Menu
No data was found
Whether you’re a one-person operation or a growing business with a full team, we’re here to help. Get in touch and let’s talk about what we can do for you.
Whether you’re a one-person operation or a growing business with a full team, we’re here to help. Get in touch and let’s talk about what we can do for you.
Guide updated October 2026
Your team is almost certainly using AI already. ChatGPT for emails, Copilot for meeting notes, something free in the browser for a spreadsheet. An AI policy tells them which tools are fine, what data stays out, and what to do when something goes wrong. This guide covers what yours needs, and the template gets you most of the way in under an hour.
This guide is written for owners and office managers of small and medium businesses in Bristol, Bath, Cheltenham, Swindon, Gloucester and across the wider South West who know they need a policy but are not sure where to start. We Do Your IT Support is a managed IT support provider that helps local businesses put sensible, short, readable ai acceptable use policy documents in place. Not 40-page legal essays.
By the end of this page you will know the five things every ai policy must cover, understand the difference between Microsoft 365 Copilot and public ai tools, and be able to download a free ai policy template for UK SMBs. An ai policy safeguards businesses from data leaks and compliance risks, and yours can be ready this week.
An AI policy (also called an AI usage policy or AI acceptable use policy) is a short written set of rules for how your business uses AI tools. It covers which tools are approved, what data can go into them, how output gets checked, and what happens when someone makes a mistake.
If you have not written anything down, your staff are making the rules up as they go. The Microsoft and LinkedIn 2024 Work Trend Index found 75% of knowledge workers use generative AI at work, and 78% of them bring their own tools. That is shadow AI: well-meant, invisible to you, and running outside your Microsoft 365 security, backups and logging.
Under UK GDPR you need to show “appropriate technical and organisational measures” to protect personal data. If a client list ends up in a free chatbot, “we were going to sort a policy” will not help much. A written policy is the simplest evidence that you considered the risk.
List what is allowed, what is allowed with conditions, and what is blocked. Use business accounts with single sign-on and multi-factor authentication, never personal logins.
Split data into public, internal and confidential. Customer details, bank details, payroll, health information and HR records never go into free or personal AI tools.
AI gives you a first draft, not a finished one. Someone checks facts and judgement before anything reaches a client, a contract or an HR letter.
Tell staff exactly who to tell and how fast. Personal data breaches that carry a risk must be reported to the ICO within 72 hours of you becoming aware, so early reporting matters.
Name a senior owner, usually the MD, with IT handling the technical side. Review it every six months; AI tools change faster than most policies.
Keep it to three to five pages in plain English, with a one-page summary at the front. Use headings that match the questions staff ask: what can I use, what can I share, what if I get it wrong? Then give real examples.
• Use Copilot with your work account to summarise a Teams meeting
• Use Copilot in Word to draft an internal update
• Check every figure before it goes to a client
• Upload a customer database to a free AI website
• Paste disciplinary notes into a personal ChatGPT account
• Copy AI output straight into a contract
Build it into onboarding for new starters and cover it in annual refresher training.
Microsoft 365 Copilot works inside your tenant, using data from Outlook, Teams, SharePoint and OneDrive under your existing Microsoft data protection terms. Free and personal AI accounts sit outside all of that.
Microsoft 365 Copilot
Free or personal AI accounts
Where it runs
Inside your Microsoft 365 tenant
On the provider’s service, often outside the UK
Used to train models
No
Often, unless the user opts out
Who can see activity
Logged and auditable by your IT
Nobody at your business
Sign-in
Work account with SSO and MFA
Personal email and password
Contract
Your Microsoft data processing terms
The user’s own consumer terms
One catch: Copilot respects your existing permissions, so it can surface anything a user can already reach. If your SharePoint is overshared, Copilot will find it. Business plans of ChatGPT, Claude and Gemini are a different conversation too; with the right settings they can be approved tools.
Putting personal data into a public AI tool can count as an unauthorised disclosure under UK GDPR. Prompts may be stored, used for training, and processed outside the UK, which raises international transfer questions as well.
Staff use public AI tools with work data and there is nothing written down.
You do not know where the tool stores data or what its terms say.
Nobody has done a data protection impact assessment for AI use.
There is no data classification, logging or risk assessment in place.
Most of the businesses we talk to are not worried about AI. They are worried they do not know what their team is already doing with it. A two-page policy and an hour of conversation usually fixes that.
Adam Gillett, Head of Business Partnerships, We Do Your IT Support
An editable Word template for UK small and medium businesses, with everything you need to change already marked. Budget 30 to 45 minutes. You will get the Word file and a PDF preview by email.
Section
What it covers
01
Purpose and scope
Who the policy applies to and what it covers
02
Approved, conditional and blocked AI tools
Which tools staff may use, and on what terms
03
Data that never goes into AI tools
The categories that are off limits, with examples
04
Checking AI output before it reaches a client
Who reviews what, and at which point
05
Telling clients, tenders and insurers how you use AI
Disclosure wording you can reuse
06
Microsoft 365 sensitivity labels and Copilot
How labelling changes what Copilot can surface
07
Reporting mistakes and the 72 hour clock
What to do when something goes wrong, and when
08
Ownership, breaches and review dates
Who owns the policy and when it gets revisited
A policy on paper is a good start. Our AI Security Pack makes it stick, with three parts that work together for businesses across Bristol and the South West.
We tailor the template to your business and check it lines up with your acceptable use, information security and data protection policies, so nothing contradicts.
Through Let’s Copilot, your team learns how AI works, what good use looks like, and where human judgement still has to come in.
Data classification, sensitivity labels, data loss prevention, audit trails and blocking of AI tools you have not approved. The rules apply in practice, not just on paper.
With 80% of UK organisations already using AI, a written policy sets clear rules to protect your business, staff and customers. It reduces risks like data breaches, safeguards trust, and shows regulators you have controls in place. AI policies should cover ethical use and data protection. Download our free AI policy template to start.
The essentials are: approved AI tools, data rules, AI-generated content handling, incident reporting, and policy ownership. Also include scope, ethics, guidance, and review frequency. Keep it short, clear, and aligned with existing policies like IT use and data protection. Download our AI policy template for a full example.
Shadow AI is staff using AI tools without IT approval. Risks include uncontrolled data sharing, biased or inaccurate outputs, and no audit trail. Microsoft found over 75% of knowledge workers use AI at work. Combining an AI policy with technical controls like web filtering is the best way to manage this risk.
Microsoft 365 Copilot runs inside your tenant with enterprise data protection and GDPR safeguards. A Copilot policy guides safe use in Outlook, Word, Excel and Teams. A general AI policy covers public tools like ChatGPT and Gemini that lack these protections. Your policy must approve enterprise AI like Copilot and restrict personal AI tools with company data.
ChatGPT use isn’t automatically illegal but becomes a GDPR risk if staff input personal or confidential data without controls. Examples include pasting customer lists or medical details into personal accounts. The safest approach is to ban sensitive data in public AI tools and use secured enterprise tools like Copilot. A clear AI policy is essential. We Do Your IT Support can help you draft and enforce it.
Your team is already using AI. The question is whether they are doing it safely. Download the template and spend 30 to 45 minutes on it with your leadership team, or book a free 30-minute AI review with Adam and we will go through it with you.
