AI, data and processes
How to write an AI policy for your business (with a free template builder)
By the Long Lever team · 7 min read · Last checked 6 November 2026
The short answer
A good AI policy says which AI tools staff may use and through which accounts, what information can and can't go into them, that a person checks everything AI produces, and who to tell if something goes wrong. Start from what your team actually does today, keep the rules simple enough to follow, and have your compliance lead or a director check and sign it off before it goes out.
Why does a business need an AI policy now?
The question we hear most from business owners isn't "should we use AI?". It's "what are my staff already putting into it?". In most businesses, people are using AI to write emails, tidy reports and summarise documents, often on free personal accounts the business doesn't know about and can't control.
That matters for three reasons. Free and personal accounts can keep what you type and, unless the setting is switched off, use it to train the AI. Customer and staff information is personal data, so UK GDPR applies however it's shared. And if your written policy says one thing while your team does another, that gap is exactly what an insurer or a client will look for after an incident.
What should an AI policy cover?
Keep it practical. A policy staff can't follow is worse than none. The essentials are:
- Approved tools and accounts. Which AI tools are allowed, who can use each one, and that work is only done through company business accounts, never personal or free ones.
- What information can go in. A simple traffic-light system so staff know what is fine, what needs care, and what must never be put into AI.
- Checking the output. A person reviews anything AI produces before it is used or sent, and stays responsible for it.
- Data protection. A lawful basis, using the minimum data, telling people in your privacy information, and keeping AI away from decisions about people without a human making the final call.
- Customers and contracts. Some clients and tenders restrict or ban AI use, so staff must check first.
- Meeting recorders and note-takers. Tell everyone before recording, and never use them in HR or sensitive meetings.
- Incidents. What to do if the wrong information goes into the wrong tool, and that some breaches must be reported to the ICO within 72 hours.
- Sign-off and review. Who owns the policy, how staff confirm they've read it, and when it is reviewed.
How do you decide what information staff can put into AI?
Sort your information into four groups and give each a clear rule. The examples change from business to business, which is why a policy should be written around the information you actually hold.
| Group | Typical examples | Rule |
|---|---|---|
| Green | Public information, general questions, drafts with no names | Any approved AI tool |
| Amber | Customer names, pricing, contracts, internal procedures | Approved business accounts only, by authorised people, using the minimum needed |
| Red | HR matters, health information, CCTV, anything about children | Only for uses the business has specifically approved, after a risk assessment |
| Never | Passwords, bank and card details, access and alarm codes | Never in any AI tool, even an approved one |
The simplest rule for staff: if you're not sure, treat it as Red and ask.
How do you write one, step by step?
- Find out what's really in use. Ask your team which AI tools they use and what for. No blame; you need the honest answer.
- Choose your approved tools. Usually the assistant that fits the software you already use, on a business plan, with training on your data switched off.
- List the information you hold and sort it into Green, Amber, Red and Never.
- Name the owners. Who owns the policy, who approves costs, and who sets up accounts. Use job titles, not names.
- Write a short staff guide alongside the policy: golden rules, a "Can I...?" section and a sign-off box.
- Get it checked and signed off by your compliance lead or a director, and by your legal adviser if you handle sensitive data.
- Brief your team, collect sign-offs and keep a register of approved tools and users, reviewed at least once a year.
Who should check and sign off an AI policy?
A template, however good, is a starting point. Before you issue it, someone who knows your business and its obligations should check that it matches how you really work. That's usually your compliance manager, operations director or managing director, with your legal adviser involved if you handle health information, information about children or criminal record data, or plan to use AI anywhere in recruitment or HR.
Where AI will touch special category data or decisions about people, carry out a data protection impact assessment (DPIA) first. The rules on automated decision-making changed under the Data (Use and Access) Act 2025, and the ICO has been consulting on updated guidance, so check the current position before relying on AI for any decision about a person.
Is there a quicker way to get started?
Yes. We turned our own policy into a free AI policy builder. Answer a few questions about your business, the AI tools your team uses and the information you handle, and it writes three documents around your answers: an AI usage and data protection policy, a plain-English staff guide with a sign-off box, and an approved tools register.
They come in your own logo and colours, ready to download as Word to edit or PDF to share. No email is needed, and your logo never leaves your browser. It's a guide to get you started, not legal advice, so it still needs checking and signing off by your compliance manager or a director before it goes to your team.
What this won't do
This article and the builder are practical guides, not legal advice. Every business is different, provider terms change, and the rules on automated decision-making are still being updated. Have your policy checked by someone responsible for compliance in your business, and take legal advice if you handle sensitive data or plan to use AI in decisions about people.
Questions people also ask
Does a small business really need an AI policy?+
If anyone in the business uses AI for work, yes. It can be short, but it should say which tools and accounts are allowed, what information can't go into them and that a person checks the output.
Can staff use free ChatGPT for work?+
Not with customer, staff or company information. Free and personal accounts can keep conversations and use them for training unless the setting is switched off, and the business has no control over them. Use a business plan instead.
Is there a free AI policy template for UK businesses?+
Our free AI policy builder writes a policy, staff guide and approved tools register around your answers, in your own branding, as Word or PDF. It still needs checking and signing off by your compliance lead or a director.
Who should sign off our AI policy?+
Usually your compliance manager or a director, with your legal adviser involved if you handle health, children's or criminal record data, or plan to use AI in HR decisions.
How often should an AI policy be reviewed?+
At least once a year, and sooner if you add new AI tools, the law changes or your insurer's requirements change.
Sources
- ICO: Artificial intelligence guidance for organisations
- ICO: 72 hours, how to respond to a personal data breach
- ICO: Consultation on draft guidance about automated decision-making, including profiling
- OpenAI: Business data privacy, security and compliance
Facts and rates last checked 6 November 2026. We review every article at least every six months.
About the Long Lever team
Long Lever Partnerships is a collective of business owners and operators: people who have built, run and sold businesses, some with multi-million-pound turnovers, and people who have spent their careers in the field. We have no software to sell and no commission from any provider.
We guide, you build and own it.
Want to know where this fits in your business? The free discovery check takes a few minutes, and the first conversation costs nothing.