- Framework
- 7 min read
- May 2026
The one-page AI policy template for UK small teams.
Five questions every growing business should answer before AI causes a problem you didn't see coming.
By Marwa Souissi & Ken Ross
Most AI policy templates are written by lawyers for lawyers. This one isn’t.
If you’re searching for an AI policy template UK-shaped, the top results are mostly thirty-page documents written for charities, large enterprises, or HR-software platforms. They’re comprehensive. They’re also unread. The team doesn’t open them. The founder doesn’t reference them. And when an actual decision needs making: can we use this tool? at what level of access? for what kind of data? The document is no help.
Worse, half the time the team runs the policy itself through AI to summarise it, and the policy gets treated like every other file: skimmed, half-understood, forgotten.
That’s the problem with most AI policies. They’re written for compliance, not for use.
Marwa and Ken at NowComms have been thinking about this for months, partly because three different founders asked us the same question in the same week, and partly because we needed one for our own agency. The honest answer we kept arriving at: most small UK companies are better served by something closer to a single page, in plain English, that three people on the team have actually read.
Five questions. That’s the document.
This is the one we use ourselves at NowComms, and the one we’re now using with clients. Read the full thinking below, or skip to the download for the editable Google Doc and Word template you can fill in for your own team.
01
Why most AI policy templates fail UK small teams
Three reasons, all of them avoidable.
They’re written for the wrong audience. Most of the AI policy templates ranking in UK search results were written for charities, large enterprises, or HR-software platforms selling adjacent products. None of them were written for a fifteen-person B2B company in Manchester or Bristol or London trying to figure out whether the marketing intern can use ChatGPT for client work. The framing is wrong from the first paragraph.
They’re built around generative AI risk in the abstract. Most templates obsess over generative AI and AI risk as theoretical categories. That language matters for legal compliance, but it doesn’t help a team make decisions on a Tuesday morning. A useful AI policy answers practical questions, not theoretical ones.
They’re too long to read. A thirty-page AI usage policy fails at its core job: shaping behaviour. If your team doesn’t read it, it doesn’t exist. The data is unforgiving, only a fraction of organisations review AI-generated content before using it, partly because the policies they have are too dense to follow.
The fix is a one-page AI policy that answers five questions clearly, in language a non-technical founder can read in three minutes and a non-technical employee can understand in five.
02
How long this should take you
Sixty minutes. Three or four people. One page at the end.
That’s the entire commitment. Block out an hour with the team members who’ll actually own AI decisions; usually a founder, a head of operations or marketing, and whoever runs your IT or compliance. Walk through the five questions live. Write the answers down in the meeting itself. Don’t draft solo and circulate for comment, you’ll lose the conversation that matters.
By the end of the hour you have a working policy. It won’t be perfect. That’s the point, you’ll improve it in the next quarterly review, when you know more about how AI is actually showing up in your business.
03
The five questions your AI policy needs to answer
Each question can be answered in 1-3 sentences. Together they fit on a single A4 page.
01
What’s the one thing AI is not allowed to do in our business, ever?
Most policies start with what AI can do. We start with what it can’t.
This is the line in the sand. The single category of work where the answer is always no, regardless of how good the tool is or how much time it would save. For NowComms, that’s drafting client-facing emails or proposals without a human writing the substance first. For a healthcare startup, it might be processing patient data. For a legal services business, it might be summarising client conversations.
The point isn’t that the answer is the same for every business. The point is that every business has one, and the policy needs to name it clearly enough that no one has to guess.
Answer in one sentence: “We will never use AI to [specific action] involving [specific data or audience], under any circumstances.”
02
What does “human review” actually mean; who, when, and how long?
Most AI policies say “AI output must be reviewed by a human.” That sentence does no work.
Reviewed by which human? At what stage: before drafting, before sending, before publishing? In how much time: thirty seconds or thirty minutes?
A useful AI policy names the reviewer for each category of work. “Anything client-facing is reviewed by Marwa. Strategy work is reviewed by Ken.” No reviewer named, no AI used. This is the human oversight question most templates skip, and it’s the difference between a policy that shapes behaviour and a policy that performs accountability.
Answer in three sentences: “For [category of work], the named reviewer is [person]. They review before [stage of work]. They have [time budget] to flag concerns.”
03
What’s the data we will never paste into an AI tool?
Generative AI tools learn from what gets pasted into them. Even when the vendor promises otherwise, even when you’ve ticked the “don’t train on my data” box, the safest assumption is: what we paste might surface somewhere we don’t control.
Every team needs a clear list. Client names. Financials. Personal data of employees or customers. Internal strategy documents. Anything covered by a non-disclosure agreement. The list won’t be the same for every business, but it has to exist.
This is the question that protects you from the real-world AI risk most small teams face, not the hypothetical one. The data leaks that have hit small UK companies in the past year almost all started with someone pasting something into ChatGPT they shouldn’t have.
Answer as a list: “We will never paste the following into any AI tool, public or private: [specific categories]. If in doubt, ask before you paste.”
Get the template
Two more questions on the next page. Want the editable template alongside?
Drop your name and email, we’ll send the Google Doc and Word version straight to your inbox. Free, no follow-up call, just the files.
04
Who owns the decision when AI and a human disagree?
This is the question almost every policy avoids.
When the AI tool says one thing and the team member says another, who wins? When the AI suggests a different course of action than the strategy you’ve agreed, who decides?
In practice, the answer should always be a named human. But the policy needs to say so explicitly, because in the moment, when time is short and the AI’s confidence is high, teams default to the AI. The policy is what gives the human permission to push back.
Answer in one sentence: “When AI output and human judgment disagree, [named role] decides. The AI is a tool, not a teammate.”
05
How will we know when this policy needs to change?
AI tools change every quarter. The capabilities change. The risks change. The use cases change.
A policy written in January 2026 will be partially obsolete by July. The question isn’t whether to update it, the question is how you’ll know it’s time. Set the trigger now, while you’re thinking clearly, before the next viral AI tool lands and everyone wants to start using it tomorrow.
For NowComms, we review the policy every quarter, and immediately whenever a team member flags an “is this allowed?” question we hadn’t anticipated. Our trigger is unanswered questions. Other businesses use new tool requests, or near-miss incidents, or team headcount milestones.
Answer in two sentences: “This policy is reviewed [interval]. It is reviewed immediately if [specific trigger].”
04
How to actually use this AI policy template
Three rules.
Use it as a meeting, not a document. Schedule a sixty-minute conversation with the three or four people in your team who will own AI decisions. Walk through the five questions live. Write the answers down in the meeting. Don’t try to draft it solo and circulate it for comment, you’ll lose the conversation that matters.
Keep it on one page. If your draft runs longer than a page, your answers are too generic. The discipline of the page limit forces clarity. “We never paste client names or financial data into AI tools” is more useful than four paragraphs explaining the philosophy of data protection.
Print it out. Pin it somewhere visible. Reference it the next time someone asks “can I use [tool] for [thing]?” The whole point is that it’s the document the team actually consults. If it lives buried in a shared drive, it’s just compliance theatre.
A one-page AI policy that gets read beats a thirty-page AI policy that doesn’t, every single time.
05
What this AI policy template doesn’t replace
This template is not legal advice. It doesn’t replace your data protection responsibilities under GDPR, your contractual obligations to clients, or your industry-specific compliance requirements. If your business handles regulated data; healthcare, finance, legal, you need additional guidance from a specialist.
What this template does is give you a one-page foundation that works for the 90% of decisions that don’t need a lawyer. It complements your existing data protection policy, IT acceptable use policy, and any sector-specific compliance documents.. it doesn’t replace them.
If you’ve already read our piece on AI adoption for founders, this framework sits alongside the four-question audit we use before adopting any new AI tool. Together they cover the two big questions: should we use this tool? and how should we govern AI day-to-day once we’ve adopted it?
•
Questions we get asked about this template
Is this AI policy template free?
Yes. Both the Google Doc and Word versions are free. We ask for an email address so we can send the next framework when it’s ready, but the template itself has no cost and no usage restrictions for your business.
Can I use this AI policy template for my UK company?
Yes. The template is written specifically for UK small teams (5-50 employees) and references UK data protection requirements. It works for any UK B2B business, though regulated industries (healthcare, finance, legal) will need to add sector-specific provisions.
How long should an AI policy be?
The template fits on a single page. We strongly recommend keeping it that short, longer policies don’t get read, and an unread policy doesn’t shape behaviour. The five questions can each be answered in 1-3 sentences.
Do I need an AI policy if my team is small?
Yes, arguably more than a large team does. Larger companies have legal teams, compliance officers, and IT controls. A small team has none of those. The policy is the only thing standing between “we have rules about AI” and “someone pasted client data into ChatGPT and we found out three months later.”
How often should we update our AI policy?
Quarterly is a good baseline, but update immediately when team members flag “is this allowed?” questions you hadn’t anticipated. AI tools and capabilities change too quickly for annual reviews to be sufficient.
What’s the difference between an AI policy and an AI usage policy?
In practice, nothing. “AI policy”, “AI usage policy”, “AI acceptable use policy”, and “AI procedures” all refer to the same document, written guidelines that govern how a team uses AI tools. We use “AI policy” throughout this template for simplicity.
Written by Marwa Souissi & Ken Ross at NowComms, a B2B marketing agency in the UK. We use this exact template ourselves. Ken’s been in B2B marketing for twenty-five years; Marwa runs data and systems. We’re writing publicly about AI for founders at our hub, Human in the Loop, figuring this out as we go. If you read the template and disagree with any of the five questions, or you’d add a sixth, we’d love to know. The next version will be better because of feedback we get on this one.
Related service: Our B2B marketing services
Get the template
The editable template, straight to your inbox.
Both the Google Doc and Word versions of the one-page AI policy template, free, no follow-up call coming. Drop your name and email below and we'll send them through. From the next essay in the hub onwards, you'll also get a quiet note when each new piece lands.
This form is not connected yet. Please use the contact page instead.