AI policy for a small UK firm: a one-page template to copy, with the rule behind each line

A small firm's AI policy fits on one page: the ten lines below can be copied today, and each rests on a rule or a vendor term read on 1 October 2026. None of the ICO pages we read requires a document called an "AI policy", but most of the lines state things the law does require, among them a written contract with the supplier, a person involved in any significant decision about someone, no fake reviews, and a notifiable data breach reported within 72 hours.

The table after the policy says which lines are law and which are good sense.

Free tool

AI rules notice to staff maker

Fill in the tool the firm pays for, who checks output and who to tell when something goes wrong. The notice sets out the house rules for AI assistants, as a short email, a cover note for the full policy, or a reminder.

Which letterShort notice to staffCover note for the full policyReminder after a rule was broken Firm name The AI tool and plan the firm pays forName the business plan, for example ChatGPT Business, Claude Team, Microsoft 365 Copilot or Gemini in Google Workspace. List more than one if you use more. How staff sign in to it Who checks output before it goes outthe person who sends or uses itthe office managerthe partner responsible for the client Person to tell when something goes wrong Date the rules apply from Date of the staff meeting to go through and sign the policy What happened (for the reminder)last week a customer's name, address and order history were pasted into a personal chat account to draft a replyDescribe what was done, not who did it. The reminder goes to everyone. Your name and role

Copy the text Print or save as PDF

• Attach the signed one-page policy to the second and third versions.
• Check the tool named is one the firm has a data processing agreement for, and that the privacy notice names that supplier.
• Send the reminder to everyone and keep names out of it; deal with the person concerned separately.
• Where personal data went into a personal account, the 72 hours to decide whether to report runs from when the firm became aware of it, not from the date of the reminder.
• Keep a dated copy of each notice with the policy.

The rule this rests on: ICO, written contract with every processor, data minimisation and breach reports within 72 hours; UK GDPR Articles 22A to 22D; Digital Markets, Competition and Consumers Act 2024, Schedule 20 (fake reviews). A draft to check and adapt, not legal advice.

Works in your browser. Nothing you type leaves this device.

The policy

Copy it, fill in the brackets, sign it and date it.

[Firm name]: how we use AI

1. Tools. We use these AI tools, on business accounts the firm pays for: [list]. Nobody uses a personal account for work.
2. Before a tool is added. [Name] reads its data processing agreement, where it holds data and what it says about training, and records whether a data protection impact assessment is needed.
3. What never goes in. Bank and card details, passwords, health information and anything about a child go into no AI tool.
4. As little as the job needs. Other customer details go only into a tool on the list, and only the details the task needs.
5. Checking. The person who sends or uses the output checks it first: every figure, date, name and statement of law against its source.
6. Decisions about people. No tool decides alone whom we hire, dismiss, refuse or charge more. A named person looks at each such decision and can change it before it takes effect.
7. Being straight with customers. Our privacy notice names our AI suppliers. Nothing we send or publish pretends a machine is a person, and we never post a customer review that a customer did not write.
8. Feedback buttons. Nobody presses thumbs-up or thumbs-down on a chat that contains customer details.
9. When it goes wrong. Tell [name] the same day. If personal data has gone where it should not, [name] decides whether the ICO must be told, which has to happen within 72 hours.
10. Keeping it current. [Name] reads this policy again every six months and whenever a tool or its terms change.

Signed: [owner], [date]

The rule behind each line

On line 6, the person named has to do real work: the draft guidance says the involvement must be "active and not just a token gesture". Our guide to telling customers you used AI covers what a firm must say when a tool does decide alone.

Line 2 has the most reading behind it. The five checks are in is it legal to put customer data into ChatGPT, Claude or Copilot.

Add your trade's rules

The ten lines are the floor. Several of our sector guides carry a policy written for one trade:

• Solicitors: the SRA's warning notice of 17 August 2026.
• Recruiters: a policy for candidate data, built on the ICO's six questions.
• Accountants: the client consent rule in the tax bodies' guidance of 19 January 2026, and a paragraph for the engagement letter.
• Letting agents: a three-line house rule that keeps prescribed notices on the government form.
• Clinics: the extra footing that patient records need before line 3 is relaxed.
• Financial advisers: six conditions before a tool reads a client file.

Where the sector rule is stricter, it wins.

Getting staff to read it

1. Keep it to one page. Explanations go in a separate note.
2. Go through it at a staff meeting and have each person sign the same copy.
3. Pin it where the work is done.
4. When a tool is added or dropped, reissue the page with a new date.
5. Give line 5 a method. The five-step check for AI mistakes is one.

What the policy is not

It does not replace the documents it points to. The contract with the supplier, the privacy notice and any data protection impact assessment are separate; the policy records that they exist and who holds them.

Much of the ICO guidance behind lines 1 to 4 carries a banner saying it is under review after the Data (Use and Access) Act 2025, and the guidance behind line 6 is still a draft. Line 10 exists for that reason.

Overlyft is an AI agency that sets up AI office assistants for ten trades: they are set up in the firm's own office for a fixed price agreed after an audit, the firm pays Anthropic directly for its own Claude plan, and a person approves anything that goes to a customer.

This page is general information, not legal advice.