Does an SME need an AI policy?
Yes, as soon as staff start using AI tools at work. The risk is not the technology itself but data ending up in a public model with no rules attached — and a one-page policy removes most of that risk cheaply.
Without a policy, employees guess. Someone eventually pastes a client contract into ChatGPT to summarise it, or drops a spreadsheet of customer details into Claude to reformat it, because no one told them not to. Most of this is well-intentioned — people are trying to work faster — not reckless. That is exactly why a policy helps: it replaces guesswork with a clear rule, stated once, applied consistently.
There is also a data-protection dimension. Personal data handled carelessly can breach UK GDPR obligations, and an AI policy is one part of showing you took reasonable steps to prevent that. This post is not legal advice, and you should not treat it as a substitute for proper data-protection guidance — but the practical starting point below removes the most common everyday risk.
Size is not a reason to skip this. A five-person firm has the same exposure as a fifty-person one the moment a single employee pastes the wrong document into the wrong tool — smaller firms simply have less capacity to absorb the fallout if something goes wrong. Owners sometimes assume a policy is only worth writing once the business is “big enough” to need one, but the risk arrives with the first member of staff who opens ChatGPT at their desk, not at some future headcount milestone.
What should an AI policy include?
An AI policy should cover approved tools, prohibited data, a human-review step, an accuracy reminder, client-disclosure rules, account security, and who owns AI-assisted work. Six or seven short clauses, not a legal treatise.
The temptation is to write something comprehensive and legally airtight. Resist it. A twenty-page policy gets skimmed once, filed, and ignored. A one-page policy in plain English gets read, remembered, and followed. Keep sentences short. Say what staff can do, not only what they can’t. Review it every few months as tools and firm practice change — an AI policy written in 2025 will already be missing tools your team uses now.
Two things separate a policy that works from one that sits in a drawer. First, ownership: someone specific should be named as the person staff ask when a situation isn’t covered, not a vague “management” or “IT”. Second, examples: a policy that says “don’t enter confidential data” is abstract; a policy that says “don’t paste a client’s contract, invoice or medical record into a public AI tool” is concrete enough that staff recognise the situation when it happens. The template below is written with both in mind.
An AI policy template you can steal
Below is a working template with eight clauses. Copy it, fill in the bracketed sections with your own tools and names, and you have a usable policy in under an hour.
- Approved tools. Staff may use [ChatGPT / Claude / …] for work. Other AI tools must be approved by [name/role] first.
- Prohibited data. Never enter client personal data, contracts, passwords, financial details or anything confidential into a public AI tool. If in doubt, leave it out.
- Human review. A person checks AI output before it is sent to a client or published. AI drafts; people decide.
- Accuracy. Treat AI output as a draft that can be wrong. Verify facts, figures and quotes before using them.
- Client disclosure. Follow [our / the client’s] rules on disclosing AI use. When unsure, ask [name/role].
- Security. Use company accounts, not personal ones. Do not share logins.
- Ownership. Work produced with AI on company time belongs to [company].
- Questions. Ask [name/role] before doing anything this policy doesn’t cover.
This template is a practical starting point, not legal advice. Have a solicitor review anything you rely on, particularly around data protection, client contracts and sector-specific rules.
Notice what the template deliberately leaves out. It doesn’t try to list every AI tool that might ever exist, because that list is out of date within months. It doesn’t attempt to cover every regulatory regime a firm might sit under, because that varies by sector. It focuses on the handful of decisions that come up every week — which tool, what data, who checks, who owns it — and leaves the rest to judgement, backed by clause eight: ask when in doubt.
What data should staff never put into ChatGPT or Claude?
Never client personal data, contracts, credentials, financial or health information, or anything under NDA — unless the firm is on a paid tier with contractual data protection and has confirmed that use is permitted.
The distinction matters. Free consumer tiers of most AI tools may use conversations to improve their models unless you actively opt out, which makes them unsuitable for confidential material. Business and enterprise tiers typically offer contractual guarantees that data will not be used for training and will be handled under agreed terms — but the exact protections vary by provider and change over time <!-- CONFIRM: data-handling terms of the specific plan the client uses -->. Check the current terms for whichever plan your team is actually on before deciding what is safe to enter, rather than assuming.
A simple test helps in the moment: would you be comfortable if this text appeared in a public forum tomorrow? If not, it probably shouldn’t go into a tool where you can’t fully control what happens to it next. This isn’t about distrusting AI providers specifically — it’s the same caution you’d apply to any third-party system handling sensitive material, and it’s a habit worth building regardless of which specific tool the team ends up standardising on.
How do you get staff to actually follow the AI policy?
Keep it to one page, explain the reasoning in ten minutes, and pair it with training so staff know the safe way to get the same result. A policy without training only says no; training shows people how to say yes, safely.
Most policies fail not because they’re wrong but because no one explained why they exist. Ten minutes walking the team through a real example — “here’s what happens if client data ends up in a public model” — does more than a page of rules alone. Then show the safe alternative: which tool to use, how to anonymise data first, when to ask before proceeding. That combination — a short policy plus practical training — is what actually changes behaviour, not the policy document by itself.
It also helps to make the policy visible where work actually happens, not just filed in a handbook nobody reopens. A one-line reminder pinned near the team’s shared drive, or mentioned again at a monthly team meeting, keeps it front of mind far longer than a single sign-off email ever will. Treat the policy as a living reference, not a box ticked once at onboarding.
How NeuralGen Academy sets up your AI policy
A starter AI policy is built into every NeuralGen Academy workshop — we adapt this template to your tools and rules and teach the team to work within it on the same day.
NeuralGen is a London AI-visibility and automation agency. In an Academy session, governance and hands-on skills are taught together: staff leave with a working policy and the practical ability to use AI tools within it, not just a document in a drawer. We set the practical starter; a solicitor should still review anything legally relied upon, especially where client data or regulated work is involved.
This matters because a policy taught alongside real practice sticks in a way that a policy emailed round on its own rarely does. During a workshop, the team applies the template to the tools they actually use and the data they actually handle, so the finished policy reflects the firm’s real work rather than a generic template left untouched. See our pricing page for the full range of Academy formats, from a half-day session through to a six-week programme that builds deeper skills across a department.