An AI acceptable use policy is a one-page document that tells staff which AI tools they may use, what company information they must never paste into them, and who to ask. For a small business, one page is enough, and writing it takes an afternoon.
Your staff are almost certainly using AI already. The question is whether they are using tools you have approved, with data you are happy to share. A short written rule is the cheapest control you can add.
Why does a small business need an AI policy?
Because the risk is ordinary people doing a helpful thing. Someone pastes a client email or a spreadsheet into a chatbot to tidy it up, and company data has left the business.
A survey of 209 security professionals by O’Reilly, run in September 2026 and reported by Help Net Security on 26 October 2026, found that more than half said colleagues at least occasionally put sensitive data into unapproved AI tools. Leaking data through commercial AI tools was a main concern for 49%, and the same share worried about staff trusting AI output nobody had checked.
It is a small sample of security professionals, not of UK small businesses, so read it as a signal rather than a measure of your own firm. The same survey found nearly three in four organisations had AI rules, but fewer than half of respondents called them comprehensive.
What should an AI acceptable use policy include?
Seven points. Each one fits in a sentence or two, and together they fit on a single page.
- Approved tools. Name the AI tools staff may use for work, and say that anything else needs approval first.
- Work accounts only. Staff sign in with their work account, never a personal one, so you can remove access when they leave.
- Data that never goes in. Client personal data, financial details, passwords, contracts and anything marked confidential. Give three plain examples from your own business.
- Check before you rely on it. AI output can be wrong. Anything sent to a client or used for a decision is read by a person first.
- No new AI tools connected to company accounts. Plug-ins, browser extensions and apps that ask for access to email or files need approval, because they can read what the account can read.
- Who decides. One named person approves tools and answers questions. Without a name, the policy is ignored.
- Tell us if something went wrong. Say plainly that pasting the wrong thing is a mistake to report, not a sacking offence. People hide mistakes they will be punished for.
What does a policy look like in practice?
Picture a five-person accountancy. The policy names the approved assistant, says client names and figures never go into any other tool, and says drafts are checked by the person who sends them. It names the managing director as the person to ask. That is the whole document.
Compare it with the alternative, where each person decides alone. One uses a free chatbot on a personal account, another installs a browser extension to summarise email, a third asks an AI to rewrite a client letter with the client’s details left in. None of them thinks they are doing anything wrong.
Writing the rule does not stop all of that on its own. It gives you something to point to, and it lets you set up the technical side to match.
Who should own the policy?
Someone with authority over how people work, usually the managing director or operations lead, with your IT provider advising on the technical side. It is a management rule, not an IT setting.
IT’s job is to make the rule easy to follow: approved tools available, unapproved ones harder to reach, and accounts managed so access is removed when someone leaves. The policy and the setup need to match.
How do I get staff to follow it?
Keep it short, explain why, and put it in front of people. Walk through the policy in a team meeting with real examples and ask for questions. The same survey found that shadow AI was described as widespread by 17% of respondents at companies with comprehensive policies, against 35% at those with only basic ones (O’Reilly survey, reported by Help Net Security, 26 October 2026). Detail seems to help, though the survey does not prove cause.
Review it every six months. The tools change quickly, and a policy that names last year’s tools looks out of date.
What if someone has already pasted something in?
Do not panic, and do not hunt for who did it. Find out what was shared, with which tool and on which account, and tell the person responsible for data protection in your business. If the content included personal data, that person decides whether it needs reporting.
Then fix the cause. Usually it is that there was no approved tool, or nobody knew the rule. A policy written after a near miss is a better policy than one written in the abstract, because you know which examples to use.
Where does IT support fit in?
INDIGO IT, a managed IT support and cyber security provider in Camberley, Surrey, manages Microsoft 365 and cloud services for businesses as part of its managed IT support, so the accounts and sign-ins behind a policy like this are part of the day job. The NCSC’s Small Business Guide is a good free starting point for the wider basics.
If you would like to talk through how your Microsoft 365 setup is managed, speak to Matt. If you want to start smaller, copy the seven points above into a document, fill in your approved tools and share it with your team.
Frequently asked questions
What is an AI acceptable use policy?
A short document that sets out which AI tools staff may use for work, what information must never be entered into them and who approves new tools. It turns an unspoken assumption into a written rule.
Do small businesses need an AI policy?
Yes, if staff use AI tools at all, which most do. A one-page policy is enough, and it is far cheaper than dealing with client data that has been pasted into an unapproved tool.
What should staff never paste into an AI tool?
Client personal data, financial details, passwords, contracts and anything marked confidential. Your policy should give three examples from your own business so the rule is concrete.
Who can help a Surrey business with the IT side of an AI policy?
Your IT provider can manage the Microsoft 365 accounts and sign-ins behind it. INDIGO IT, a managed IT support and cyber security provider in Camberley, Surrey, manages Microsoft 365 and cloud services as part of its managed IT support for local businesses.
