By PolicyPeek

AI Acceptable Use Policy Template for a Small Business (UK, 2026)

An AI acceptable use policy tells staff which AI tools they can use for work and what they must never put into them. For a small UK business it can be one page. Below is a free outline you can copy, plus the decisions you need to make before you fill it in.

Last checked: 24 October 2026. Based on ICO guidance, the European Commission’s AI literacy Q&A, OpenAI’s enterprise privacy page and AI tools’ own published policies. Not legal advice.

Why have an AI acceptable use policy?

The ICO says data protection law almost certainly applies to small businesses, because nearly all of them hold customer and staff details. (ICO advice for small organisations) When staff paste that information into an AI tool, that is processing personal data, and you are responsible for it. An acceptable use policy is how you set the rules before it happens.

It also matters which tools people pick. PolicyPeek’s ratings of 61 AI tools’ own policies (5 November 2026) found 21 that train on your data by default with an opt-out and 15 that train with no opt-out found. (PolicyPeek)

Decisions to make first

1. Which tools are approved. List them by name and plan. Business plans often have different data terms from free ones. For example, OpenAI says it does not train on data from ChatGPT Business, ChatGPT Enterprise or its API by default. (OpenAI enterprise privacy) Its consumer ChatGPT policy, by contrast, says it may train on your content unless you opt out. (ChatGPT on PolicyPeek)
2. Who switches off training settings. Name one person.
3. Who staff tell when something goes wrong.

AI acceptable use policy template (outline)

Copy and edit this:

1. Purpose. This policy sets out how [Company] staff may use AI tools for work.
2. Approved tools. Staff may only use these AI tools for work: [tool, plan, account type]. Ask [name] before using anything else.
3. Never enter. Customer or staff personal data, health information, passwords or access keys, unreleased financial information, or anything covered by an NDA or client contract, unless [name] has approved the tool for that use.
4. Settings. [Name] makes sure “use my data to improve the model” or similar settings are switched off where a tool allows it.
5. Check the output. AI can be confidently wrong. A person checks any AI output before it goes to a customer, is published, or is used for a decision about a person.
6. Be open. Tell your manager when AI did a significant part of a piece of client work.
7. Mistakes. If the wrong data goes into an AI tool, tell [name] straight away. Don’t try to fix it quietly.
8. Training. Everyone using AI for work attends a short session, and we keep a record of who attended.
9. Review. We review this policy every [6 months] and whenever we adopt a new tool or a tool changes its terms.

Do you need anything else?

If a tool will process sensitive data, such as health information or data about children, the ICO says you’re likely to need a data protection impact assessment (DPIA) first. (ICO advice for small organisations)

If you have EU staff or customers, the EU AI Act’s AI literacy duty may apply too. See EU AI Act Article 4: what a 10-person UK business must do. If you’re still deciding whether you need a policy at all, start with Do UK small businesses need an AI policy?

Changes

• 4 November 2026: PolicyPeek tool counts updated to 61 rated tools. The 10 tools the 28 October audit had flagged stay on the site with their existing verdicts while PolicyPeek re-checks them.

FAQ

What is an AI acceptable use policy?

A short document that tells staff which AI tools they may use for work, what data they must never enter, and who checks AI output.

Is an AI acceptable use policy a legal requirement in the UK?

No UK law requires one by name. But UK GDPR applies when staff put personal data into AI tools, and a policy is the simplest way to set rules for that.

How long should a small-business AI policy be?

One or two pages is enough for most small teams. Staff are more likely to read and follow a short policy.

Should the policy ban free AI tools?

Not necessarily, but check each tool’s terms. Free consumer plans are more likely to train on what you type, so many businesses approve only business plans or tools whose policies say they don’t train on your data.

Last updated 24 October 2026. Plain-text version for AI tools: ai-acceptable-use-policy-template-small-business-uk.md.