Writing an AI Use Policy for a Small Employer
Share
Most small employers discover they needed an AI policy through an incident. It takes an afternoon to write and it prevents the incident.
Direct answer
A workable AI policy for a small employer is one page with three sections. What must never be pasted into any tool, which tools are approved, and who checks output before it reaches a customer. Name specifics rather than principles.
Based on the AI and Automation Practitioner standard (ST1512), a Level 4 apprenticeship for people already in work. Funding rules described here are the England position and are set by the funding body.
Potentially free for you
The learner never pays. Employers potentially pay nothing either, and where the apprentice is aged 16 to 24 the government funds the whole cost even if the employer does not pay the levy.
Closing any gap. A levy transfer from another employer covers 100% of the cost. Unused transfer allowance is not carried forward at the end of the tax year, and it must be agreed before the apprentice starts.
From 1 August 2026 the government stopped adding the 10% top-up to new funds entering levy accounts, so there is less in the system than there was.
Part of our guide to AI for UK Business: Where It Pays and Where It Does Not.
Section one: what must never go in
List the categories specifically. Customer records, employee data, contract terms, anything under an NDA, anything with a bank detail in it.
Be careful is not a policy. People need to know which document on their desk is the problem.
Give the practical test alongside. If you would not email it to a supplier, do not paste it into a public tool.
State the exception clearly. Tools operating inside your own tenant under your existing controls are treated differently, and staff need to know which is which.
Section two: approved tools
Name them. An open list produces twenty subscriptions, no oversight and no support.
Say what each one is for. One general assistant, whatever is in your existing stack, and a note-taker if relevant.
Say how someone requests a new one. Without a route, people just sign up, which is how shadow tooling starts.
Review the list every six months. Tooling changes faster than policy documents usually do.
Section three: checking
Name who checks output before it reaches a customer. A person, not a principle. Unowned checks do not happen.
Say what must always be checked. Any number, any name, any date, any claim about rules or entitlements.
Say what does not need checking, because a policy that requires everything to be checked gets ignored entirely.
Add one line on disclosure. Decide whether customers are told when content is AI-assisted, and be consistent.
There is more on this in our guide to AI for UK businesses.
What not to put in it
Legal boilerplate copied from a large corporate. It does not fit your business and nobody will read past the first page.
A ban on AI generally. Staff will use it anyway, unrecorded, which is considerably worse than a policy with boundaries.
Detailed technical restrictions you cannot enforce. A policy you cannot check is a document rather than a control.
Anything that requires a lawyer to interpret. If your team cannot follow it without asking, it will not be followed.
The paragraph most policies are missing
What happens when someone gets it wrong. Staff who fear a disciplinary for an honest mistake hide the mistake instead of reporting it.
Say plainly that reporting a near miss quickly is what you want, and that it will not be treated as misconduct.
That single paragraph is what turns a policy into something that gives you visibility rather than false comfort.
The exception is deliberate breach after training, and it is worth saying that too so the distinction is clear.
The UK GDPR points to cover
Name your lawful basis for anything involving personal data. For most workplace use it is legitimate interests, and it should be written down.
Say where processing happens. If a tool processes outside the UK, your contract needs appropriate transfer safeguards.
Update your privacy notice if the way staff or customer data is processed changes. This is quick and it is frequently forgotten.
The Information Commissioner's Office publishes free guidance for small organisations. It is short, practical and written for people without a legal team.
Making it stick
Circulate it once, then mention it once more a month later. Single circulations are forgotten within a fortnight.
Put it where people work rather than in a policy folder. A pinned message in the channel they use beats a document nobody opens.
Name a person to ask when unsure, and make sure that person actually answers.
Revisit it after any near miss. The near miss tells you which line was unclear, and that is worth more than a review cycle.
Key takeaways
- One page, three sections, specific categories rather than principles.
- If you would not email it to a supplier, do not paste it into a public tool.
- Name approved tools and a route to request new ones.
- Name the person who checks output, not a principle.
- A blanket ban produces unrecorded use, which is worse.
Frequently asked questions
Does a small business need an AI policy?
Yes, and one page is enough. It should cover what must never be pasted in, which tools are approved, and who checks output before it reaches a customer.
What should staff never put into an AI tool?
Customer records, employee data, contract terms, anything under an NDA and anything with bank details, unless the tool operates inside your own tenant.
Should we ban AI at work?
No. Staff will use it anyway without a record, which is considerably worse than use with boundaries you can see and support.
Who should check AI output?
A named person, not a principle. Unowned checks do not happen, which is how errors reach customers.
Do we need a lawyer to write it?
For a small employer, generally not. A policy requiring legal interpretation will not be followed by the people it applies to.
Should customers be told when content is AI-assisted?
That is a decision to make deliberately and apply consistently. Inconsistency is what causes reputational problems rather than disclosure itself.
How do we make the policy stick?
Put it where people work rather than in a policy folder, name someone to ask, and revisit it after any near miss.
How often should we review it?
Every six months at least. Tooling and licensing change faster than policy documents usually do.
The funded route, in figures
Figures are the England position. Levy-paying employers usually draw the whole cost from the levy they already contribute, so they pay nothing extra. Employers below the £3 million pay bill threshold pay nothing for an apprentice aged 16 to 24. For an older apprentice the government funds 95 per cent, and a levy transfer from a larger employer can cover the rest. Eligibility and funding rules are set by the funding body and can change.
Where to go next
If you want AI governance built into someone's role and assessed formally, the funded route covers responsible use on your own work.
We help UK employers and employees access government-funded AI training. Training is delivered by third-party providers. We do not guarantee a place, a qualification, a job or any particular outcome. Eligibility and funding rules are set by the funding body and can change. Always check the current position before you commit. See our disclaimer.