grammar in an internal report is not something anyone needs telling about. Using AI to generate an image used in a client campaign, or to draft advice a client will act on, usually is. Recruitment and performance decisions sit in a stricter category again, and your AI policy for business should treat candidate-facing use as disclosable by default.

Write the wording you want used and put it in the appendix. Nobody invents a disclosure line under time pressure.

Who owns the policy

Every AI policy for business needs one named owner, not a committee. The owner keeps the approved tools list current, answers the edge cases, logs incidents, and schedules the review.

In a smaller company this is usually the operations lead, the finance director or whoever already handles data protection. In larger organisations a small group spanning IT, legal and HR advises, with one person holding the pen. Put the name and contact route on the page. A policy with an anonymous owner has no owner.

Set a review date at the same time. Quarterly is sensible while tools and rules are shifting, and an AI policy for business dated more than a year ago is worse than no policy, because it gives false comfort.

The UK GDPR Touchpoints, In Plain Language

You do not need a legal background to understand where AI use meets UK data protection law, because the rules are the ones you already follow. Nothing about AI creates a separate regime. If personal data goes into a tool, that is processing, and your existing obligations apply unchanged.

Four touchpoints account for most of what an AI policy for business needs to say about data protection. Getting these right will not make you compliant on its own, but missing them almost guarantees you are not.

Personal data stays personal data inside a prompt

Typing someone’s name and circumstances into a chatbot is processing their personal data, in the same way that emailing it to a supplier would be. The interface being conversational changes nothing about the legal position.

That means the tool provider is usually acting as a processor for you, which raises the questions you would ask of any supplier: what are the contract terms, where is the data held, how long is it retained, and is it used to train the model. Free tiers commonly answer those questions in ways you would not accept from any other vendor.

Lawful basis, purpose and data minimisation

Every use of personal data needs a lawful basis and a purpose you have already told people about. Feeding a customer list into a new AI tool to score sales prospects is a new purpose, and your privacy notice probably does not cover it.

Data minimisation is the control that does the most work here. Most AI tasks do not need real personal data at all: summarising a complaint does not require the complainant’s name, and drafting a template does not require a live customer record.

Automated decisions and the right to human review

Decisions made about people by AI carry extra requirements, particularly where the effect on the individual is significant. Recruitment shortlisting, credit decisions, performance management and disciplinary processes all sit in this territory.

The Data (Use and Access) Act 2025 changed parts of the UK rules on solely automated decision-making, and the ICO has confirmed that its own AI guidance is under review as a result. What has not changed is the direction of travel: where automated decisions affect people, they need transparency and a genuine route to human intervention. An AI policy for business should therefore keep a named human in the loop for these decisions rather than waiting for the final position to settle.

Where to check the official position

Point your policy at the source rather than paraphrasing it. The Information Commissioner’s Office publishes guidance on AI and data protection covering lawfulness, fairness, transparency, accountability and when a Data Protection Impact Assessment is needed.

Include the link in your document and make checking it part of the owner’s quarterly review. Guidance is still moving, so an AI policy for business that cites a regulator’s page will age better than one restating rules in its own words.

A Section-by-Section Structure You Can Adapt

What follows is a starting point, not legal advice. It is the structure we see working for SMEs across Northern Ireland, Ireland and the UK, and it is deliberately plain so that a first draft can be produced in an afternoon and improved later. If your sector carries specific regulatory duties, in financial services, healthcare or education for example, take this to your legal adviser before it goes live.

Seven sections keep it readable. The first page holds sections one to four, and everything else becomes an appendix.

Section one: purpose and scope

Two sentences on why the policy exists and who it applies to. Cover employees, contractors, freelancers and agencies working on your behalf, because third parties are a common gap.

State plainly that the policy covers personal devices and personal accounts when used for work. Most shadow AI happens there.

Section two: approved tools

A table with three columns: the tool, the account type, and what it is approved for. Add the date each entry was last checked.

Add a line on requesting additions, naming the owner and the expected turnaround.

Section three: data rules

The two prohibited categories, written as concrete examples rather than definitions. Then the permitted alternatives: anonymised text, hypothetical scenarios, publicly available material, your own published content.

One sentence closes it: if you are unsure whether something belongs in a prompt, ask before pasting.

Section four: human review and disclosure

The review triggers set by consequence, the roles accountable for sign-off, and the disclosure threshold. Keep the copy-and-paste disclosure wording in the appendix.

State the accountability rule in one line, because it is the sentence that changes behaviour: the person who sends the work owns the work.

Section five: reporting mistakes

A named route for telling someone when personal data has gone into an unapproved tool, or when AI output caused an error that reached a customer. Say explicitly that early reporting is expected and will not be punished.

This section is what turns your AI policy for business into an early warning system rather than a compliance artefact. Without it, mistakes surface when a customer complains.

Section six: training expectations

State who must complete AI training, at what point, and how often it is refreshed. New starters, anyone requesting a new tool, and anyone in a role touching personal data are the usual population.

Link the requirement to your onboarding checklist so it happens automatically rather than by memory.

Section seven: ownership, version and review date

The owner’s name and contact route, the version number, the approval date and the next review date. Four lines, kept accurate.

An AI policy for business with a visible review date signals to staff, customers and auditors that someone is still paying attention.

Where Most AI Policy Documents Fail

Plenty of UK organisations now have an AI policy. Far fewer have one that changes what happens at desks. The failure modes are consistent, and all three are avoidable at the drafting stage.

Test any draft against the three patterns below before you circulate it.

It was written for lawyers, not staff

A document full of qualifications reads as permission to guess. If a marketing executive cannot work out from your policy whether they may paste a customer testimonial into a chatbot, it has failed at the only test that matters.

Write it for the least technical person on your payroll. An AI policy for business that a new starter can act on without asking a follow-up question is doing its job.

It bans everything

Blanket prohibition looks decisive and produces the worst outcome available: the same usage as before, now hidden and unrecorded. Staff who see a rule as unworkable will route around it.

The alternative is proportionate permission. Approve the low risk uses openly, restrict the sensitive ones clearly, and you get visibility instead of silence.

It is never looked at again

Tools change their data terms. Vendors add AI features to software you already use, often with no announcement. Regulatory guidance moves. A policy written eighteen months ago probably names products that have changed since.

“The mistake we see most often is treating an AI policy as a one-off document rather than something that gets reviewed and retrained on,” says Ciaran Connolly, founder of ProfileTree. “The businesses that get real value out of AI are the ones where staff know exactly what is allowed, know who to ask when they are not sure, and are not quietly using free tools because the official answer was no.”

Policy and Training Arrive Together

A policy nobody understands changes nothing. This is the part most organisations skip, and it is the part that determines whether any of the preceding effort produces a different outcome at the desk.

Publication is not implementation. Sending a document to an all-staff address puts it on the record and leaves behaviour where it was. What changes behaviour is a short session where people try the approved tools, see a redacted example of what not to paste, and understand why the data rules exist.

Keep the session practical and role-specific. Sales, HR and finance face different exposures, and generic awareness training produces generic compliance. Half an hour on the tasks a team actually performs beats an hour of principles.

Build in a way for staff to ask questions without an audience. Most breaches start with someone who was unsure and did not want to look behind. A named contact and a low-stakes channel prevents more incidents than any prohibition. Structured digital training also gives you a record of who has been briefed, which matters if you need to show that reasonable steps were taken.

Then repeat it. Refresh at each policy review, brief new starters during onboarding, and update the examples when the tools change. An AI policy for business and the training that supports it are a single ongoing activity, not two separate projects.

Conclusion

The realistic goal is not perfect control. It is visibility, a small number of rules people remember, and a named person who owns the answer when something falls outside them. An AI policy for business built on those three things will outperform a longer document that nobody reads.

Start with the one-page version this week. List the tools you approve, write down the two data categories that stay out of prompts, name your review points and your owner, and put a date on it. Then brief the team properly, because the document only works once people can act on it without asking.

ProfileTree is a Belfast-based web design and digital marketing agency that helps SMEs across Northern Ireland, Ireland and the UK adopt AI in ways their teams can actually sustain. If you want the policy and the training handled together, that is the work we do.

FAQs