AI policy templates for small businesses

[Business name] uses AI tools (such as ChatGPT, Gemini and Copilot) to help with everyday tasks like drafting emails, quotes and social posts. This policy sets out how we use them responsibly.

Our principles

• AI assists our work; a person always reviews anything that goes to a customer.
• We never put sensitive customer data (addresses, financial details, health information) into free, public AI tools.
• We use Business or Team plans where data training is switched off.
• AI output is clearly checked and approved before it is sent, published or acted on.
• Staff are encouraged to use AI for genuine work, not to misrepresent AI output as wholly human-created where it matters.

What staff should do

• Treat AI suggestions as a first draft, not a final answer.
• Check facts, figures and customer names before sending.
• Ask [owner name] before using a new AI tool or putting any customer data into it.
• Never use AI to write fake reviews, mislead customers, or make decisions about people without human oversight.

Review

This policy is reviewed by [owner name] once a year, or whenever we adopt a new AI tool.

Customer data is valuable and protected by UK GDPR. This policy keeps it safe when we use AI tools.

What counts as customer data

• Names, addresses, phone numbers and email addresses.
• Financial details, payment information and invoices.
• Anything that could identify a living person.

The rules

• Never paste customer data into free ChatGPT, free Gemini or any public AI tool that may train on inputs.
• Only put customer data into approved, Business/Team-plan tools with data training switched off.
• Anonymise where you can — “draft a quote for a boiler service” rather than “draft a quote for John Smith at 12 Acacia Avenue”.
• Don't store AI-generated content containing personal data for longer than you need.
• If you're unsure whether something is safe to put in AI, ask [owner name] first.

Before using a new AI tool at [business name], work through this checklist with [owner name].

• What will this tool be used for, and who is responsible for it?
• Does it need any customer or sensitive data? If so, is it a Business/Team plan with training off?
• Where does the data go and is it stored? Check the provider's data policy.
• Will AI output reach customers? If so, who reviews it before it goes out?
• Could this tool make a decision about a person (pricing, eligibility, service)? Keep a human in the loop.
• Do we need to tell customers we're using AI for this? (See Template 5.)
• Have we added it to our AI tools list and briefed the team?

Before any AI-generated content goes to a customer or gets published, the person responsible checks:

• Facts and figures — are prices, dates, names and numbers correct?
• Tone — does it sound like us, and is it appropriate for the customer?
• Accuracy — has the AI invented anything (hallucinated) that isn't true?
• Personal data — does it contain customer details it shouldn't?
• Promises — does it make a promise or commitment we can't keep?
• Approval — has the right person signed it off?

If in doubt, don't send it. Rewrite it yourself or ask for help.

Short, honest wording you can add to your terms, quotes, or website. Pick the one that fits.

Option A — website footer

“[Business name] uses AI tools to help draft and organise some of our communications. A person reviews anything before it reaches you.”

Option B — quote or proposal

“Some parts of this document were drafted with AI assistance and reviewed by our team for accuracy. Please check all figures before agreeing.”

Option C — if you use an AI chatbot

“You may be chatting with our AI assistant. It can answer questions and book appointments. For anything complex or sensitive, just ask to speak to a person.”