AI use policy for a small business

Staff in most small businesses already use AI tools, on personal accounts, for work the business has not thought about: drafting emails, summarising documents, writing code, answering customers. A policy that bans all of it is ignored; a business with no policy has confidential information and personal data going into tools on terms nobody has read. The policy says which tools are approved, what must never be entered, how outputs are checked and what the business tells clients, and the contract provisions put the position into its customer and supplier terms. I draft the AI use policy for the business, with the accompanying contract provisions, for a fixed fee of £995, delivered in five working days.

Who this is for

Businesses in England and Wales with a few staff to a few dozen, in any sector, where AI tools are in use.

What matters in a small business AI use policy

The policy a business needs and the ban it does not

A policy that prohibits AI tools is a policy the business cannot enforce and does not want to, since the tools make its staff quicker at work the business is paid for; the policy drafted for the business permits approved tools for stated uses, restricts uses that carry risk (client data, personal data, decisions about people, code into production) to approved accounts and checks, and prohibits the handful of uses that cannot be made safe (entering client secrets into a consumer tool, letting a tool decide a customer's application, passing off generated work as checked), with the three tiers written so that a member of staff can tell which tier their task is in.

The tools, the accounts and the terms behind them

The policy lists the approved tools and requires work use to be on business accounts (a business or enterprise tier whose terms do not permit the provider to train on inputs and which give the business control of the data, as opposed to a free personal account whose terms usually do), names who approves a new tool and what they check (the provider's terms on training, retention, confidentiality, security and location, and the data processing agreement under Article 28 of the UK GDPR where personal data is involved), and requires staff to tell the business about tools they are using so that the list reflects reality; a business that does not know which tools its staff use has a policy for tools it does not have.

Confidential information, clients' data and what never goes in

nothing confidential (trade secrets, clients' data, unreleased plans) goes into a tool whose terms let the provider train on or keep the input, because the Trade Secrets (Enforcement, etc.) Regulations 2018 and the business's confidentiality obligations turn on the steps taken to keep it secret; the policy gives examples staff recognise and explains that on an approved business account with the right terms some of these may be used for stated purposes, while on a personal account none may, and that a client's own contract may prohibit the use of AI tools on its material at all, which the business must check before the work starts.

Personal data, the law and the notice people are owed

the UK GDPR treats personal data entered into an AI tool as processing, requiring a lawful basis, a notice to the people concerned, a data processing agreement with the provider under Article 28 and an impact assessment under Article 35 where the use affects individuals; the policy tells staff that customers', employees' and contacts' data goes only into approved tools under a data processing agreement, that the privacy notice must say the business uses AI tools and for what, that special category data (health, for example) needs a condition under Article 9 before it goes anywhere near a tool, and that decisions with legal or similarly significant effects taken solely by an AI tool fall under Article 22 of the UK GDPR as amended by the Data (Use and Access) Act 2025, which allows them outside special category data only where the safeguards (information, representations, human intervention, contest) are in place, so that a tool may draft the decision but a person makes it.

Outputs, checking and the mistake nobody caught

AI tools produce confident text that is sometimes wrong, cite sources that do not exist, reproduce other people's copyright material and reflect the biases of their training data, and the policy requires every output used for work to be checked by the person using it as if they had written it themselves (facts verified, sources confirmed, figures recalculated, code tested, legal and regulatory statements confirmed), prohibits sending generated content outside the business without that check, and makes the person who sends it responsible for it; the Copyright, Designs and Patents Act 1988 gives no clear owner for a work generated with no human author (section 9(3) names the person who made the arrangements), so the policy also tells staff to keep the human contribution visible where the business needs to own the result.

Disclosure, clients and the contract provisions that go with the policy

The policy states the business's position on telling clients and customers that AI tools were used (not for routine drafting assistance checked by a person; disclosed where a contract requires it, where the client asks, where a deliverable is substantially generated, or where a regulator or professional body expects it), prohibits presenting generated work as something it is not, and sets the record a member of staff keeps where the use matters; the contract provisions drafted with the policy put the position into the business's customer terms (what the business may use tools for, who owns the deliverable, the warranty the business gives and the warranty it does not), its supplier terms (what suppliers may do with the business's data) and its employment contracts and handbook (the policy incorporated, with breach a disciplinary matter), so that the policy and the contracts say the same thing.

What it costs

AI use policy, £995. Internal policy plus the accompanying contract provisions. Five working days.

AI provisions in a contract, £595. Review or draft AI-specific terms in a supply or customer agreement. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• An internal AI use policy your staff will follow, rather than a document that bans everything and is quietly ignored
• Contract provisions covering output ownership, training data, confidentiality and liability
• A defensible position to give customers who ask what your AI governance looks like
• Review of your AI suppliers' terms, including what they reserve the right to change
• Practical guidance on what to permit, what to restrict and what to prohibit outright
• One round of amendments

What is not included

• Technical AI assurance, model testing or bias auditing
• Sector-specific regulatory approval
• Advice on non-UK regulatory regimes beyond flagging where they apply
• Ongoing regulatory monitoring

Questions I am often asked

Should we just ban AI tools?

A ban is ignored and leaves the business with no control over what goes into which tool. The policy approves tools on business accounts for stated uses, restricts the risky uses and prohibits the few that cannot be made safe.

Can staff use a free AI tool on a personal account for work?

Not for anything confidential or involving personal data, because the terms usually permit the provider to retain inputs and train on them. Work use goes on business accounts whose terms the business has checked.

Do we have to tell clients we use AI?

Where a contract requires it, the client asks, a deliverable is substantially generated, or a regulator expects it; not for routine drafting assistance checked by a person. The policy states the position and the contract provisions put it in your terms.

Related guidance and services

• AI contracts and AI use policies, £995, the service this page describes
• Data protection agreements and privacy terms, £795
• Employment contracts and handbooks, £595
• Privacy notice for a company using AI tools on customer data
• AI use policy for a consultancy

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.