# Do UK Small Businesses Need an AI Policy? (2026)

Short answer: there is no UK law that says "every small business must have an AI policy". But if your staff use ChatGPT, Copilot, Gemini or an AI note-taker for work, a short written policy is the simplest way to show you've thought about where your data goes, and if you have customers or staff in the EU, the EU AI Act's AI literacy duty may already apply to you.

*Last checked: 24 October 2026. Based on the EU AI Act text, the European Commission's AI literacy Q&A and AI tools' own published policies. Not legal advice.*

## Is an AI policy a legal requirement in the UK?

Not as a standalone document. The UK has no equivalent of the EU AI Act. But the rules you already follow still apply when staff use AI tools: if someone pastes customer or employee personal data into an AI tool, that is processing personal data under UK GDPR, and confidentiality duties in your contracts don't stop at the chat box. A policy is how you tell staff what is and isn't allowed before that happens.

## When does the EU AI Act reach a UK business?

The European Commission says the AI Act applies to organisations inside and outside the EU "as long as the AI system is placed on the Union market, used in the Union or its use has an impact on people located in the EU". That explicitly includes the AI literacy duty in Article 4. So a UK business with EU-based staff, or that uses AI in work affecting EU customers, should take it seriously. ([European Commission AI literacy Q&A](https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers))

Article 4 has applied since 2 February 2025, and national authorities supervise and enforce it from 2 August 2026. For what it requires in practice, see [EU AI Act Article 4: what a 10-person UK business must do](https://getpolicypeek.com/guides/eu-ai-act-article-4-ai-literacy-small-uk-business/).

## What is the real risk without one?

The everyday risk is data going somewhere you didn't expect. Many AI tools' own policies allow training on what you type unless you opt out, and some give no opt-out at all. PolicyPeek's ratings of 61 AI tools' own policies (4 November 2026) found 21 that train by default with an opt-out and 14 that train with no opt-out found. ([PolicyPeek](https://getpolicypeek.com/tools/))

Without a policy, each member of staff decides alone which tool to use and what to paste in.

## What should a small-business AI policy cover?

Keep it to one or two pages:

1. **Approved tools.** Which AI tools staff may use for work, and on which plan or account (business plans often have different data terms from free ones).
2. **What never goes in.** Customer personal data, staff records, passwords, unreleased financials, anything under an NDA.
3. **Training settings.** Who switches off "use my data to improve the model" where a tool allows it. Check each tool on [PolicyPeek](https://getpolicypeek.com/).
4. **Checking output.** AI can be confidently wrong. A person checks anything that goes to a customer.
5. **Who to tell.** What staff do if the wrong data goes in by mistake.
6. **Training.** A short session so everyone knows the rules, with a record of who attended.

## How long does it take?

For a small team, writing a first version is an afternoon's work, especially if you start from a template. Review it when you adopt a new tool or a tool changes its terms.


## Changes

- 4 November 2026: PolicyPeek tool counts updated to 61 rated tools. The 10 tools the 28 October audit had flagged stay on the site with their existing verdicts while PolicyPeek re-checks them.

## FAQ

### Is an AI policy legally required for UK small businesses?

No UK law requires a standalone AI policy. But UK GDPR applies if staff put personal data into AI tools, and the EU AI Act's AI literacy duty can apply to UK businesses whose AI use reaches people in the EU.

### Does the EU AI Act apply to UK companies?

It can. The European Commission says it applies to organisations outside the EU when an AI system is used in the EU or its use affects people located in the EU.

### What should a basic AI policy include?

Approved tools, what data must never be entered, training opt-out settings, human checking of AI output, who to tell about mistakes, and short staff training.

### Do I need a certificate to show AI literacy?

No. The European Commission says no certificate is needed; an internal record of training and guidance is enough.