What Founders Should Put In An AI Use Policy

AI use often starts a little informally.

A founder tries an AI tool to draft an email, summarise a document or brainstorm a few ideas. It works well, so the rest of the team starts experimenting too.

Before long, one person is using AI for marketing content, another is uploading customer documents for review and an AI meeting assistant is joining calls that may contain confidential information. The business is using AI in several different ways, but nobody has properly decided where it should be used, what information can be entered or who is responsible for checking the result.

That is where an AI use policy becomes useful.

An AI use policy can help make sure everyone understands where AI fits into the business, where the boundaries are and what needs to happen before AI-generated work is relied on.

What Is An AI Use Policy?

An AI use policy is an internal document explaining how employees, contractors, directors and other people working in the business can use AI.

It might cover generative AI platforms, meeting transcription tools, chatbots, automated decision-making systems and AI features built into software your team already uses.

A useful policy should answer practical questions.

Can someone use AI to improve an internal email? Can they upload a customer contract for analysis? Can AI draft a response that will be sent directly to a customer? Can an employee connect an AI tool to the company inbox or customer database?

There is no single answer that works for every business. The right rules will depend on what the business does, what information it handles and what could happen if an AI tool produces an incorrect result or exposes information it should not.

Can I Just Use An Online AI Policy Template?

A template can be a place to start, but it should not be treated as a finished policy.

The UK Government does not currently provide a general fill-in AI use policy for private businesses. It has, however, published AI Management Essentials, commonly known as AIME.

AIME is a self-assessment framework aimed particularly at SMEs and start-ups. It helps businesses consider whether they have clear AI policies, appropriate records, assigned responsibilities and processes for assessing risks and reporting problems.

It can give founders a useful structure to work from, but it will not decide how AI should be used inside a particular business.

A care provider handling health information will need different rules from a marketing agency using AI to brainstorm campaign ideas. A recruitment business may need additional safeguards where AI influences decisions about applicants, while a software company may be more concerned about source code, confidential product information and ownership of AI-assisted work.

Simply adding your company name to an online template may create a policy that looks complete but gives staff little help when a real situation arises.

The better approach is to use a template or government framework as a starting point, then tailor it to the work, tools and risks inside your business.

Decide Where AI Can Be Used

The first question is not simply which AI tools your team can access. It is where AI is appropriate in the business and what it may be used for.

Most businesses will not need to choose between allowing AI everywhere and banning it completely.

You might allow staff to use AI to brainstorm ideas, reorganise non-confidential text or prepare an early first draft. Approval may be required before it is used for customer communications, contract analysis, recruitment, financial information or work involving personal data.

Some uses may be prohibited. This could include impersonating another person, creating deceptive content, making final decisions about employees or customers without meaningful oversight, or providing professional advice without review by someone suitably qualified.

The policy should also identify which tools are approved for each purpose.

Approving one platform does not mean it is suitable for every task. A secure business account may be appropriate for drafting an internal document but not for processing health information or assessing job applicants.

Free public tools, personal accounts, meeting assistants, browser extensions and AI features built into other software may all need different rules.

Before approving a tool, the business should understand how it handles information. This may include where data is stored, whether prompts or uploads are used to improve the provider’s systems, who can access them, how long information is kept and what happens when the account is closed.

Staff should also know how to request approval for a new tool. Otherwise, people may simply adopt whichever platform is easiest to access, leaving the business with little visibility over where its information is going.

Be Clear About What Staff Can Enter

One of the most important parts of an AI use policy is explaining what information staff may and may not enter into an AI system.

A general warning not to upload confidential information is rarely enough. People can have very different ideas about what counts as confidential.

The policy may need to address customer information, personal data, special category data, financial records, business plans, contracts, source code, passwords, access credentials, legally privileged material and documents supplied by another party in confidence.

The rules may depend on the tool. Entering information into an approved business account with appropriate contractual and security protections may create different risks from pasting the same material into a free public chatbot through a personal account.

Where personal data is involved, the UK GDPR and Data Protection Act 2018 may apply. The business may need a lawful basis for using the information, must be transparent about what it is doing and should avoid collecting or sharing more data than necessary.

A data protection impact assessment may also be required where the proposed use is likely to create a high risk to people’s rights and freedoms. This may be particularly relevant where AI is used to process sensitive data, evaluate people or make significant decisions about them.

The most useful policies give examples connected to the team’s actual work. Telling a sales team not to upload unannounced pricing information, or telling customer support staff not to enter identifiable complaint records into an unapproved tool, is clearer than relying on a broad reference to sensitive data.

Explain How AI-Generated Work Must Be Reviewed

AI can produce useful work, but it can also generate information that is inaccurate, outdated, incomplete or entirely invented.

Using an AI tool does not transfer responsibility for the final result to the technology or its provider. If AI helps prepare a customer email, marketing claim, report or recommendation, the business still needs to make sure it is appropriate before it is used.

The policy should explain what review is required and who is qualified to carry it out.

A rule saying that a human must check the output is only useful if that person can recognise when it is wrong. Someone without legal, medical, financial or technical expertise may not provide meaningful oversight simply by reading the result before sending it.

Depending on the task, factual claims may need to be checked against reliable sources, customer-facing content may need management approval and specialist information may need review by someone suitably qualified.

Additional care is needed where AI is used in recruitment, performance management or other decisions about workers. Businesses should consider whether a system could produce unfair or discriminatory outcomes and whether its use complies with data protection and equality laws.

Specific safeguards also apply where a significant decision is made solely through automated processing, without meaningful human involvement. This can include informing the person, allowing them to contest the outcome and giving them access to human intervention.

The higher the consequences of getting something wrong, the stronger the review process should be.

Set Rules For Customer-Facing AI

AI used to organise internal notes usually presents a different level of risk from AI used to speak to customers, recommend products or process requests.

If your business uses AI for marketing, customer support, chatbots, automated emails or personalised recommendations, the policy should explain what must happen before the output reaches a customer.

Marketing claims still need to be accurate. Product information still needs to be clear. A misleading statement does not become acceptable because AI generated it.

The Competition and Markets Authority has also made clear that businesses remain responsible for AI agents used to interact with customers or carry out tasks on their behalf. This could include answering questions, managing subscriptions or processing refunds, even where the technology was supplied by a third party.

The policy should also address when customers need to be told that AI is being used.

Using AI to correct the grammar in an email is unlikely to raise the same transparency concerns as allowing a chatbot to present itself as a member of staff. Where a customer could otherwise be misled, the business should consider making the use of AI clear.

Customers should also have a way to reach a person, question an outcome or report an error where appropriate.

Cover Security And Intellectual Property

An AI use policy should work alongside the business’s privacy notice, cybersecurity procedures, confidentiality requirements, employment policies and contracts.

An AI tool connected to company email, cloud storage or customer records may be able to access far more information than a standalone chatbot. The policy should therefore explain who can approve integrations, what permissions may be granted and what happens when a staff member leaves or an account is compromised.

Intellectual property needs attention too.

Staff may upload material that the business does not have permission to use, such as third-party photographs, code, articles, designs or customer documents. The business may also use an AI-generated output without knowing whether it closely resembles protected work created by someone else.

The policy can require staff to confirm they have permission to upload material, check relevant platform terms and avoid assuming every AI-generated output is automatically safe to use commercially.

UK law currently contains specific protection for certain computer-generated works created without a human author, although there is significant uncertainty about how this applies to modern generative AI. The government has proposed removing that protection, but the change has not yet been made.

Businesses should therefore be cautious about assuming they will own strong or enforceable copyright in every AI-generated output. The platform’s terms, the level of human involvement and the business’s agreements with employees or contractors may all matter.

Tell Staff What To Do When Something Goes Wrong

Even a good policy will not prevent every mistake.

Someone may upload the wrong file, send unchecked content to a customer or connect a tool to more information than expected. A meeting assistant may record a conversation it should not have joined.

The policy should tell staff who to contact, what information to preserve and whether they should stop using the tool while the issue is assessed.

Early reporting should be encouraged. If employees are worried that acknowledging an AI-related mistake will automatically lead to punishment, they may delay reporting it and make the problem harder to contain.

Depending on what happened, the incident may also need to be handled under the business’s existing data protection, cybersecurity, contractual or data breach procedures.

Give Someone Responsibility For The Policy

A small business may not need an AI governance committee or a complicated approval structure. It does need someone who owns the policy and can make decisions about AI use.

That person may approve new tools, consider higher-risk uses, arrange staff training and coordinate the response to incidents. Other people may need to be involved where a proposed use raises legal, data protection, employment, security or operational concerns.

It can also be useful to maintain a simple record of the AI systems the business uses, what they are approved for, who is responsible for them and any important limitations.

The policy should be reviewed when the business introduces a significant new tool or use, after an AI-related incident or when relevant laws, guidance or supplier terms change.

Should A Legal Expert Help Draft Your AI Use Policy?

A founder may be able to identify some obvious rules, such as banning passwords from public AI tools or requiring customer-facing content to be reviewed.

The harder part is working out how those rules should reflect the business’s wider obligations.

An AI use policy may need to account for data protection, confidentiality, intellectual property, consumer law, employment practices and agreements with customers, workers, suppliers and AI providers. It should also fit with the business’s privacy notice, employment documents, contractor agreements and security procedures.

Getting help from a legal expert can be valuable because they can identify where the business’s proposed AI uses interact with those obligations and turn them into clear, practical rules.

The goal is not to make the policy longer or more restrictive than necessary. It is to create a document that reflects how the business actually works and gives the team guidance they can use.

Key Takeaways

An online template or government framework can provide a useful starting point, but it is not a complete answer for every business.

A practical AI use policy should explain where AI can be used, which tools are approved, what information staff may enter, how outputs must be reviewed and what should happen when something goes wrong.

The best policy is not necessarily the longest. It is the one that turns the business’s actual risks and legal obligations into rules the team can understand and follow.

If you would like a consultation on an AI use policy for your small business, you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.