The moment more than one person in your business starts using AI, someone will do something with it you would not have chosen. Not out of malice, just because nobody ever told them where the line was. A customer’s details pasted into a free chatbot. A price quoted from an answer nobody checked. A reply sent in a tone that is not yours. None of it is anyone’s fault if there were no rules to break.
The fix is not a policy the size of a phone book. It is one page, in plain English, that everyone can actually remember. This is the template we hand small teams, laid out so you can copy it, change the wording to fit your business, and pin it up by the end of the day.
A quick honest note first: this is general, practical guidance to keep a small team sensible, not legal advice. If you handle sensitive data or you are in a regulated trade, have someone qualified check anything you are unsure about.
Step 1: Write down what AI is fine for
Start with permission, not prohibition, or the whole thing reads like a telling-off. List the everyday jobs where using AI is welcome, so people feel free to get on with it.
For most teams that is things like: drafting emails and replies, tidying up your own writing, summarising long documents or notes, brainstorming ideas, and getting a first version of something you will then finish yourself. The theme is that AI helps you do a job faster, and you stay in charge of the result.
Example wording: “You are encouraged to use AI to draft, summarise, tidy and brainstorm. It is a helper, not the final say.”
Step 2: List what AI must never be used for
Now the hard lines. Keep them few and clear. These are the things that cause real damage if they go wrong.
Typical ones: never send anything straight to a customer, supplier or official body without a person reading it first. Never rely on AI for legal, financial, medical or safety advice as if it were fact. Never use it to make a final decision about a person, like hiring or a complaint, on its own. Never pass off a raw AI answer as checked, expert work.
Example wording: “AI never gets the final word on money, people, safety or anything that leaves the building unread.”
Step 3: Spell out what must never be pasted in
This is the one that protects you most, so make it concrete. People cannot follow “be careful with data”. They can follow a list.
Never paste in: customer personal details, card or bank information, passwords or logins, anything covered by a confidentiality agreement, and staff personal records. The simple test to teach: if you would not want it to leak or appear in public, it does not go in. Use business AI accounts rather than personal ones, so your inputs are not being used to train a public model, and the risk drops again.
Example wording: “If you would not put it on a postcard, do not paste it in. No customer data, no card details, no passwords, no confidential documents.”
Step 4: Name who to ask when someone is unsure
Most mistakes happen in the grey area, when someone is not sure and does not want to look daft by asking. Remove that. Put one name on the page as the person to check with, and make it plain that asking is always the right call, never a nuisance.
Example wording: “Not sure if something is OK? Ask [name] first. Asking is never a problem. Guessing wrong is.”
Step 5: Add the golden rule and share it
Above all four sections, put the one rule that carries the most weight: AI drafts, a person checks. Nothing reaches a customer, a supplier or the taxman without a human eye on it first. If people remember only one line, that is the line.
Then actually share it. A policy in a folder nobody opens does nothing. Walk the team through it once in five minutes, pin it up or drop it in the shared chat, and mention it when you bring someone new on. Revisit it every few months, because the tools change and your one page should keep up.
That is the whole thing. Five short sections, one page, no jargon. It will not cover every situation a lawyer could dream up, and it is not meant to. It is meant to keep a normal team sensible on a normal day, which is what actually prevents the messes.
Where to take this
A one-page policy is step one of a calm rollout. The rest, sharing tools and context, controlling cost, and getting the doubters on board, is covered in our pillar guide, Rolling AI out to your team without chaos. Read that next and you have the full picture.
If you would rather write your policy alongside people who set these up for a living, that is exactly what our AI Automation Masterclass in Manchester is for. Half a day at Heron House, laptops open, and you can leave with your own version drafted. Tickets are normally £20. This one’s free, a limited-time offer to launch the series.
And to save yourself the blank page, our free resource pack turns this template into a fill-in-the-blanks sheet. Grab it from the free resources shelf.