AI is already part of ordinary work in UK small businesses. It is used to research, summarise documents, draft emails, create marketing copy, analyse spreadsheets and help staff move through routine tasks faster. The problem is not that every owner needs a grand AI transformation programme. The problem is that useful tools are arriving in the workflow faster than the operating rules around them.
The UK Business Data Survey 2026, published by the Department for Science, Innovation and Technology (DSIT), makes that gap hard to ignore. Among businesses handling digitised data, 41% reported using AI for at least one purpose. Usage was 51% among small businesses with 10 to 49 employees, and 41% among micro businesses. Yet, among AI-using businesses, only 17% said they had any AI policy or guidelines; just 5% had a formal written policy. The gap is not between businesses that use AI and businesses that do not. It is between everyday use and clear internal guardrails.
For a small firm, the first answer is not a twenty-page rulebook copied from a multinational. It is a short, practical policy that tells people which tools they may use, what information must stay out of them, when a person must check the result, and who owns the decision. That is operational governance: a way to make work safer, clearer and more consistent while keeping the benefits of AI available.
This is not legal advice and it is not an AI rollout plan. It is a pragmatic starting point for owners who need to manage AI already appearing in the business. Where your use involves personal data, sensitive work, regulated decisions, employment matters or significant customer impact, obtain specialist advice appropriate to the activity.
Why a starter policy matters now
Small businesses rarely adopt AI through a single board-approved project. It usually enters through the side door. A salesperson asks a chatbot to sharpen a proposal. An administrator uses an assistant to summarise a meeting. A manager switches on an AI feature inside email, a customer relationship management system or accounting software. A freelance supplier sends AI-generated copy for approval.
Each action may seem low risk in isolation. Collectively, they create a new set of decisions about information, quality and accountability. If nobody has set expectations, employees are left to guess whether a free public tool is acceptable, whether customer details can go into a prompt, or whether an apparently polished answer can be sent without checking it.
The survey indicates that the most common reported uses of AI are researching information, and summarising or collecting in-house information or drafting reports and correspondence. Those are precisely the uses that can spread quickly across a small team because they feel familiar rather than technical. They are also the uses where a poor source, an overconfident summary or a copied-and-pasted confidential detail can create avoidable problems.
A policy does not need to treat AI as forbidden or mysterious. Its function is much more useful: it turns individual judgement calls into a shared working method. It gives staff permission to use approved tools for sensible tasks, sets boundaries before an error occurs, and gives managers a route to resolve exceptions.
There is also a commercial reason to act. Customers, larger clients and public-sector buyers increasingly ask suppliers how they manage data, security and emerging technology. A concise policy, followed in practice, is a more credible answer than either an absolute ban that no one observes or a vague assurance that staff “use common sense”.
Start with the real risk: uncontrolled use, not AI itself
The wrong first question is, “Which AI platform should we deploy?” The better question is, “What are people already doing with AI, and what could go wrong in those workflows?”
That shift matters because risk depends on the task, the information and the consequence of being wrong. Asking an approved assistant to suggest five neutral headings for a public blog post is not the same as asking one to rank job applicants, interpret a customer complaint, draft medical information, advise on a contract, calculate payroll or decide whether a client receives credit.
The Information Commissioner’s Office (ICO) stresses that organisations using AI must consider accountability and governance, and that a data protection impact assessment may be required where AI processing is likely to create high risk to people’s rights and freedoms. The ICO also notes that a major project involving personal data is good practice to assess carefully. Its AI accountability and governance guidance is a valuable reference point when a use case moves beyond everyday drafting support.
That does not mean a florist, local manufacturer or creative agency needs a complex governance committee before using a writing assistant. It means the business should distinguish between low-consequence assistance and tasks where the output affects people, money, rights, safety or confidential information. Your starter policy should make that distinction visible.
The four-part policy that is proportionate for a small business
A useful first policy can fit on two pages, plus a simple approved-tools list. The key is to write rules people can actually remember and apply. Four sections will cover the majority of everyday decisions.
1. Approved tools: make the safe route the easy route
Do not write “staff may use AI responsibly” and assume everyone will interpret that the same way. Name the tools, accounts and features your business approves. For example, you might approve an AI assistant included in your existing business software subscription, a named design tool under the company account, and a transcription service with settings reviewed by the business.
The policy should say that staff must use company-managed accounts where available, rather than personal logins or unapproved free versions. This gives the business a practical chance to manage access when someone leaves, review supplier settings and keep subscriptions visible. It also makes it easier to give a clear answer to the basic question: “Can I use this?”
Keep a small register alongside the policy. For each approved tool, record the owner, intended uses, account type, whether it connects to other systems, and any restrictions. Review it every quarter or whenever you introduce a new platform. The register does not need to be bureaucratic; a shared spreadsheet is often enough at the start.
Your policy can also include a simple route for requests: if a team member wants a new AI tool, they should ask the named owner before entering business information or connecting it to company files. The owner then checks the use case, supplier terms, security settings, data location where relevant, and whether the tool would create a new processing activity.
- Permitted: use an approved tool for brainstorms, first drafts, summaries of non-sensitive material and formatting assistance.
- Ask first: connect a tool to email, cloud storage, a CRM, finance software or a shared drive; upload a dataset; or use AI to communicate directly with customers.
- Not permitted: use personal or unapproved AI accounts for business work, or install browser extensions and plug-ins that can read company content without approval.
2. Sensitive information: set a clear “do not paste” boundary
This is usually the most important part of the policy. Staff should not have to interpret a long privacy notice mid-task. Give them an unambiguous default: do not enter confidential, personal or commercially sensitive business information into an AI tool unless that tool and use have been explicitly approved for it.
List examples in plain English. They can include customer names, contact details, employee records, CVs, health information, payment information, passwords, API keys, bank details, non-public pricing, contract terms, legal correspondence, unpublished financial results, supplier disputes, product designs and confidential client materials.
Where AI is genuinely useful for a task involving such material, the business should define a safer route rather than rely on workarounds. That might mean using a contracted enterprise product with appropriate controls, removing direct identifiers before use, limiting fields shared, or deciding the task should remain outside AI altogether. The ICO explains that organisations must be clear about the purpose for processing personal data and ensure it is limited to what is necessary for that purpose. Its discussion of purpose limitation in generative AI is a helpful reminder that “it might be useful later” is not a sufficient reason to put information into a system.
The policy should also address prompts as records. A prompt can contain more than a finished document: it can reveal internal strategy, customer circumstances or a combination of facts that identifies someone. Staff should treat what they type, upload or connect to an AI service as an external disclosure unless the business has established otherwise for that approved service.
3. Human review: AI may assist, but it does not sign off
AI output can be fluent, plausible and wrong. It may omit qualifications, invent sources, misunderstand a spreadsheet, use an unsuitable tone or reproduce an assumption hidden in the prompt. A good starter policy therefore states that a person remains responsible for checking output before it is relied on, published, sent externally or used to make a decision.
Be specific about what “check” means. For routine drafting, it means reading the text, verifying key facts and making sure the message fits the customer and brand. For research, it means opening and assessing the original sources rather than treating an AI summary as evidence. For calculations, it means checking the inputs and result independently. For code, it means testing it in a suitable environment and applying normal security review.
Create a higher review threshold for consequential work. AI-generated material should not be the sole basis for decisions about hiring, performance, pay, credit, insurance, eligibility, disciplinary action, health, safeguarding, legal claims or other outcomes that materially affect a person. The ICO’s work on automated decision-making emphasises safeguards, transparency and routes for people to challenge significant decisions and seek human review. Its 2026 guidance update on automated hiring decisions illustrates why “a manager looked at it eventually” is not an adequate control for high-impact uses.
For most SMEs, the operational rule is straightforward: AI can prepare, organise and suggest; an accountable person decides and approves.
4. Accountability: name the owner and define escalation
A policy without an owner becomes a document in a shared folder. Name one person who is accountable for maintaining the approved-tools list, handling questions and recording incidents. In a very small business, that may be the owner or operations lead. In a larger SME, it could be a technology, data protection, finance or people lead, supported by external advisers where needed.
The policy should make every employee accountable too. They are responsible for following the approved-tool and information rules, checking their output, and raising concerns promptly. Managers are responsible for ensuring the policy makes sense in their team’s actual workflows, rather than encouraging quiet non-compliance.
Add an uncomplicated incident route. If someone puts restricted information into the wrong tool, discovers an output error after sending it, sees biased or unsafe content, or suspects an account has been compromised, they should report it immediately to the policy owner. The policy should say not to hide the mistake or attempt a private fix. Fast reporting lets the business understand what was shared, stop further use, preserve relevant information and decide what action is appropriate.
This is consistent with the direction of government support for smaller organisations. DSIT’s AI Management Essentials guidance is aimed primarily at SMEs and start-ups, and frames AI management as a set of internal processes, risk management and communication practices. In other words, governance is not a specialist document reserved for AI developers. It is part of running the business.
Turn the policy into day-to-day practice
Writing the policy is the easy part. Embedding it takes a few deliberate actions, none of which requires a major programme.
First, speak to the people closest to the work. Ask where they already use AI, what saves them time, what information they struggle to handle safely and where outputs are most likely to be sent outside the company. You are looking for real workflows, not impressive demonstrations. A ten-minute conversation with sales, customer service, finance and marketing will reveal more than an abstract brainstorming session.
Second, train through examples. Show a safe prompt using public information and an unsafe prompt containing a customer’s identifiable complaint. Show an AI-generated summary beside the source document and point out what still requires checking. Explain who approves a new tool. A short induction module and an annual refresh are more valuable than a one-off policy email.
Third, build the rules into existing habits. Put the approved-tools list in the same place as other operational policies. Include the AI rules in onboarding. Add a quick AI check to project kick-offs when a team will use a new system or handle customer information. Make the policy owner a visible contact, not an anonymous address.
Fourth, review the policy after real use. If staff keep asking the same question, the wording is unclear. If a valuable task is prohibited, consider whether an approved and controlled route can be created. If a tool adds new integrations or changes its settings, reassess it. The policy should be stable enough to guide behaviour but short enough to update as tools and work change.
What your first policy should not try to do
Do not make the document a substitute for wider obligations. It will not independently resolve data protection, employment, intellectual property, consumer protection, sector regulation, procurement or cyber-security questions. It should direct staff to escalate when a planned use touches those areas.
Do not promise that every AI output will be accurate, unbiased or confidential. Instead, set controls that reduce predictable failures: approved access, information limits, human review and a named owner. Avoid blanket wording such as “AI may never be used” unless that is genuinely how the business operates; blanket bans often drive usage onto personal devices and unapproved accounts.
Finally, do not confuse a starter policy with a mandate to automate every process. The UK Business Data Survey found that only 5% of AI-using businesses reported using automated decision-making tools. Most small-business AI use is still assistance with information and content, not handing decisions to machines. Your governance should match that reality.
Make the first decision a good one
The lesson from the 2026 survey is not that small businesses are failing because they use AI. It is that adoption has become ordinary before internal guidance has caught up. That creates an opportunity for owners: establish a small number of clear rules now, while habits are still forming.
Start this week. Identify the AI tools currently in use, nominate an owner, publish a one-page policy covering approved tools, sensitive information, human review and accountability, then discuss it with the team. Review it in 90 days using what you learn from real work.
That is not an AI strategy in miniature. It is better: a practical operating rule that helps your business use helpful technology without surrendering judgement, confidentiality or responsibility.
