Updated 28 September 2026 · By Yann Davies, Managing Director, ABCOM IT Solutions
AI is now part of everyday work in most small businesses, whether or not the business has approved it. A short, practical AI policy is the quickest way to get control. Here’s what to put in one, with a structure you can copy and a one-week plan to roll it out.
Why every small business needs an AI policy in 2026
- Shadow AI is already happening. Microsoft research found 71% of UK employees have used unapproved AI tools at work, often pasting emails, contracts and spreadsheets into free chatbots.
- Few businesses have controls. The UK Government’s latest survey found only 24% of businesses using AI have any practices to manage its risks.
- UK GDPR still applies. If personal data goes into an AI tool, you’re responsible for it, just as with any other system.
- Clients and insurers are asking. Supplier questionnaires and cyber insurance forms increasingly ask how you control AI.
- Microsoft Copilot changes the stakes. Copilot can surface anything a user has access to, so permissions and rules matter more.
The 6 sections every AI policy should cover
A simple traffic-light approach
The best policies give staff a quick rule of thumb. We recommend three levels:
Drafting emails, summarising public information, brainstorming, rewording your own text, using approved tools with a work account.
Anything customer-facing, figures and legal wording, new AI tools or plugins, AI agents that can send email or change files.
Personal or client data in free/personal AI tools, passwords or keys, decisions about people made by AI alone, unapproved browser extensions.
AI policy template outline (copy this)
Use these headings as the structure for your own policy. Keep it to two or three pages, as people won’t read more.
- Purpose and scope: why the policy exists and who it covers (staff, contractors, volunteers).
- Approved AI tools: for example, Microsoft 365 Copilot Chat signed in with a work account. Name the tools and the accounts to use.
- How to request a new tool: who approves it, and what security and privacy checks happen first.
- Data you must never enter: personal data, client confidential information, financial details, passwords and keys, and anything under NDA.
- Checking AI output: a human reviews all AI content before it’s sent, published or relied on. Staff are accountable for what they send.
- Transparency: when to tell clients or colleagues that AI was used.
- AI agents and automation: rules for tools like Copilot Cowork that can send emails or change files, including approval steps and spending limits.
- Copilot and permissions: keep files in the right places, don’t overshare SharePoint or Teams, and report anything you can see but shouldn’t.
- Reporting problems: how to report a mistake, data leak or suspicious AI-generated message, with no blame for reporting quickly.
- Training, review and sign-off: training on joining and every year, a policy review every 6 to 12 months, and staff acknowledgement.
How to roll it out in a week
- Day 1, find out what’s in use: a quick anonymous survey, plus a check of Microsoft 365 app consents and browser extensions.
- Day 2, choose the approved tool: usually Microsoft 365 Copilot Chat with work accounts, which is included with Microsoft 365 business plans.
- Day 3, draft the policy using the outline above.
- Day 4, fix the basics: MFA on all accounts, remove “everyone” sharing on SharePoint and Teams, and block high-risk AI apps if needed.
- Day 5, brief your team in 30 minutes, with examples of green, amber and red uses, and collect sign-off.
Common mistakes to avoid
- Banning AI completely: staff just use it on their phones instead, with no controls at all.
- A 20-page policy nobody reads: short and practical wins.
- Forgetting permissions: a policy doesn’t help if Copilot can see your HR folder.
- No named owner: someone needs to approve tools and answer questions.
- Never reviewing it: AI tools change monthly, so review at least twice a year.
Want it done for you? The AI Readiness Sprint
Our four-week AI Readiness Sprint includes writing your AI acceptable use policy (Week 3), alongside a shadow AI discovery, a Microsoft 365 and permissions security review, and a Copilot readiness roadmap. More answers are in our AI & Copilot FAQs.
Frequently asked questions
Does a small business need an AI policy?
Yes. Most staff already use AI tools, often unapproved ones, and UK GDPR still applies to any personal data they enter. A short AI policy sets approved tools, data rules and checking steps, and is increasingly asked for by clients and insurers.
What should an AI acceptable use policy include?
Approved tools and accounts, data that must never be entered, rules for checking AI output, transparency with clients, rules for AI agents and automation, Copilot and permissions, how to report problems, and training, review and sign-off.
Should we ban ChatGPT at work?
Outright bans rarely work, because staff use AI on personal devices instead. It is safer to approve a work tool such as Microsoft 365 Copilot Chat signed in with a work account, block high-risk tools, and set clear data rules.
How long should an AI policy be?
Two to three pages. A short policy with a simple green, amber and red rule of thumb is far more likely to be read and followed than a long document.
Can ABCOM write our AI policy?
Yes. ABCOM writes practical AI acceptable use policies, either on their own or as part of the four-week AI Readiness Sprint, which also covers shadow AI discovery, Microsoft 365 security and Copilot readiness.
Need an AI policy that fits your business?
We write short, practical AI policies and get your Microsoft 365 ready for Copilot, from our Burgess Hill base. Price on request.
Sources
- Microsoft UK: Rise in shadow AI tools
- UK Government: Cyber Security Breaches Survey 2025/2026
- ICO: Artificial intelligence and data protection
Do not just read it. Act on it.
Reading is the easy part. Book a free IT review and we will tell you, in plain English, where your business stands and what to fix first.