AI Acceptable Use Policy for Small Businesses
AI is already in your business. The question is whether it is being used safely.
Your team may already be using ChatGPT, Copilot, Gemini, Claude, AI meeting tools, browser extensions or image generators to get work done faster. That is not automatically a problem. The problem starts when company data, client information, staff records or contract details are pasted into tools that have never been checked.
It can be quick, helpful and surprisingly useful, but it does not know your business, your clients, your contracts or your professional responsibilities. Human judgement still needs to be the final check before anything is sent, published or relied on.
You do not need to become an AI company. You do need clear rules.
For many smaller organisations, AI risk is not about building machine learning systems or creating complex algorithms. It is much simpler than that: people are using powerful online tools with business data, often before anyone has agreed what is safe.
Data protection risk
Personal data, client data and staff data still need to be handled properly under UK data protection law. AI does not create a free pass.
Cyber security risk
Browser extensions, meeting bots, unmanaged apps and personal devices can all create new routes for data to leave your business.
Commercial risk
Client contracts, supplier terms, insurance questions and professional obligations may restrict how AI tools can be used.
We help you put sensible guardrails around the cyber security, data protection and staff-use risks that sit around AI tools.
The tools are useful. The unmanaged use is the issue.
Most staff are not trying to cause trouble. They are trying to save time. They ask AI to tidy an email, summarise a document, draft a proposal, rewrite notes or analyse a spreadsheet.
of workers who use AI tools at work have done so without any formal approval or guidance from their employer.
Salesforce “Economy of AI Agents” Survey, Feb 2025
of AI prompts from business users contained sensitive data — including customer information, employee details and proprietary business data.
Harmonic Security, Q1 2025 AI Data Leakage Report
That becomes risky when the information entered into the tool includes client names, employee records, contracts, pricing, credentials, financial information, health data, safeguarding information or commercially sensitive documents.
Some AI tools offer business settings and stronger privacy controls. Some consumer or free tools may store prompts, use content to improve services, allow human review, or process data in ways that are not suitable for your organisation. The answer is not panic. The answer is approval, training and clear rules.
Letting staff use AI tools without a policy is a bit like giving every employee a company credit card with no spending limit and no oversight. Most people will use it sensibly. But without any controls, it only takes one mistake to create a serious problem.
Run a Shadow AI audit without turning it into a witch hunt
The Shadow AI article adds a useful point: this should feel like routine maintenance, not a crackdown. Most people use AI because they are trying to save time, not because they want to bypass security. You will get better answers if the tone is, "help us support this safely".
Start with visibility
Look at the signals you already have before sending a company-wide warning. Identity logs, managed device activity, browser telemetry, SaaS admin settings and enabled AI features can all help show what is already being used.
Watch for purpose creep
The risk is not only the first prompt. It is what happens to the data after that. Information entered for one quick task can end up being stored, reused, reviewed, shared or processed in ways that no longer match the original reason it was collected.
"Which AI tools or AI features are helping you save time right now?" This sounds very different from "Who has been using unapproved AI?" and is more likely to give you honest answers.
Discover use
Check sign-ins, SaaS settings, browser extensions, endpoint activity and self-reported use.
Map workflows
Do not obsess over tool names. Map where AI touches real work and where the output goes.
Classify data
Use simple buckets: public, internal, confidential and regulated where relevant.
Triage risk
Prioritise the highest-risk uses first instead of trying to create a perfect inventory.
Decide outcomes
Mark each use as approved, restricted, replaced or blocked, then explain the decision clearly.
| Workflow | AI touchpoint | Input type | Output use | Owner |
|---|---|---|---|---|
| Marketing content | Drafting, rewriting or image ideas | Public or internal information | Website, social posts, email campaigns | Marketing lead or business owner |
| HR and recruitment | Job adverts, interview notes or policy drafts | Staff or candidate information | Internal decisions or published documents | HR, manager or director |
| Client work | Reports, proposals, summaries or contract wording | Client, pricing or contract information | Client-facing advice or documents | Account owner or service lead |
Look at data sensitivity, whether the account is personal or managed, retention and training settings, export or sharing options, and whether audit logs are available. This avoids the trap of analysing everything and fixing nothing.
Approved
Allowed for defined use cases, ideally with managed identity, logging and agreed settings.
Restricted
Allowed only for lower-risk use, with clear rules on what data must stay out.
Replaced
Moved to a safer approved tool or a better-controlled business process.
Blocked
Stopped because the risk is too high or the tool cannot be managed properly.
AI terms your team should understand
A policy works better when people understand the words being used. These are the terms that usually matter most for small businesses.
Shadow AI
Staff using AI tools for work without approval, guidance or security checks.
Hallucination
When an AI tool gives an answer that sounds confident but is wrong, invented or misleading.
Prompt injection
A way of tricking an AI tool into ignoring instructions, revealing information or taking an action it should not take.
Training data
Information used to improve or train an AI system. This is why staff must understand what happens to anything they paste into a tool.
Anonymisation
Removing names, identifiers, prices, addresses and other details before using information with an approved AI tool.
Deepfake
AI-generated audio, video or images that make it look or sound as though a real person said or did something.
The main areas your AI acceptable use policy should cover
A useful AI policy should be short enough for people to follow, but clear enough to protect the business. It should not be a dusty PDF nobody reads.
Approved tools
Which AI tools can be used for work, who approves them, and what settings must be in place before staff use them.
Data rules
What can be entered into AI tools, what must be anonymised, and what must never be entered.
Meeting bots and browser extensions
How AI note-takers, transcription tools, browser plugins and summarising extensions are handled.
Accuracy checks
Who checks AI-generated work before it is sent to clients, published, used in reports or relied on for decisions.
Personal devices
Whether staff can use AI apps on their own phones, laptops or home computers for work-related tasks.
Incident reporting
What staff should do if they accidentally paste sensitive data into an AI tool or invite the wrong AI bot into a meeting.
Keep an approved list, not a banned list
New AI tools appear all the time. A banned list goes stale quickly. An approved list is easier for staff to understand and easier for the business to manage.
Your approved list should include
- The name of each approved AI tool.
- Who is allowed to use it.
- What it can be used for.
- What data can and cannot be entered.
- Whether prompts and outputs are stored or monitored.
- Who owns the review and approval process.
A simple staff rule
If the tool is not on the approved list, do not use it with company, client, staff or supplier information until it has been checked.
You are not asking staff to understand every AI platform on the market. You are giving them a clear route: use approved tools, ask before using anything else.
What a small business AI policy should actually say
A good AI policy does not need to be full of legal language. It needs to tell people what they can use, what they cannot use, what data must stay out of AI tools, and who to ask when they are unsure.
1. Start with the right tone
The policy should not sound like "AI is banned". Staff are already using these tools because they help. The aim is to make AI safer, not to make people feel they have done something wrong.
"We support the careful use of AI tools where they help people work more efficiently. This policy exists to protect our business, clients, staff and data while allowing sensible use of approved tools."
2. Make personal responsibility clear
AI can help draft, summarise and suggest, but it should not become the final decision-maker. Staff should remain responsible for the accuracy, tone, legality and suitability of anything they submit or send.
"AI is a tool, not a member of staff. You are responsible for checking AI-assisted work before it is used, shared, published or sent to a client."
3. Define which tools are approved
Do not try to keep a long list of every banned AI app. New tools appear constantly. A cleaner approach is to keep an approved list and make it clear that anything not on the list needs checking first.
"Only AI tools approved by the business may be used for work. If a tool is not on the approved list, do not use it with company, client or staff data until it has been reviewed."
4. Set clear data rules
This is the heart of the policy. Staff need examples of what can be used, what needs anonymising, and what must never be pasted into an AI tool.
"Do not enter client names, employee records, passwords, financial information, health data, safeguarding information, legal documents, contract pricing or confidential business information into public or unapproved AI tools."
5. Cover browser extensions and meeting bots
AI tools are not limited to chat boxes. Browser extensions, transcription tools and meeting recorders can access emails, web pages, calls, documents and conversations. They need approval too.
"AI browser extensions, meeting recorders and transcription bots must not be installed or invited to meetings unless approved by the business."
6. Require accuracy checks
AI can sound confident when it is wrong. Anything factual, financial, legal, technical or client-facing should be checked against a reliable source before use.
"AI-generated answers must be checked before they are relied on. Do not use AI as the only source for legal, financial, HR, technical, safety or client advice."
7. Address copyright and brand risk
Staff should avoid asking AI to copy a competitor, living artist, author, brand, logo or protected style. AI-generated content should be reviewed before it represents the business publicly.
"Do not use AI to deliberately copy protected work, imitate a specific creator, reproduce trademarks, or create content that could mislead clients about its source."
8. Put controls around automations
AI becomes riskier when it is connected to email, CRM systems, file storage, forms, finance platforms or automation tools such as Power Automate, Zapier or Make.
"Do not create automated workflows that send company, client or staff data to an AI tool or AI API without prior approval."
9. Include deepfake and payment fraud checks
AI-generated voice, video and image tools can make impersonation scams more convincing. Finance teams should have a simple verification rule.
"Any urgent payment request, bank detail change, gift card request or credential request must be verified through a second trusted method before action is taken."
10. Explain personal device use
Staff may have AI apps on their own phones or home laptops. The policy should make it clear whether work information can be copied into those apps.
"Company, client or staff data must not be copied into AI apps on personal devices unless the device, app and account have been approved for work use."
11. Tell people how to report mistakes
If someone accidentally pastes the wrong information into an AI tool, you want them to report it quickly, not hide it.
"If you accidentally enter restricted information into an AI tool, report it straight away. Early reporting helps us limit the risk and support you."
12. Review the policy regularly
AI tools change quickly. A policy written once and forgotten will go stale. Build in a regular review, especially when new tools or features are introduced.
"This policy will be reviewed regularly and updated when new AI tools, features, risks or business requirements need to be covered."
We can help with the cyber security, data handling and practical staff-use side of AI. Before you formally approve an AI acceptable use policy, it should be checked by your solicitor, HR adviser or data protection adviser. That is especially important if the policy mentions staff monitoring, disciplinary action, personal data, client contracts or regulated information.
A practical way to decide what is safe to use with AI
Staff need clear examples, not vague warnings. A simple traffic-light approach makes the policy easier to follow.
Public information
Information already publicly available or created for public use.
General marketing ideas, public research, website copy drafts, public FAQs.
Can usually be used with approved AI tools, subject to normal review.
Internal business information
Information not public, but not highly sensitive if properly anonymised.
Internal process notes, non-sensitive draft emails, generic policies, anonymised examples.
Use only approved tools. Remove names, identifiers, client details and sensitive values first.
Restricted or sensitive information
Information that could harm people, clients or the organisation if exposed.
Client lists, employee records, health data, safeguarding information, passwords, API keys, bank details, legal documents, contract pricing.
Do not paste into AI tools unless the tool, contract, lawful basis, security controls and approval process have been reviewed.
What needs extra care in the UK?
This is where AI use overlaps with data protection, employment practices, contracts and cyber security. The details matter.
UK GDPR and personal data
If AI tools process personal data, your organisation still needs a lawful basis, transparency, security, purpose limitation and appropriate controls. Staff should not enter personal data into public or unapproved AI tools.
Staff monitoring
If company AI accounts are monitored, staff should be told clearly. Monitoring should be necessary, proportionate and reflected in your internal privacy information.
Automated decisions
AI should not be the sole decision-maker for hiring, firing, disciplinary action, finance approvals, client advice or anything that materially affects people without proper human review.
Copyright and brand risk
AI-generated text, code, images, audio and video should be checked before use. Avoid asking tools to copy a living artist, competitor, brand style, protected logo or copyrighted work.
Client contracts
Some clients may restrict AI use in contracts, NDAs or supplier terms. If a contract says AI cannot be used on their data or deliverables, that contract takes priority.
Regulated sectors
Schools, care providers, finance firms, legal practices, charities and public-sector suppliers may have extra expectations around confidentiality, safeguarding, records, audit trails and supplier assurance.
A quick checklist before giving AI the green light
Before staff start using AI tools with work data, it is worth checking the basics. These are the questions that often reveal the hidden risk.
Have you checked the terms?
Do you know whether prompts, uploads and outputs are stored, reviewed, used for training or processed outside the UK or EEA?
Have you checked the data?
Is the tool being used with personal data, client data, staff data, financial information, health information or contract details?
Have you checked the access?
Does the tool connect to email, files, calendars, Teams, SharePoint, Google Drive, CRM systems or finance platforms?
Have staff been trained?
Do people know what not to paste, how to check AI outputs, and who to ask when they are unsure?
Have contracts been reviewed?
Do client agreements, NDAs, supplier terms or regulated-sector requirements restrict how AI can be used?
Have you agreed who owns it?
Someone needs to own the approved list, policy updates, staff guidance, incident reporting and supplier reviews.
Three sensible steps before AI gets away from you
You do not need to solve every AI question this week. Start with the basics that reduce the biggest risks.
1. Put a policy in place
Agree which tools are approved, what data is off-limits, and who is responsible for oversight.
2. Train your team
People cannot follow rules they do not understand. Short, practical training is usually enough to make a real difference.
3. Check before rolling tools out
AI tools should be set up intentionally, especially where they connect to email, files, calendars, devices or client data.
This is why AI use belongs in your cyber risk conversation.
AI risk is not just about the answer a chatbot gives. It is also about where data goes, what tools connect to your systems, and how easily staff can be tricked.
AI browser extensions
Some extensions can read pages, emails or content in the browser. That may expose more data than the person installing it realises.
Meeting recorders
AI note-taking tools may record, transcribe and store sensitive discussions. They should not join meetings without approval and awareness.
Personal devices
Staff may install AI apps on phones or home laptops that are not managed, patched or protected by your business. If they then access work email or a CRM from that same device, your company data is sitting on a machine with none of your security controls on it. We can lock down work systems — but not personal devices. That is exactly why a clear policy matters.
Deepfake and payment fraud
Voice cloning and realistic fake video can make payment scams more convincing. Finance requests should have a second verification route.
Prompt injection and data leakage
AI tools connected to documents, email or CRM systems can create new risks if permissions, plugins and connectors are not reviewed.
Vendors, freelancers and suppliers
Your AI policy should also cover third parties who handle your data. If a freelancer, contractor or supplier is using personal AI tools with your information, that is still a risk you need to understand.
How we can help without turning this into a huge project
You do not need a 90-page AI strategy to make progress. You need to know what is already happening, agree what is allowed, and give staff simple rules they can follow.
Review current AI use
We help you identify where AI tools may already be used across staff, devices, browser extensions, meeting tools and Microsoft 365 workflows.
Agree approved tools
We help you create a clear approved list, with practical guidance on what each tool can and cannot be used for.
Create or tidy your policy
We can help shape an AI acceptable use policy that fits your organisation, then you can have it reviewed by HR or legal where needed.
Train your team
Short, plain-English training helps staff understand what not to paste, how to check AI outputs, and when to ask before using a tool.
Review controls over time
AI tools change quickly. Your approved list, settings, training and security controls should be reviewed regularly.
Who this is for
- Small businesses using Microsoft 365, Google Workspace or cloud systems.
- Schools, nurseries and care providers handling sensitive information.
- Finance, legal, property, charity and professional services teams.
- Organisations applying for cyber insurance or answering supplier security questions.
- Business owners who suspect AI is already being used but have no policy yet.
What this is not
- We are not claiming to be AI transformation consultants.
- We are not replacing your solicitor, HR adviser or data protection officer.
- We are not telling you to ban AI across the business.
- We are not selling hype, prompts or vague productivity promises.
- We are focusing on practical cyber security, data handling and staff-use controls.
AI acceptable use policy FAQs
How do we run a Shadow AI audit without upsetting staff?
Keep it practical and non-judgemental. Explain that the aim is to support safe AI use, not catch people out. Start with identity logs, SaaS settings, browser extensions and managed device activity, then ask staff which AI tools are helping them save time.
What should we do when we find an AI tool in use?
Map the workflow, classify the data being entered, check whether the account is managed or personal, review retention and sharing settings, then decide whether the use should be approved, restricted, replaced or blocked.
Is it illegal for staff to use AI at work?
Not automatically. The risk depends on what tool is being used, what data is being entered, what the tool does with that data, and whether the organisation has the right controls, transparency and approvals in place.
Can staff use ChatGPT, Copilot, Gemini or Claude for work?
Potentially, but it should be under an agreed policy. Business versions and consumer versions may have different privacy, retention and administration settings. Do not assume a tool is safe just because it is well known.
Can personal data be entered into AI tools?
This needs real care. Personal data should not be pasted into public or unapproved AI tools. Where AI tools process personal data, your organisation needs to consider UK GDPR requirements, contracts, security controls and transparency.
Do we need to tell staff if company AI accounts are monitored?
Yes, this should be handled transparently. Monitoring should be necessary, proportionate and explained through your internal privacy information and acceptable use policy.
Should we ban AI completely?
Usually, no. A blanket ban often pushes usage underground. A better starting point is to approve suitable tools, set clear data rules and train staff on safe use.
How often should an AI policy be reviewed?
At least every six months is sensible for many organisations, or sooner if you introduce a new AI tool, connect AI to business systems, change your data handling process, or enter a new regulated contract.
Want to know whether AI is already creating risk in your business?
We can help you review current AI use, spot obvious data risks, and put a plain-English acceptable use policy around the tools your staff are already using.
Based near Chesterfield, supporting organisations across Derbyshire, Sheffield, South Yorkshire and the wider UK.