If your team uses ChatGPT, Copilot or any other AI tool, you already have an AI policy. It is just unwritten, and it probably says “paste anything”. A good AI policy for small business use fits on one page and answers four questions: which tools are allowed, what data may go into them, who checks the output, and who to ask when unsure. This guide gives you the structure. It is not legal advice.
The need is practical. A staff member pasting a client’s contract into a free account to get a summary has just moved confidential material to a third party. Nobody meant harm. Nobody told them not to.
Is ChatGPT GDPR compliant in the UK?
There is no stamp that makes a tool compliant on its own. UK GDPR applies to how you use personal data, so compliance depends on the plan you choose, the settings, the data you enter and whether you have a lawful reason to process it. The tool provider’s terms matter, but so do your choices.
One difference is worth knowing. According to OpenAI, business offerings such as ChatGPT Business, Enterprise and the API do not use your inputs and outputs for model training by default. Personal free and paid accounts do have a data-sharing setting switched on by default, which you can turn off under Data Controls. So the same brand can carry quite different risk depending on whose account staff are using. Check the provider’s current terms before you rely on any of this, because they change.
What should an AI policy for small business staff ban pasting?
Draw the line in plain words, because a vague rule gets ignored. A workable starting set: no customer or staff personal data (names with contact details, addresses, health information, payroll), no passwords or access keys, no unpublished financial figures, no client documents covered by confidentiality terms, and nothing you promised a client you would keep private.
Then say what is fine. Public information, your own marketing drafts, anonymised examples and generic questions are usually safe. People follow a rule that tells them what they can do as well as what they cannot.
How do you approve which AI tools are allowed?
Keep a short approved list and name one person who owns it. For each tool record the plan used, whether training on your data is switched off, where it is stored and who has access. Ban personal accounts for work data. Pay for a business plan instead, which typically costs a modest amount per seat per month and gives you admin controls that personal accounts lack.
New tools go to the owner for a quick check before anyone signs up. A five-minute review beats discovering in a year that nine tools hold your customer notes.
What are the UK GDPR basics for AI?
Start with a quick inventory. Ask each team member which AI tools they used last month and what for. Expect a surprise or two. A salesperson running call notes through a free transcription app is common, and it is exactly the sort of use your policy needs to catch.
The principles are the ones you already know. Have a lawful basis for using personal data. Use only what you need. Be open with people about what you do with it. Keep it secure. If an AI tool processes personal data for you, it acts as your processor, so you need appropriate terms with the supplier. For higher-risk uses, such as anything making or heavily influencing decisions about people, think about a data protection impact assessment.
The regulator publishes guidance on AI and data protection, which the ICO notes is under review following new legislation. Read it once and check back for updates. For anything more complicated than routine admin, take advice from a data protection professional.
Why does client confidentiality need its own line?
Because contracts often say more than the law does. An agreement with a larger customer may forbid sharing their material with any third party, which includes an AI provider. Read your biggest contracts, find those clauses, and write a rule: client material only goes into tools approved for client work.
If clients ask what you use, have an honest answer ready. Increasingly, tender questionnaires ask.
Who checks what the AI produces?
A named person, every time, for anything leaving the business. AI makes things up with a straight face. It invents references, misstates prices and gets legal points subtly wrong. The rule is simple: you sign it, you check it. Nobody can say “the AI wrote it” to a customer.
Set stricter review for higher stakes. A social post needs a glance. A quote needs a check against your price list. Anything with legal, medical or financial claims needs a qualified person.
What records should you keep?
Not much, and that is the point. Keep the approved tool list, a note of who agreed what and when, and a log of any incident, such as someone pasting something they should not have. Record how you responded. A reported mistake with a calm fix is a sign the policy works.
Tell staff that reporting is safe. If people fear blame they hide errors, and a hidden error is the expensive kind.
What does the one-page version look like?
Put six headings on a single page: purpose, approved tools, data rules, review and sign-off, reporting problems, and review date. Two or three sentences under each. Add a line saying the policy covers employees, contractors and anyone using firm accounts. Have everyone read it and reply “understood”. Diarise a review in six months, because tools and terms move quickly.
Once the rules exist, projects get easier to start. See what AI can automate in a small business for ideas, and ChatGPT against a custom AI tool if you are deciding whether off-the-shelf is enough. Budget questions are covered in what AI development costs in the UK, and our AI development service builds tools with these rules designed in. If a customer-facing bot is on your list, see what a chatbot costs.
Frequently asked questions
Do I legally need an AI policy?
No law demands a document called that, but UK GDPR does expect sensible controls over personal data.
Can staff use ChatGPT on their own phones for work?
Not for anything confidential, no. Personal accounts sit outside your control, which means you cannot see what was shared, switch off data sharing or delete anything when someone leaves. If people find the tools useful, the answer is to give them an approved business account rather than pretend the habit will stop.
Is AI-written content a copyright or accuracy risk?
Accuracy, certainly. Check every fact.
How often should the policy be reviewed?
Every six months at first. Terms change, new tools appear, and staff will have found uses you did not expect. Treat the first year as a trial and adjust it as you learn how people really work.
Does this apply to a sole trader?
Yes, scaled down. You still handle customer details, and you still carry the responsibility. Half a page is plenty.
If you would like a second pair of eyes on your draft, or want a tool built so that sensitive data never leaves your own systems, send us what you have and we will review it.
