Guides6 min read
A one-page AI data policy for a small company
Sort your information into three kinds, keep a short list of approved AI tools, name an owner and review it each quarter. A template you can copy.
Mercury Labs
Sort your information into three kinds, keep a short list of approved AI tools, name an owner and review it each quarter. A template you can copy.
A small company needs one page that says which kinds of information may go into which AI tools. Sort your information into three kinds, keep a short list of approved tools, name the person who owns the list, and review it every quarter. Anything longer will not be read.
An AI data policy is the rule your staff follow when they decide what to paste or upload into an AI assistant. It is not an AI strategy, and it is not an ethics statement.
Because the tools arrived before the rules. In Microsoft and LinkedIn's 2024 survey of people who use AI at work, 78% said they brought their own AI tools, and the figure for small and medium-sized companies was 80%. That is a survey by a company that sells AI tools, and it is two years old, but the pattern is a familiar one: staff using free assistants on personal accounts, and nobody having said whether that is allowed.
Banning the tools does not work. People who have found something useful keep using it, more quietly. The job of the policy is to move that use onto accounts the company controls, and to keep the most sensitive information out altogether.
Three kinds of information and one rule for each. Most companies can sort almost everything they hold into these three without a long classification exercise.
| Kind of information | Examples | The rule |
|---|---|---|
| Personal data about customers and staff | Names with contact details, payroll, health or HR records, anything about a child | Stays out of AI tools, unless a named system has been approved for that purpose |
| Confidential company information | Contracts, pricing, accounts, board papers, source code, anything under a confidentiality agreement | Approved tools only, on a work account |
| Everyday work | Drafting, summarising public material, rewording, planning, spreadsheets without customer detail | Any assistant on the approved list |
An illustration. Where your own lines fall depends on what you hold and what your contracts with customers say.
The first row is the one to take advice on. If your business handles personal data as its main work, as a clinic, a school or a recruiter does, you will need more than this page, and the Information Commissioner's Office publishes guidance on AI and data protection that is worth reading before you approve any tool for it.
By their terms, not their brand. The same assistant can be safe on one plan and unsafe on another. As a rule, the business plans of the main assistants say they do not train their models on your content, and the free and personal plans often do unless each person switches it off. Read the provider's own page for the plan you are buying; it changes.
05 stages
Is it a business account that the company pays for and controls?
Watchpoint
A personal account leaves with the person, along with everything they pasted into it.
Do the terms say your content is not used to train models?
Watchpoint
On free plans the default is often the other way round.
How long is content kept, and can you delete it?
Watchpoint
Chat history kept for years is a second copy of your confidential files.
Where is it processed, and does that fit your customer contracts?
Watchpoint
Some contracts require data to stay in the UK or EU. Check before you promise it.
Do staff sign in with their work account, so access ends when they leave?
Watchpoint
A shared login cannot be switched off for one person.
Something like this. Change the names and the list, and keep it to one side of paper.
AI data policy Owner: [name] Next review: [date] 1. Use only the approved tools below, signed in with your work account. Approved: [tool and plan], [tool and plan] 2. What may go in Personal data about customers or staff Never, unless a system is named here for that purpose Confidential company information Approved tools only Everyday work Any approved tool 3. You are responsible for what you send. Read AI output before you use it, and check any fact, figure or quotation against its source. 4. Tell a customer when their contract requires it, and never put information covered by a confidentiality agreement into a tool that is not approved. 5. Not sure which kind of information something is? Treat it as the more sensitive kind, and ask [name]. 6. If something went into the wrong tool, tell [name] the same day. Nobody is in trouble for reporting it.Most of what a template from the internet contains. A page of principles about fairness and transparency changes nothing a member of staff does on a Tuesday. A list of banned uses that runs to two pages will not be remembered. If a rule does not help someone decide whether to paste the thing in front of them, it belongs in another document.
Write the page this week, with the three kinds of information and two approved tools, and send it to everyone with the owner's name on it. Then look at where the information people most want to ask about actually lives. A policy tells people what they may paste in. The larger gain comes when they no longer have to paste at all, because the assistant can read the approved records for itself, with each person's access respected. Agreeing the rules and then connecting the systems is part of our AI transformation work.