The AI policy your business needs but probably doesn't have

Somewhere in your business, right now, someone is pasting something into ChatGPT that you'd rather they didn't. Maybe it's a client email. Maybe it's a pricing spreadsheet. Maybe it's a draft contract with names and numbers still in it.

They're not doing it to be reckless. They're doing it because it's fast, it works, and nobody told them not to. That's the gap a policy fills. A clear, short set of rules that tells your team what's fine, what needs checking, and what's off limits.

Most businesses with fewer than 50 people don't have one. They should.

Why don't most SMEs have an AI policy?

Three reasons, and they're all understandable.

The first is that it feels premature. You've got five Copilot licences and someone uses ChatGPT for emails. Writing a formal policy for that feels like overkill. The problem is that usage grows faster than you expect. By the time you notice the gap, someone has already fed something sensitive into a tool with no data retention agreement.

The second is that nobody knows who should own it. IT? HR? The MD? In a 30-person business, there's no Chief AI Officer. The policy falls between chairs, and falling between chairs means it doesn't get written.

The third is that most template policies are written for enterprises. They reference compliance teams, data protection officers, and governance boards that don't exist in your business. Reading one of those templates makes the whole thing feel more complicated than it is, so you put it off.

None of those reasons will help you if a client asks what your AI policy is and you don't have an answer.

What goes wrong without one?

Four things. They range from embarrassing to expensive.

The most common is data leakage by accident. Someone pastes client information into a free AI tool. That tool's terms of service say it can use inputs for training. Your client's data is now in a training set you don't control. Nobody intended this. It happened because nobody said it shouldn't.

The second is inconsistent quality. One team member uses AI to draft client-facing documents and reviews every word before sending. Another team member does the same thing and sends the output straight out. Both are "using AI." One of them is going to produce something wrong, and your client won't know AI was involved until the mistake lands.

The third is a growing legal exposure. The UK's approach to AI regulation is still forming, but the direction is clear: businesses will be expected to show they've thought about how they use AI, what data they feed it, and how they check what it produces. "We didn't have a policy" is not a defence that ages well.

The fourth is client confidence. More and more RFPs and procurement questionnaires now ask whether you have an AI policy. If you're pitching for work with larger organisations, the question is coming. Having a clear, honest answer is a commercial advantage. Not having one is a disqualifier.

What should the policy cover?

Six areas. Each one can be a single paragraph. The whole document should fit on two sides of A4.

1. Which tools are approved, and which aren't.

Name the tools your business has approved for use: Microsoft Copilot, a specific version of ChatGPT with the right data settings, whatever transcription tool you use. Then say that any tool not on the list needs sign-off before anyone uses it for work purposes. That single rule prevents most data leakage problems before they start.

2. What data can go into AI tools, and what can't.

Draw a clear line. Internal notes, your own drafts, publicly available information: fine. Client data, personal information, financial figures, anything covered by an NDA or a confidentiality clause: not without checking the tool's data retention terms first. If a tool doesn't have a zero-retention agreement, client data stays out of it.

3. Who reviews AI-generated output before it goes external.

Every piece of AI-generated content that leaves the business should be reviewed by someone qualified to check it. That means a different person depending on the content. A tender response gets checked by the person who owns the commercial relationship. A technical document gets checked by the person with the subject matter knowledge. The rule is simple: no AI output goes to a client, a supplier, or the public without a named person signing it off.

4. When you tell clients you've used AI, and when you don't.

This is the question most businesses avoid, and it's worth having a clear position on. My view: if AI did the thinking, disclose it. If AI did the typing, you don't need to. A proposal drafted with AI assistance and reviewed by your team is your work. An analysis produced by AI and sent without human review is AI's work. Your policy should say where the line sits for your business.

5. How you evaluate new AI tools before adopting them.

Three questions are enough for most SMEs. Does the tool have a data retention policy you're comfortable with? Does it do something your approved tools don't already do? Is there a named person in the business who will own the rollout and check whether it's working after 90 days? If the answer to any of those is no, the tool waits.

6. How often the policy gets reviewed.

AI moves fast. A policy written in September 2026 will need updating by March 2027. Set a review date. Put someone's name on it. When new tools arrive or regulations change, that person updates the document and tells the team. Quarterly is about right for most SMEs. Less often than that and you'll find the document no longer matches what your team is doing.

How do you write one without it becoming a compliance project?

Start with what your team is doing today. Ask each department or function two questions: which AI tools are you using, and what are you putting into them? The answers will tell you where the risks sit and what the policy needs to address first.

Write it in the language your team uses. If your business doesn't use the word "governance," don't put it in the policy. "Check before you send" is a better instruction than "implement a human-in-the-loop review protocol." The goal is a document that people read once and remember. If it reads like a legal brief, it'll sit in a shared drive untouched.

Keep it to one or two pages. Each section should be three to five sentences. If you can't explain a rule in five sentences, the rule is too complicated for a business your size.

Get it reviewed, but not by a committee. One person writes it. One person reviews it. The MD signs it off. Done. You can refine it later. The first version doesn't need to be perfect. It needs to exist.

I worked with an engineering firm that had a documented AI strategy with board-level ownership but zero budget behind it and no operational policy at all. Three AI projects were running independently with no shared rules about data handling. The first thing the strategy recommended wasn't a tool, it was a three-question evaluation gate for every new tool and a data sovereignty clause requiring zero-retention agreements from every vendor touching client data, which is about a week's work, and the tool decisions follow from there.

What should I do this week?

Three things, and none of them require a budget.

First, ask your team what AI tools they're using. You'll find tools you didn't know about, used in ways you didn't expect. That's not a problem. That's the information you need.

Second, write a one-page draft. Use the six areas above as headings. Fill in what applies to your business. It doesn't need to be polished. It needs to exist.

Third, pick a review date. Put it in your calendar for 90 days from now. When that date arrives, check whether the policy still matches what your team is doing. If it doesn't, update it.

The businesses that handle AI well in 2026 aren't the ones with the best tools. They're the ones that set clear rules early and updated them as things changed. A two-page policy written this month is worth more than a 20-page framework you never start.