Your staff are almost certainly using AI tools already. Some will be using them well. Some will be pasting client details, CVs, or incident reports into free chatbots without a second thought. Most small businesses I work with have no written rules at all, which means nobody actually knows what’s allowed.
An AI acceptable use policy fixes that. It doesn’t need to be long or technical. A clear two or three page document, explained to staff and reviewed once a year, will cover most of the risk. This article walks through what to include and why.
Why you need one now
The National Cyber Security Centre (NCSC) published a blog in September 2026 on the hidden risks of shadow AI. It defines shadow AI as “the use of AI technology which isn’t captured in an organisation’s approved systems and processes.” Its point is simple: “You cannot manage what you do not know.”
That’s the real problem a policy solves. Banning AI rarely works, and as I explained in how to tell if your team is using AI, people just use it quietly instead. A policy brings it into the open, gives staff approved tools that meet their needs, and sets the boundaries.
There are legal reasons too. If personal data goes into an AI tool, UK GDPR applies in exactly the same way as it does to any other system. And the NCSC’s guidance on AI and cyber security warns that AI tools “can get things wrong and present incorrect statements as facts.” If that wrong answer ends up in a client report, it’s your business’s name on it.
What to include in your AI acceptable use policy
Here’s the structure I recommend for a small business. Adapt the wording to suit, but try to cover each heading.
Purpose and scope
Say why the policy exists and who it applies to: employees, agency staff, subcontractors, and anyone else working on your behalf. Define what you mean by AI tools, for example chat assistants, AI features built into office software, transcription tools, and image generators.
Approved tools
List the AI tools staff may use for work, and say how they should be accessed (ideally through business accounts you control, not personal sign-ups). Business accounts matter because they let you manage access, switch on security settings, and remove people when they leave. Include a simple route for staff to request a new tool, so they’re not tempted to go around you.
When you approve a tool, check its terms. Look at whether your inputs are used to train the provider’s models, where the data is stored, how long it’s kept, and who owns what the tool produces. Keep a note of what you checked and when.
Information you must never put into AI tools
This is the most important section, so make it specific. A typical list for a security, facilities, or construction business would include:
- Personal data about staff, candidates, or members of the public, unless the tool has been approved for that purpose
- Screening and vetting records, including ID documents and references
- Client site details, security arrangements, alarm codes, or access information
- Passwords, system credentials, or network details
- Incident reports, CCTV stills, or witness statements
- Commercially sensitive information, such as pricing, tender responses, or contracts
- Anything a client has asked you to keep confidential
If in doubt, staff should leave it out and ask.
Personal data and UK GDPR
If you do allow personal data in an approved tool, the normal data protection principles apply, including lawfulness, fairness and transparency, data minimisation, accuracy, and security. The ICO’s guidance on AI and data protection says that “overall accountability for data protection compliance lies with the controller”, which means you, not the AI provider.
The same guidance states that in the vast majority of cases, the use of AI will involve processing likely to result in a high risk to individuals’ rights and freedoms, which triggers the legal requirement to carry out a data protection impact assessment (DPIA). Even where you decide the risk isn’t high, the ICO says you still need to document how you made that assessment. Note that the ICO says this guidance is under review following changes made by the Data (Use and Access) Act 2025. Under that Act, the ICO’s functions formally passed to the new Information Commission on 30 September 2026, according to the government’s commencement plan, but the guidance is still published on the ICO website.
Most of the Act’s data protection changes are now in force. Its new rules on automated decision-making came into force on 5 February 2026, according to legislation.gov.uk. If you ever let an AI tool make significant decisions about people without meaningful human involvement (shortlisting candidates, for example), the government’s summary of the changes explains that safeguards must be in place, including giving people information about the decision, a way to challenge it, and access to human intervention. For most small businesses the simplest rule is: AI can help, but a person makes the decision.
The Act also requires organisations that control personal data to make it easy for people to complain about how their data is handled, and to acknowledge complaints within 30 days, in force from 19 June 2026 under section 103. My guide to GDPR for small businesses covers the basics.
Checking accuracy
State clearly that the person using the tool is responsible for the output. Anything produced with AI must be read and checked by a competent person before it’s used, sent, or published. That includes facts, figures, legal references, and dates. For anything client-facing, a second check is sensible.
Transparency with clients
Decide your position and write it down. Some clients will want to know if AI was used to produce work they’re paying for, and some contracts may restrict it. A simple rule is to tell clients when AI has played a significant part in a deliverable, and never to present AI output as independent professional judgement without a person standing behind it.
Intellectual property
Staff shouldn’t upload material you don’t own or aren’t licensed to use, such as a client’s documents or a paid-for standard. They should also understand that the tool’s terms may affect who owns or can reuse what it produces. If ownership of a piece of work matters, check before relying on AI to create it.
Security
Require business accounts with strong passwords and two-step verification where available. The NCSC’s AI guidance describes prompt injection, where “an attacker creates an input designed to make the model behave in an unintended way”, as one of the most widely reported weaknesses in large language models. Treat AI tools that connect to your email, files, or systems with the same care as any other software with that level of access.
Record keeping
Keep a short register of approved AI tools: what each one is for, who owns it, what data it may handle, when its terms were checked, and whether a DPIA was done. That register is what an auditor or client will ask to see.
Training and reporting
Brief staff on the policy at induction and when it changes, and record that they’ve read it. Tell them how to report a mistake, such as pasting personal data into the wrong tool, so it can be dealt with quickly. Mistakes reported early are far easier to fix, and if personal data is involved the clock may already be ticking on a breach assessment. My post on data breach response explains what to do next.
Where ISO/IEC 42001 fits
If AI becomes central to how you work, or clients start asking about AI governance, ISO/IEC 42001:2023 is the international standard for an AI management system. ISO describes it as specifying requirements for “establishing, implementing, maintaining, and continually improving” an AI management system. Because it’s a management system standard, it can sit alongside ISO 9001 or ISO 27001 if you already have them.
Most small businesses don’t need certification to start. A good acceptable use policy, a tool register, and regular review are the foundations that ISO/IEC 42001 would build on anyway. I’ve covered the standard in more detail in ISO 42001 in plain English.
It’s also worth knowing that the Department for Science, Innovation and Technology (DSIT) consulted on an “AI Management Essentials” self-assessment tool, but said in its February 2026 government response that it will not publish it, and plans future guidance on foundational AI governance for SMEs instead.
FAQs
Does a small business need an AI policy?
There’s no specific legal requirement for a standalone AI policy, but if staff use AI tools with business or personal data, UK GDPR, client contracts, and confidentiality obligations all still apply. A written policy is the simplest way to show you’re managing that.
Can staff put personal data into ChatGPT or similar tools?
Only if your business has approved that tool for personal data, checked its terms, and considered a DPIA. The ICO’s guidance says accountability stays with the controller, so the business remains responsible for what happens to the data.
What should an AI acceptable use policy include?
Scope, approved tools, information that must never be entered, personal data and UK GDPR rules, accuracy checking, client transparency, intellectual property, security, record keeping, and training.
Is ISO/IEC 42001 required for using AI?
No. ISO/IEC 42001:2023 is a voluntary standard for AI management systems. It’s useful if AI is central to your services or clients ask for formal assurance.
How often should we review our AI policy?
At least once a year, and whenever you add a new tool or the law or guidance changes. AI tools and the rules around them are changing quickly.
Get a policy that fits your business
CAW Consultancy can write an AI acceptable use policy tailored to how your business actually works, set up your AI tool register, and link both into your existing ISO 27001, ISO 9001, or GDPR arrangements. If you’re considering ISO/IEC 42001, our gap analysis is free.
For staff awareness, ISO Training Institute offers online ISO courses that can support your training records.
Call 01257 824481, email Craig@cawconsultancy.co.uk, or visit www.cawconsultancy.co.uk.
Sources
- The hidden risks of shadow AI, NCSC blog, 7 September 2026
- AI and cyber security: what you need to know (NCSC)
- Guidance on AI and data protection (ICO)
- What are the accountability and governance implications of AI? (ICO)
- Data (Use and Access) Act 2025: data protection and privacy changes (GOV.UK)
- Data (Use and Access) Act 2025: plans for commencement (GOV.UK)
- Data (Use and Access) Act 2025, section 80 (legislation.gov.uk)
- Data (Use and Access) Act 2025, section 103 (legislation.gov.uk)
- AI Management Essentials tool: government response (GOV.UK)
- ISO/IEC 42001:2023 (ISO)
Craig Willetts is the founder of CAW Consultancy Business Solutions Ltd and a UK lead auditor with over 20 years’ experience across ISO management systems and UK security industry schemes.
Leave a Reply