A one-page AI policy works for a 30 person firm because people read it, remember it and can follow it without asking anyone. Twenty pages written for a bank do not survive contact with a busy Tuesday. What the page has to do is settle five things once: which tools are approved, what data never goes in, how outputs are checked, who to ask, and what is allowed in front of customers.
The template is further down, ready to copy. First, why one page, and the reasoning behind each of the five parts, so you can adjust it to your business.
Why one page beats twenty
Most of the risk in a small firm comes from small moments. Someone pastes a customer email into a free chatbot to speed up a reply. Someone sends a quote they did not fully read. None of that is malice, and none of it is covered by a long document that nobody opened.
A short policy has three advantages in a team of 30. It fits in an onboarding conversation. It can name one real person to ask, instead of a committee. And it can be reviewed in ten minutes twice a year, so it stays true. If you want the fuller framework with a register of AI uses and risk tiers, our guide to lightweight AI governance covers it. This page is the first step of that, not a replacement.
The British Chambers of Commerce makes the same practical point in its 2026 AI research: the risks it describes can be reduced by training staff on how and when to use AI, and on not relying on outputs as gospel. A one-page policy is the written version of that conversation.
The five things it must cover
1. Approved tools and account types
Name the tool and the type of account. “ChatGPT Business, signed in with your company email” is a policy. “Use AI responsibly” is not. The account type matters because the data terms differ: on personal and free accounts your content can be used to improve the model unless someone changes a setting, while business plans do not train on it by default. We explain the tiers in where your data goes in ChatGPT and Claude. Say plainly that personal accounts are out for company work, including on phones, and give people a quick way to ask for a new tool.
2. What data never goes in
Staff need a rule they can apply in a few seconds, so a traffic light works better than a list of data categories. Green is public information and your own drafts. Amber is internal material and customer or supplier contact details, in approved tools only. Red never goes into any AI tool: passwords, bank and card details, health or HR records, anything under a non-disclosure agreement.
The amber rule rests on data minimisation. The ICO’s guidance says the key is that you only process the personal data you need for your purpose. In practice that means: if the task works with the names removed, remove them. The ICO also says that sharing personal data with a company so it can improve an AI model needs a lawful basis, and that where possible you should anonymise the data or remove identifiable details. Our piece on customer data and LLMs under GDPR goes further.
3. Checking outputs
One sentence does most of the work: you are responsible for anything you send, whoever or whatever drafted it. Then name the things that need a second pair of eyes: quotes and any figures, contract and HR wording, safety and financial advice. The ICO’s advice on AI meeting-notes tools says outputs must be checked for accuracy, which is the same principle at small scale. If you want examples of where AI helps and where it needs this check, see our guide to AI for small businesses.
4. Who to ask, and what to do when it goes wrong
Name a person and a channel. Then add the rule that matters most: if someone pastes something they should not have, they tell that person the same day. Some of those slips will be personal data breaches. The ICO says a notifiable breach must be reported to it without undue delay and no later than 72 hours after you become aware of it. A policy that makes people afraid to report slows everything down.
5. Customer-facing use
Three rules cover most of it. No AI-written message goes to a customer without a person reading it first. If a customer is talking to an AI, they are told. And AI does not make decisions about people, such as hiring, discipline or credit, on its own. We hold ourselves to a similar standard, and it is set out on our responsible AI page.
The template
Copy this into a document, replace the square brackets, and have a solicitor look it over if your sector has specific rules. It is a starting point, not legal advice.
AI USE AT [COMPANY NAME]
Version 1. Owner: [name]. Review by: [date, six months from now]
WHY THIS EXISTS
AI tools save us time. This page explains how to use them without
putting customers, colleagues or the company at risk. If something
is not covered here, ask [name] before you go ahead.
1. WHICH TOOLS YOU MAY USE
- [ChatGPT Business / Claude Team], signed in with your company email.
- Free or personal accounts of any AI tool are not to be used for
company work, including on your phone.
- Want to try another tool? Ask [name]. We will answer within [a week].
2. WHAT GOES IN
GREEN: public information, your own drafts, general questions.
AMBER: internal documents, customer and supplier names and contact
details. Approved tools only, and only what the task needs. If it
works with names removed, remove them.
RED: never goes into any AI tool. Passwords and access codes, bank
and card details, health, HR or disciplinary records, anything under
a non-disclosure agreement, anything a customer has told us is
confidential.
3. CHECKING WHAT COMES OUT
- You are responsible for anything you send, whoever or whatever
drafted it.
- Check every number, name, date and claim against the source.
- Quotes, contracts, legal or HR wording, safety and financial advice
are read by [name or role] before they go out.
- Never present AI output as expert advice.
4. CUSTOMERS
- No AI-written message goes to a customer without a person reading
it first.
- If a customer is talking to an AI, they are told.
- AI does not make decisions about people (hiring, discipline,
credit) on its own.
5. IF SOMETHING GOES WRONG
- Pasted something you should not have? Tell [name] the same day.
Reporting it is never a disciplinary matter. Delay is what makes
it worse.
- Output that looks wrong? Tell [name] so we can fix it for everyone.
QUESTIONS: [name], [email or channel]Making it stick
A page nobody remembers does not help anyone, so three small habits do more than extra wording.
Put it in the onboarding pack and read it through with each new starter in ten minutes. Pin it where people already work, whether that is your intranet or a team chat channel. And book the review date in the diary now, because the tools and their terms change often enough that last year’s page can be quietly wrong.
You may find that you need more than a page. The ICO says a data protection impact assessment is required where processing is likely to result in a high risk to individuals, and that if you are in any doubt it recommends doing one. The ICO notes that this guidance is under review following the Data (Use and Access) Act, so check the current version. Drafting emails in a business account is a different order of risk from running customer records through a tool at scale or using AI to make decisions about people. When you move towards the second kind of use, the page is where you start, not where you stop.
If you would like help adapting this to your firm, and a short session to walk your team through it, book a 30 minute call. We will tell you what to change in the template and what, if anything, needs a proper review.