AI Acceptable Use Policy for Small Businesses

Why a small business needs one now

Most staff already use AI tools at work, whether or not you have approved any. The risk is not the tools themselves. It is client data going into personal accounts on free plans, AI-written content going out unchecked, and nobody knowing who used what when a client asks.

A short written policy fixes most of this. It tells people what is allowed, so they stop guessing, and it gives you something to point to when a client, insurer or tender asks how you handle AI. The UK Information Commissioner's Office publishes guidance on AI and data protection, and its message for businesses is consistent: if personal data goes into an AI tool, UK GDPR applies, and you need to know where it goes.

What goes in the policy

We write it in plain English, usually two to three pages. The sections we cover:

• Approved tools: named products and plans, for example Microsoft 365 Copilot or ChatGPT Business, used only through company accounts.
• Banned data: special category data (health, ethnicity and so on), client financial or legal details, passwords and keys, anything under a non-disclosure agreement, and unpublished company financials.
• Checking: a person checks every AI output before it leaves the business. AI can state wrong facts confidently.
• Disclosure: when you tell clients that AI was used, if your contracts or professional body require it.
• Images, voice and recordings: rules on meeting transcription, recording consent and generated images.
• Coding and spreadsheets: AI-written formulas, macros and scripts must be tested before use.
• Reporting: who to tell if something sensitive was pasted into the wrong tool.

Regulated businesses, such as solicitors, accountants or medical practices, should have the final wording checked by their own compliance adviser. We are IT specialists, not lawyers.

Backing it up with technical controls

A policy that relies only on goodwill does not last long. Depending on your licences, we can add controls that make the right choice the easy one:

• Company accounts only: business AI tools set up with single sign-on, so access ends when someone leaves.
• Verified domains: your company email domain verified with the AI provider, so you can see and manage who is using it with a work address, where the provider supports this.
• App restrictions: with Intune and Microsoft Defender for Business (both in Business Premium), unapproved AI web apps can be flagged or blocked on company devices.
• Data loss prevention: Microsoft Purview DLP policies can warn or stop staff pasting data such as card numbers or National Insurance numbers into browsers on managed devices, depending on your plan.
• Audit: Microsoft Purview audit logs record Copilot interactions so you can investigate an incident.

We will tell you plainly which of these your current licences support and which would need an upgrade. See device management with Intune for the device side.

Rolling it out

1. A 30-minute call to understand what your team does and which tools they already use.
2. A first draft within a few working days, which you edit.
3. Technical controls applied remotely.
4. A short briefing for staff, ideally alongside wider staff security training.
5. A review date, usually every six to twelve months, because AI tools change quickly.

Common mistakes in AI policies

• Too long. A twelve-page policy copied from a large corporate goes unread. Two or three pages that staff can follow works better.
• No named tools. "Use approved tools" means nothing unless the policy says which ones, on which plan, signed in how.
• Nothing about leavers. If AI accounts are personal, chats and uploaded files leave with the person. Company accounts with single sign-on fix that.
• No owner. Someone in the business needs to answer "can I use this new tool?" questions, or people will decide for themselves.

Cost

Drafting, controls and a staff briefing are charged at £45 an hour + VAT. A small business with Microsoft 365 already in place typically needs a few hours in total; we give you an estimate before starting. On the Complete plan at £99 a month + VAT, policy reviews and day-to-day AI questions can use the included hours.

What it costs

Support plans from £25 a month + VAT, or £45 an hour + VAT for one-off fixes. Pick a plan if you want it looked after every month, or pay by the hour for a one-off job.

Related