Do we need a policy if we only use Microsoft Copilot?

Yes. Copilot works on your own files and email, so the rules about what goes in, who checks the output and what reaches customers still matter. A one-page policy also covers the free tools people may be using anyway.

Does UK GDPR apply to AI tools?

Yes. Your business stays responsible for personal data your team puts into any tool. The template points staff to your data protection policy; for advice on your obligations, speak to your data protection adviser.

How often should we review it?

At least every six months, and whenever you add a new tool. AI products change quickly, so a short policy that is kept up to date beats a long one nobody reads.

How long should the policy be?

As short as you can make it. The core sections fit on one page. Add an extra section only where your team does that kind of work.

Should staff sign it?

A sign-off helps if you want a record that everyone has read it. Many small businesses record attendance at the team briefing instead.

Can you tailor it for us?

Yes. Writing and rolling out an AI use policy is part of our AI in 90 and AI in 120 programmes, and we can also help on its own after a free 30-minute call.

Free template

A free AI use policy template
for UK small businesses

One page your team will actually read. It sets out which AI tools people can use, what they can put into them, and how to check what comes out. Fill it in on this page, or download it to edit.

Get the template

Word and PDF. Free. Or fill it in on this page.

Why one page

Short and specific beats long and unread

Most staff are already using AI in some form, often free tools on personal accounts. A long policy written for lawyers rarely changes that. A short one that names your tools and gives clear examples does.

This template is the starting point we use with clients. It covers:

Which AI tools are approved, and how to ask for a new one
What can and cannot go into AI tools, in plain English
Checking AI output before anyone relies on it
A person approving anything that reaches a customer, changes a record or moves money
Personal data and UK GDPR
What to do if something goes wrong
Who owns the policy, and when it is reviewed

Policy builder

Fill it in for your business

Type your details and the policy updates as you go. Tick an extra section only where your team does that kind of work. Nothing you type here is sent to us.

Your policy

[Company name] AI use policy

Policy owner: [name, role] · Approved: [approval date] · Next review: [review date, within 6 months]

1. Why we have this policy

We want everyone to use AI to save time and do better work, safely. This policy explains which tools you can use, what you can put into them, and how to check what they produce.

2. Who and what it covers

Everyone who works for [Company name], including contractors and temporary staff.
Every AI tool used for work, on any device, including AI features built into software we already use.

3. Approved tools

Use only these AI tools for work, signed in with your work account: [approved tools].
Ask [policy owner] before using any other AI tool for work, including free versions, browser extensions and AI features in other software.
Do not use personal AI accounts for work, and do not send work files to a personal email address to use them with AI.

4. What you can put into AI tools

In approved tools: our own documents, emails, drafts and data you would normally have access to for your job.
Never, in any tool: passwords or access codes, bank or card details, health or other sensitive personal information, or anything a client or supplier contract says must not be shared.
In unapproved or personal AI tools: only information that is already public.
If you are not sure, treat it as confidential and ask first.

5. Checking what AI produces

You are responsible for anything you send, publish or decide using AI.
Check facts, figures, names, dates and links before you rely on them. AI can be confidently wrong.
If you could not explain or defend the output yourself, do not use it.

6. Customers and decisions

A person reviews anything AI drafts before it goes to a customer, changes a record or moves money.
Do not use AI alone to make decisions about people, such as hiring, pay or performance.

7. Personal data

UK GDPR still applies when you use AI. Follow our data protection policy, and ask [data protection lead] if you are unsure.
Use the least personal data the task needs, and remove names where the task works without them.

8. If something goes wrong

Tell [policy owner] straight away if you put the wrong information into an AI tool or AI output causes a problem. Reporting quickly is what matters; there is no blame for honest mistakes.

9. Help and good practice

Your AI champions: [names]. Our shared prompt library: [location]. Training: [how to book].

10. Ownership and review

[policy owner] owns this policy and reviews it at least every six months, and whenever we add a new AI tool.

Template by PlatformWorks AI (platformworks.co.uk). A starting point, not legal advice: review it with your adviser before use.

Unlock to copy your policy

Highlighted brackets still need your details.

Download

Get the editable template

Tell us who you are and we'll unlock the Word and PDF versions, and the copy button in the builder, straight away.

Section 4 in practice

Can I put this into an AI tool?

The question staff ask most. Search for a type of information to see the rule in an approved work tool and in a personal or unapproved one.

Information	Approved work tool	Personal or unapproved tool
Public informationWebsite copy, published prices, press releases	YesFine to use	Yes
Internal drafts and notesProcedures, meeting notes, proposals in progress	YesFine to use	No
Customer names and contact detailsEmails, phone numbers, account notes	With careUse the least you need	No
Customer contracts, quotes and pricingSigned agreements, rate cards, tenders	With careCheck the contract's confidentiality terms	No
Financial reportsManagement accounts, forecasts, margins	With careOnly if your job gives you access	No
Employee recordsHR files, payroll, performance reviews, CVs	With careAsk the data protection lead first	No
Health or other sensitive personal informationMedical details, ethnicity, religion, union membership	NoNever	No
Passwords, API keys and access codesLogins, tokens, door codes, connection strings	NoNever	No
Bank and card detailsAccount numbers, card numbers, payment references	NoNever	No
Information under an NDAAnything a client or supplier contract restricts	With careOnly if the contract allows it. Ask the policy owner	No
Source code and system settingsScripts, configuration, integration details	With careRemove secrets first	No
Meeting recordings and transcriptsCalls with customers, suppliers or staff	With careTell attendees before recording	No
Legal advice and disputesSolicitor's letters, complaints, claims	With careAsk the policy owner first	No

Adjust these to your contracts and sector before sharing them with your team.

Rolling it out

Three steps to make it stick

1
Fill in the brackets
Add your approved tools, the policy owner, your data protection lead and a review date no more than six months away.
2
Brief the team in 15 minutes
Walk through it at a team meeting with real examples from your own work. Questions now save mistakes later.
3
Name champions and review after 30 days
One or two people per team who help colleagues and collect good prompts. After a month, check what people are using and update the policy.

The 15-minute team briefing

Run it in a normal team meeting, with examples from your own work.

2 minWhy we have a policyWe want people using AI. This keeps it safe.
3 minThe approved toolsShow where to sign in with a work account.
4 minWhat can and cannot go inWalk through three real examples from the table above.
3 minChecking the outputShow one answer that was confidently wrong.
2 minIf something goes wrongWho to tell, and that honest mistakes carry no blame.
1 minQuestions and championsIntroduce the people to ask.

Bought Copilot licences? Our first 30 days guide shows where the policy fits in a wider rollout.

Questions

Do we need a policy if we only use Microsoft Copilot?: Yes. Copilot works on your own files and email, so the rules about what goes in, who checks the output and what reaches customers still matter. A one-page policy also covers the free tools people may be using anyway.
Does UK GDPR apply to AI tools?: Yes. Your business stays responsible for personal data your team puts into any tool. The template points staff to your data protection policy; for advice on your obligations, speak to your data protection adviser.
How often should we review it?: At least every six months, and whenever you add a new tool. AI products change quickly, so a short policy that is kept up to date beats a long one nobody reads.
How long should the policy be?: As short as you can make it. The core sections fit on one page. Add an extra section only where your team does that kind of work.
Should staff sign it?: A sign-off helps if you want a record that everyone has read it. Many small businesses record attendance at the team briefing instead.
Can you tailor it for us?: Yes. Writing and rolling out an AI use policy is part of our AI in 90 and AI in 120 programmes, and we can also help on its own after a free 30-minute call.

This template is a starting point, not legal advice. Review it with your adviser before you adopt it.

Need help tailoring it?

A policy is step one. Using AI well is the point.

Our AI in 90 programme writes your policy with you, then trains every team on its own work and measures the hours saved.

Request a free 30-minute call About AI in 90

A free AI use policy template for UK small businesses