Generative AI can save a small business hours each week. It can help staff structure a draft, turn rough notes into a checklist, explain technical language and produce first-pass ideas. But a chatbot is not a blank sheet of paper. Every prompt is a potential disclosure, and the convenience of copying and pasting can bypass the controls a business already uses for email, cloud storage and customer systems.
That matters because AI use is now routine enough to create a real operational risk. The UK Business Data Survey 2026 found that 41% of businesses handling digitised data used AI for at least one purpose in 2025 to 2026. Yet only 18% said they would feel comfortable with business-owned data being used to train external AI models, while 73% said they would feel uncomfortable. The sensible response is not a blanket ban that staff will work around. It is a short, practical AI data policy that makes safe behaviour obvious.
This plain-English template is designed for UK small businesses. It focuses on the question every employee should be able to answer in seconds: what must never be pasted into a chatbot? Adapt the wording to your organisation, have it approved by the owner or leadership team, and make it part of induction, cybersecurity training and day-to-day supervision.
Why an AI data policy belongs in cybersecurity
AI tools can look like ordinary websites or office applications, but the risk is broader than a spelling mistake in a generated email. A member of staff may paste a customer complaint into a public chatbot to make it sound more diplomatic. An accounts assistant may ask it to interpret a spreadsheet. A salesperson may request a summary of a proposal. In each case, confidential information or personal data can leave the systems your business directly manages.
Whether that is acceptable depends on the exact tool, account type, contract, settings, data locations, retention terms, security controls and intended use. “We paid for it” does not automatically mean “any company data may be uploaded”. Equally, anonymising a document is not always enough: a distinctive combination of job title, location, date, transaction and circumstance may still identify someone.
The Information Commissioner’s Office (ICO) explains in its AI and data protection guidance that its resources apply to businesses across the private, public and third sectors. Its guidance also highlights how AI can intensify familiar security and data-minimisation problems. For small firms, the practical lesson is simple: use the minimum information needed, keep a person accountable, and do not make a chatbot the place where sensitive business material is analysed by default.
A policy also reduces “shadow AI”: staff using personal accounts, free services or unapproved browser extensions because they are quick. If people are given safe, useful routes to use approved AI, they are much more likely to follow the rules.
The policy principle: treat every prompt as an external disclosure
A good rule of thumb is to assume that a prompt, uploaded file, image, spreadsheet, meeting transcript or pasted conversation is being disclosed to a third party unless the business has specifically assessed and approved the tool for that data and task.
This is not a statement that every AI supplier trains on every input. Product terms and controls differ, and they can change. It is a behavioural safety rule. Staff should not need to interpret a supplier’s data-processing documentation while racing to finish an email. They should know what is safe to use and when to stop and ask.
Use the following wording as the opening of your policy.
Template: purpose and scope
Our business may use artificial intelligence tools to support work, not to replace professional judgement, confidentiality obligations or required approvals. This policy applies to all employees, directors, temporary staff, contractors and anyone using AI for work on a business device, personal device or business account.
Staff may use only AI tools and accounts that appear on our approved-tools list. Do not enter business information into a personal AI account, a free account, an unapproved application, a browser plug-in or a tool connected to an unapproved third-party service.
Before entering information into an approved tool, staff must check that the task is permitted and that the prompt contains no prohibited data. If unsure, stop and ask the named AI policy owner before proceeding.
Build an approved-tools list, not a vague permission slip
“Use AI responsibly” is not a usable instruction. Maintain a simple list that employees can find in less than a minute, ideally in the same place as your IT and data-protection policies. Name the tool, the approved account type, approved features, permitted users, permitted purposes, prohibited data categories and the person who owns the relationship with the supplier.
For example, a business may approve an enterprise AI assistant for general drafting and brainstorming using fictionalised or fully de-identified material. It may separately approve a meeting-transcription service only for internal meetings, with recording notices and a defined retention period. It may approve no tool at all for analysing payroll, HR files, legal documents or customer support tickets. Granularity prevents dangerous assumptions.
Template: approved tools and access
Only the tools listed below are approved for business use. Approval applies only to the named business account and configured workspace. Staff must not use personal logins, shared passwords, consumer accounts, plug-ins, “bring your own AI” features or integrations unless written approval has been given.
- Approved purpose: for example, drafting generic marketing ideas, improving plain-English wording, creating non-confidential checklists or researching public information.
- Approved data level: public information, internally created non-confidential material, or properly de-identified examples only.
- Not approved: personal data, customer content, financial records, commercially sensitive information, credentials and material subject to confidentiality obligations, unless a separate written assessment explicitly permits it.
- Owner: name the person responsible for reviewing supplier terms, security settings, user access, data retention and changes to the service.
Before approving a tool, check its business terms, data-processing arrangements, settings that affect model training or retention, administrator controls, audit logs, multi-factor authentication, sub-processors and exit arrangements. If personal information may be processed outside the UK, assess the arrangement properly rather than guessing from the location of a server. The ICO’s guidance on cloud services and restricted transfers explains that the contracting entity and the processing arrangement matter, and that businesses should understand how a cloud provider transfers information through its global network.
What staff must never paste into a chatbot
The following should be the clearest section of your policy. It should apply to prompts, uploads, screenshots, voice recordings, copied emails, spreadsheets and pasted chat histories. “I removed the name” is not a sufficient exception unless the business has an approved de-identification process and the use is authorised.
1. Client and customer confidential information
Staff must never paste a client’s confidential information, unless the business has expressly approved that exact AI tool and use case in writing. This includes contracts, statements of work, proposals, pricing, discounts, tender responses, product roadmaps, strategy documents, audit findings, security questionnaires, legal correspondence, meeting notes and unpublished work.
Examples of unsafe prompts include: “Summarise this client’s dispute and draft our reply”; “Improve this bid, including the customer’s budget and buying criteria”; or “Turn this project update into a presentation.” Even where there is no personal data, the information may be protected by a confidentiality clause or may damage the client relationship if disclosed.
A safer alternative is to ask for a generic structure: “Create a neutral template for a project-status update” or “Give me questions to consider before responding to a customer complaint.” The employee then writes the final version inside the company’s approved systems without pasting the underlying case details into an AI tool.
2. Customer, employee and supplier personal data
Do not paste any information that identifies a living person directly or indirectly. This includes names, email addresses, telephone numbers, home addresses, dates of birth, account numbers, order references, IP addresses, customer correspondence, call transcripts, photographs, CVs, performance notes and details that could identify someone when combined.
Use particular caution with special category data and criminal-offence data. Health details, disability information, ethnicity, religious beliefs, trade-union membership, biometric information, sexual-life or orientation information, and alleged offences should never be entered into a chatbot unless there is a specifically documented and legally reviewed arrangement. In a small business, the correct default is simply: do not paste it.
This covers people data inside the company too. A manager must not ask a chatbot to rank named applicants, interpret sickness patterns, rewrite a disciplinary note, assess an employee’s performance or recommend a redundancy selection. Such activity can create privacy, fairness, employment-law and automated-decision risks as well as a confidentiality problem.
3. Financial records and payment information
Never paste bank details, card data, payment links, invoices containing customer details, tax returns, payroll information, pension records, expenses claims, management accounts, cash-flow forecasts, supplier payment schedules or accounting exports. Do not upload screenshots of finance software to ask why figures do not reconcile.
These records may expose personal data, commercially sensitive information and security details in one place. If help is needed, ask your accountant, finance lead, software provider or approved IT support. If AI is approved to explain a formula or accounting concept, use a made-up example with fictional figures rather than a live export.
4. Passwords, keys and security information
Credentials must never be entered into a chatbot, even if the tool claims to be secure. This includes passwords, one-time codes, recovery codes, API keys, encryption keys, private certificates, access tokens, Wi-Fi passwords, remote-access details, firewall rules, security incident evidence, vulnerability reports and system diagrams that reveal sensitive controls.
Developers and technical contractors also need a clear instruction: do not paste proprietary source code, production logs, customer data extracts or secrets into an AI coding assistant unless that tool and repository workflow have been approved. A request to “debug this error” can expose far more than an error message.
5. Legal, HR and high-stakes decision material
Do not input legal advice, litigation strategy, settlement discussions, privileged communications, insurance claims, safeguarding concerns, whistleblowing reports, grievance documents, disciplinary material or records relating to investigations. These documents often contain personal data and carry heightened confidentiality and reputational risk.
AI can help create a generic meeting agenda or a plain-English checklist, but it must not become the decision-maker. A response produced by AI is not legal, HR, tax, medical or regulatory advice. Staff must refer the real facts to the appropriate qualified adviser or internal decision-maker.
Prompt review: the 30-second check before sending
Policies succeed when staff have a routine. Require a short pause before every work-related prompt. The aim is not bureaucracy; it is to catch the moment when a harmless request becomes a data disclosure.
Template: staff prompt-review checklist
Before I send a prompt or upload a file, I will check:
- Is this an approved AI tool, business account and approved feature?
- Is my purpose on the approved-use list?
- Does the content contain a name, contact detail, identifier, customer history or enough context to identify a person?
- Does it reveal confidential client, supplier, employee or business information?
- Does it include money, payroll, tax, payment, passwords, code, security or legal/HR information?
- Can I ask the same question using a fictional, generic or safely de-identified example?
- Would I be comfortable showing this exact prompt to the customer, the business owner and the ICO?
If the answer to any question creates doubt, do not send it. Use an approved internal system, ask a manager, or seek advice from the person responsible for data protection or IT security. Never attempt to solve the uncertainty by pasting less information into an unapproved tool.
Human sign-off: AI may assist, but a person remains accountable
Every AI output used externally or in a material internal decision must be reviewed by a competent person before it is relied on, shared, published or entered into a business system. The reviewer is responsible for accuracy, tone, confidentiality, intellectual-property concerns, factual support, bias and whether the content actually answers the question.
This matters because chatbots can confidently produce incorrect information, invent sources, omit caveats and misunderstand context. A polished sentence is not evidence that it is right. For customer communications, quotations, policies, website copy, technical instructions and marketing claims, staff must check facts against reliable source material and business records. For regulated, legal, employment, financial, health or safety content, obtain the appropriate specialist review.
Template: human-review rule
AI-generated content is a draft, not an authority. A named employee must review and approve it before it is sent outside the business, published, used to communicate with a customer, relied on for a decision about a person, or added to a permanent business record. AI must not make final decisions about customers, employees, applicants or suppliers.
For higher-risk work, add a second approval. For example, require the owner, HR lead, finance lead, data-protection lead or client partner to sign off material that affects money, employment, contractual commitments, security, safety or an individual’s access to a product or service.
Governance, reporting and consequences
Name an AI policy owner, even if that is the managing director in a microbusiness. Their job is to keep the approved-tools list current, review requests for new uses, coordinate with IT or advisers, record training and investigate incidents. The policy should be reviewed at least every six months and whenever the business adopts a new tool, connects AI to a customer relationship management system, changes supplier terms, or experiences a security event.
If your use of AI involves personal data and is likely to create high risk to people, assess it before deployment. The ICO says a data protection impact assessment (DPIA) is a process for systematically analysing, identifying and minimising data-protection risks, and that a DPIA is required before processing likely to result in high risk. Its guidance specifically identifies AI as an example of innovative technology that can be relevant to this assessment. Use the ICO’s DPIA guidance and its AI and data protection risk toolkit as practical starting points. They do not remove the need to consider your own facts, contracts and risks.
Template: report mistakes immediately
If you paste prohibited information into any AI tool, upload the wrong file, use an unapproved account or believe an AI output has caused harm, report it immediately to [name/role] at [contact method]. Do not delete evidence, hide the error or try to resolve it alone. Prompt reporting helps us contain the issue, obtain support from the supplier and meet any legal or contractual obligations.
Make clear that a genuine, promptly reported mistake will be handled constructively. The goal is fast containment and learning. Deliberate disregard of the policy, repeated unsafe use or concealment of an incident may lead to disciplinary action or termination of a contractor engagement.
Make the policy work in a real small business
A three-page policy nobody reads is weaker than a one-page rule people remember. Put the prohibited-data list near the AI tool, not only in an employee handbook. Add it to onboarding. Run a 15-minute example-based briefing: show a safe generic prompt, an unsafe client-email prompt, an unsafe payroll screenshot and a permitted rewritten prompt. Ask staff to practise the 30-second check.
Then test the policy in ordinary workflows. Can the marketing assistant obtain approved wording without uploading a customer list? Can the operations manager improve a process without pasting a supplier contract? Can a developer get coding help without exposing secrets? If the safe route is too slow or unclear, fix the workflow rather than assuming staff will simply be more careful.
AI can be a valuable assistant for UK small businesses, but it needs boundaries that match the value of the information being handled. Start with an approved-tools list, prohibit confidential and personal information by default, require a prompt check and insist on human sign-off. Review the template with your IT, data-protection and professional advisers, communicate it clearly, and give staff a safe way to ask questions. That is how you gain the productivity benefits of AI without turning everyday prompts into your next cybersecurity incident.
