// in this post
An AI usage policy can fit on two pages. Here are the seven parts it needs, what goes in each, and four tests for whether your staff will actually follow it.
Most staff are ahead of the policy. A Deloitte UK survey of 25,000 workers, run in May and June 2026, found that 31% of the people using generative AI at work were doing it without their employer knowing. The Department for Science, Innovation and Technology's AI adoption research, published in January 2026, found that very few businesses said they had any internal guidelines on using AI responsibly, and most of those without had no plans to write them. The Office for National Statistics says 30% of UK businesses were using AI in its latest survey, which closed on 4 October 2026. Put those together and the usual picture is AI in use, rules unwritten, and every person deciding for themselves where the line is.
A usage policy fixes the unwritten part. It's the document for your staff: what they can use, what they can put into it, what they must check and who to tell. It isn't the same as AI governance, which is how the business decides who owns AI, keeps a register, approves new tools and reviews all of it every quarter. The policy is one of the things governance keeps up to date. And it isn't a strategy, which says what you're using AI for in the first place.
Why "we trust people to use good judgement" isn't a policy
The UK has no comprehensive AI law, as Lewis Silkin noted in September 2026. Existing regulators apply existing law instead, guided by five principles from the government's 2023 AI white paper. That sounds like room to improvise. In practice it leaves you to turn abstract principles into rules your team can follow, and good judgement needs a line to be judged against.
The regulator that would investigate a data protection failure has already written its own. The ICO's Internal AI Use Policy, version 1.1 published in August 2025, says staff may use only AI approved through its governance process, on approved devices; that a human must review all AI outputs; that content must be checked for third-party intellectual property before it's published; and that AI use should be disclosed where appropriate. It covers contractors and temporary staff as well as employees. If the ICO thinks its own people need that in writing, yours probably do too.
The seven parts
Aim for two pages. The ICO's policy is longer because it also covers procurement and development, with annexes for specialists. For most businesses of 50 to 500 people, that material belongs on the governance side, and the policy staff read can be short.
1. Who it covers, and what counts as AI. Employees, contractors, agency and temporary staff. Define AI by examples people recognise: chat assistants, writing and translation tools, meeting recorders and summarisers, the AI features switched on inside software you already use, and anything that builds or runs automated workflows. The last two are where policies leak, because people often don't think of a "smart summary" button in the CRM as AI.
2. Approved tools, by name. "Use AI sensibly" isn't a rule anyone can follow or break. "Claude and Copilot are approved for drafting and internal analysis; personal ChatGPT accounts are not approved for anything containing client or employee data" is. Say what each tool is approved for, and say who to ask about a tool that isn't listed.
When you ban something, name an alternative that does the job. Of the 3,562 Deloitte respondents who paid for their own tools or used unapproved ones, 21% said those tools outperform what their company provides. A ban with nothing in its place moves the use out of sight.
3. What data can go where. A three-tier split covers most businesses of this size. Public information is fine in any approved tool. Internal business information goes in approved tools only. Client, employee or regulated data needs a specific sign-off, or is banned outright from tools that haven't been checked. Add examples in your own terms: a price list, a client contract, a staff review. The usual failure isn't malice, it's not knowing where the line is until you've crossed it.
UK GDPR applies the moment personal data goes into a tool. The ICO's guidance on AI and data protection was last updated in March 2023 and is being reviewed after the Data (Use and Access) Act, so read it as a starting point and expect changes.
4. Check before it leaves the building. Whoever sends something is responsible for it, whatever or whoever drafted it. Name what to check: names, figures, dates, quotes, links and anything that looks like a source. The more an output leaves the business, the more checking it gets. An internal draft needs a read; a customer-facing document needs a named reviewer; anything regulated needs sign-off. Checking is already common but rarely written down: the DSIT research found that 84% of businesses using AI applied at least some checking to outputs, but only a few said they had a specific procedure for it. This part is the procedure.
5. Decisions about people. AI doesn't make or shape decisions about individuals, such as hiring, performance, discipline, credit, pricing or access to a service, without the owner's sign-off first. The reason is the law. Section 80 of the Data (Use and Access) Act 2025 came into force on 5 February 2026. Significant decisions made only by automated means are now allowed more widely, provided you tell people, give them a way to get a human to review the decision and let them contest it (Bratby Law's summary). The stricter rules for special category data stay, and the ICO's guidance on how it will read all this is still a draft out for consultation. One sentence in the policy is enough. The safeguards belong in your governance, under the highest-risk tier.
6. Telling people. Tell people when you record or summarise them with AI, and when a customer is dealing with AI rather than a person. The ICO's policy asks for disclosure where appropriate. If your AI system's output is used in the EU, the EU AI Act's duty to tell users they are interacting with AI has applied since 2 August 2026.
7. When something goes wrong, and who owns the policy. Name the person to tell, make it the same day, and say that nobody is blamed for reporting. If personal data is involved and there's likely to be a risk to people, the business has 72 hours from becoming aware to tell the ICO, so a report that sits in an inbox costs you time you don't have. End the policy with its owner's name and its next review date. Agents, which act as well as answer, need extra care: the failure modes are in the piece on agent risks and guardrails.
Four tests before you publish it
- A new starter can explain it back in a minute. If they can't, it's too long.
- Every ban has an alternative. Otherwise you've written a rule people will route around.
- There's a named person to ask, with an answer inside a week. A slow route sends people back to using tools unasked.
- It has an owner and a review date. Quarterly is realistic; the rules it points to moved several times in 2026.
Launch it in a half-hour session with examples from your own business, not as an attachment. An attachment gets filed. Ten real-life AI horror stories make useful examples, because they show what each rule is there to prevent.
A starter outline
Copy this and fill in the brackets.
AI usage policy: [Business name]
Owner: [name and role] Next review: [date]
1. Who this covers
Everyone who works for us, including contractors and temporary staff.
"AI" means [chat assistants, meeting recorders, writing tools, and AI
features inside our software].
2. Approved tools
[Tool]: approved for [uses].
[Tool]: approved for [uses].
Anything not listed needs [name]'s approval first. Ask them; you'll
have an answer within a week.
3. Data
Public information: any approved tool.
Internal business information: approved tools only.
Client, employee or regulated data: only with [name]'s sign-off.
4. Checking
You're responsible for anything you send. Check names, figures, dates,
quotes and links before it leaves the business.
5. Decisions about people
AI does not make or shape decisions about hiring, performance,
discipline, credit or pricing without [name]'s sign-off.
6. Telling people
Tell people when you record or summarise them with AI, and when a
customer is dealing with AI.
7. If something goes wrong
Tell [name] the same day. Nobody is blamed for reporting.
Where to start
Write parts 2 and 3 first. The approved-tools list and the three-tier data rules take an afternoon, and they cover the points where staff most need a line. Then add the rest and set the review date.
If you'd rather build this with someone, a Discovery engagement writes the AI strategy, the usage policy and the governance to hold them together with your people, so they are documents your teams use, not ones that sit on a shared drive. Get in touch if you'd like to talk it through first.
FAQ
Does the UK have an AI law that small businesses need to comply with?
Not a single one. As of September 2026 the UK has no comprehensive AI legislation. Existing regulators apply existing law within their own sectors (the ICO for data protection, the FCA for financial services, and others), guided by five principles from the government's 2023 AI white paper: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress. UK GDPR applies as soon as personal data goes into an AI tool. The EU AI Act can also reach you if the output of your AI system is used in the EU.
What should an AI usage policy include?
Seven things: who it covers and what counts as AI, which tools are approved and for what, what data can go where, what must be checked before anything leaves the business, the rule on decisions about people, when to tell people AI is involved, and what to do when something goes wrong, with a named owner and a review date. Two pages that staff read beat twenty that nobody opens.
Do I need a lawful basis under UK GDPR to use AI tools with personal data?
Yes. If you rely on legitimate interests, the ICO says you must complete a three-part test: is the aim a legitimate interest, is the processing necessary for it, and do people's interests and rights outweigh yours. It also says you should record the assessment and its outcome. If the AI makes or shapes a significant decision about a person, the automated decision-making rules in the Data (Use and Access) Act 2025, in force since 5 February 2026, also apply: you need to tell the person, let them ask for human review and let them contest the decision.
What if my staff are already using AI tools I haven't approved?
Assume some are. A Deloitte UK survey of 25,000 workers in May and June 2026 found that 31% of the people using generative AI at work were doing it without their employer knowing. Ask everyone what they use, say plainly that it's so you can approve tools and not to punish anyone, add the useful ones to your approved list, and when you ban something, name an alternative that does the job.