On this page
Key takeaways
An AI policy for a small business sets which AI tools staff and providers may use, what data can go into them, and which outputs a person must check. Leaders set these rules because AI use affects data protection, quality and customer trust. Providers can use AI to work faster, within your rules, and must tell you where they do.
- Leaders decide which AI tools are approved.
- No personal or confidential data in unapproved tools.
- A person checks AI output before it reaches customers.
- Providers disclose where they use AI on your work.
Want a one-page AI use policy to adapt? Message us on WhatsApp.
Chat on WhatsApp →Why must the business set AI rules?
Because the risks land on the business: personal data shared with a tool without a lawful basis, inaccurate content sent to customers, or decisions about people made without human review. The ICO's guidance on AI and data protection makes clear that existing data protection law applies to AI use.
What should an AI policy cover?
One page is enough for most SMEs.
- Approved tools and accounts.
- Data that must never be entered.
- Work that needs human review.
- Decisions AI must not make alone.
- How providers must disclose AI use.
Which decisions should never be left to AI?
Decisions with significant effects on people, such as hiring, firing, credit or complaints outcomes, need meaningful human involvement, and UK data protection law restricts solely automated decisions with legal or similarly significant effects. Final quality checks on customer-facing work should also stay with a person.
How should outsourced teams use AI?
Within your policy, using approved tools, with personal data protected and outputs checked. Ask providers to state where AI is used in your processes and how they check its accuracy. AI can make outsourced work faster and cheaper; the rules keep it safe.
What does this look like in practice?
A pattern we see: staff paste customer emails into free AI tools to draft replies, with no policy saying otherwise. A one-page policy and an approved business account solve most of the risk in a week.
AI policy checklist
- List approved AI tools.
- Ban personal data in unapproved tools.
- Require human review of customer-facing output.
- Keep people in decisions about people.
- Ask providers to disclose AI use.
Next step
Ask your team which AI tools they used this week. The answer is the starting point for your policy.
Message us on WhatsApp, or book a 30-minute consultation.
Chat on WhatsApp →Sources and further reading
- Artificial intelligence · Information Commissioner's Office
- Lawful basis for processing personal data · Information Commissioner's Office
Frequently asked questions
Does a small business need an AI policy?
If staff or providers use AI tools, yes. A short policy covering approved tools, data that must not be entered, work that needs human review and decisions AI must not make alone reduces data protection, quality and reputational risks.
Can staff put customer data into ChatGPT?
Only if the business has approved that tool, has a lawful basis, has checked how the provider handles data and has told customers as required. Many businesses ban personal and confidential data from free consumer AI tools and use approved business accounts instead.
Can AI make decisions about customers or staff?
UK data protection law restricts solely automated decisions that have legal or similarly significant effects on people. Decisions such as hiring, dismissal, credit or complaint outcomes should include meaningful human review by someone in the business.
Written by
Global Bridge Labs (GBL) is a UK–Sri Lanka partner for social media, websites and BPO. Everything here comes from client delivery, not theory.
