Ask a UK small business owner whether their team uses AI at work and most will say yes, informally. Someone drafts client emails with ChatGPT. Someone else pastes meeting notes into Copilot for a summary. Nobody wrote the rule that made either one fine, because nobody wrote a rule at all. That gap between what staff actually do and what the business has decided is safe is where incidents start: a client's name typed into a free chatbot, a pricing sheet copied into a prompt, a report sent out that nobody checked.
Most businesses respond to that gap in one of two ways, and both fail the same way in the end. Some ban AI outright, which mostly teaches staff to use it quietly on personal accounts, further from anyone's view than before. Others say nothing, which leaves the same shadow use in place with no rules attached to it at all. Neither approach changes what people actually do at their desks; it just changes whether the business can see it.
Our free AI policy generator turns that gap into a document in minutes. But a policy only earns its place if every clause is doing a job, not filling space between headings. Here is what the generator actually produces, clause by clause, and why each one exists.
The tools allowlist
Without a stated list, staff pick individually which AI product to trust with company information, usually whichever one they already use at home, on a free consumer account nobody at the business can see into. Naming the approved tools turns that unspoken default into a written one, and it forces a second decision alongside it: who signs off anything not on the list. Without that second part, a new tool slips in through someone's personal login the moment the approved ones feel slow, and the allowlist stops meaning anything within a month.
The point is not to be restrictive for its own sake. A short, named list people actually read beats a long compliance document nobody opens, and it gives the business one place to update when a tool gets dropped or a better one replaces it.
Data handling
This is the clause that decides what a well-meaning employee is allowed to type into a chat window, at the moment they're about to type it. The generator offers a genuine choice rather than a single stance: block personal and client data outright, allow it once identifying details are stripped, or allow it only with documented consent and named sign-off. None of these read as compliance theatre. Each is a rule a busy employee can actually remember and apply without opening the full document.
Training
This is the clause most policy templates skip, because it is specific to how AI vendors handle what you type rather than what the tool outputs. Many consumer AI accounts use submitted prompts to train future versions of the model unless an enterprise or "do not train on my data" setting is switched on, and it is rarely on by default. If a pricing strategy or an unreleased plan goes into a free-tier account with that setting left off, there is no way to pull it back out of a model's future training run once it is in. The clause exists to make that setting a deliberate choice, not a default nobody in the business ever noticed.
Human review
AI output reads confidently whether or not it is correct, and that is exactly the problem this clause addresses. It draws one line: nothing AI-assisted leaves the business, whether that's client work, published content, or a set of figures, without a person reading it first and being accountable for sending it. This is the clause that stops "the AI wrote it" becoming an excuse once something has already gone out wrong. Accountability stays with whoever pressed send, not with the tool.
That single sentence does more work than any amount of general caution about AI being fallible. It gives every piece of AI-assisted work a named human owner before it leaves the building, which is the actual control, not a reminder to "use your judgement".
Disclosure
Disclosure is about honesty with the people your work reaches, not a badge stamped on every output. It commits the business to a straight answer if a client or customer asks how something was produced, rather than letting them assume more manual effort went in than actually did. It matters most exactly where trust matters most: contract work, regulated content, anything a client is paying for the judgement behind, not just the words.
Incidents
Policies fail quietly when there is no route for someone to admit a mistake. This clause names who to tell if personal or confidential data ends up somewhere it should not, and it says plainly that reporting early gets treated better than staying silent and hoping. Without it, the first real slip becomes the moment everyone learns the policy had no mechanism for handling exactly this, and learns it the hard way.
Review cadence
AI tools change faster than most businesses update their internal documents. This clause puts a date on the calendar, whichever cycle fits, so the policy does not get signed once and left to go stale while the tools named in the allowlist get swapped out underneath it. A policy with no review date is a policy that quietly stops matching how the business actually works, usually without anyone deciding that on purpose.
Put the rules in writing
None of this needs a lawyer to start. Answer a short set of questions in the AI policy generator and you get all seven clauses filled in for your business, in plain English, ready to download and adapt. Generate it, adjust anything that does not fit how your team actually works, and walk through it together in one short meeting rather than an email nobody opens.
If you would rather talk through where your AI use actually carries risk before you write anything down, book the free audit and bring whichever part of it worries you most. Either way, the aim is the same: turn what your team is already doing quietly into something the business decided on purpose.