Guardrails on a Single Page: Making AI Policy Usable in UK Small Firms

The policy problem is usually a usability problem

Many UK SMEs now have an AI policy. Fewer have one that changes what people do on a Tuesday afternoon. The document may be thorough, legally reviewed and stored on the intranet, yet staff still cannot answer three basic questions: which tools may I use, what data may I put into them, and who do I tell if something goes wrong?

That gap matters. Governance is not measured by the length of a PDF. It is measured by whether an organisation can show consistent, defensible decisions when AI touches customer data, commercial information or employment records. A one-page policy will not replace contracts, data protection impact assessments or legal advice. It can, however, provide the operating layer that makes those controls visible in daily work.

The aim is not to simplify away the risk. It is to simplify the route to the right decision.

Why length creates risk

A long policy creates three predictable problems. First, it hides the few rules that matter among background text and caveats. Second, it leaves managers to interpret principles differently across teams. Third, it encourages informal workarounds because the approved route feels slower than the unapproved one.

For UK SMEs, the compliance context adds pressure without requiring bureaucracy. Under the UK GDPR and the Data Protection Act 2018, the organisation remains accountable for how personal data is processed, including when a third-party AI tool is involved. ICO guidance emphasises lawful processing, data minimisation, transparency, security and the ability to demonstrate compliance. None of that demands a 40-page internal manual. It demands clear decisions, recorded where appropriate, and evidence that staff know what to do.

A single page is therefore not an abdication of governance. It is a communication device. The fuller records — vendor terms, assessments, approval notes — sit behind it.

The six blocks of a workable one-page policy

A useful policy should fit on one side of A4, or one screen, and use plain English. It should cover six areas.

1. Purpose and scope

State why the policy exists and who it applies to. Include employees, contractors, temporary staff and anyone using AI for work, whether on a company device or a personal one. Clarify that it covers generative AI, AI features embedded in existing software and browser extensions, not just standalone chatbots.

2. Approved tools

List the tools that are permitted, with any limits. Keep the list short and current. For each tool, note the approved use — for example, drafting non-sensitive internal text, summarising public documents or transcribing approved meetings — and the data classification permitted. If a tool is not on the list, it is not approved. That sentence alone prevents many ambiguous decisions.

3. Data rules

Use simple categories rather than legal jargon. For example: public information; internal business information; personal data; special category or highly sensitive data; client confidential information. State what may enter each category of tool. Prohibit entering personal data, client secrets or unpublished financial information into unapproved tools. Require minimum necessary data even in approved tools.

4. Disclosure and records

Explain when staff must record AI use. That may be a short entry in a register for customer-facing outputs, automated decision support or any use involving personal data. State whether AI-assisted content must be reviewed by a human before publication or use. For client work, make clear who is responsible for any client-specific disclosure.

5. Escalation

Name a role, not just a department. Give a route for questions, suspected data leaks, inaccurate outputs and requests to use a new tool. Set expectations for response times, such as one working day for routine questions and immediate reporting for suspected personal data breaches. Make clear that reporting a mistake promptly is treated as responsible behaviour, not automatic blame.

6. Review and ownership

Name the owner, the version date and the review cycle. A policy that is never reviewed becomes inaccurate quietly. Quarterly review is often enough for a small firm; trigger an earlier review when a new tool, client requirement or regulatory guidance changes the picture.

A template to adapt, not adopt unchanged

The following structure can be adapted with advice from a data protection adviser or legal counsel. It is a starting point, not legal advice.

• Purpose: This policy explains how [organisation] uses AI tools at work and what staff must do before, during and after use.
• Scope: It applies to all staff, contractors and agents using AI for [organisation] work, including embedded AI features.
• Approved tools: The current approved list is maintained at [location]. Tools not listed are not approved.
• Data rules: Do not enter personal data, special category data, client confidential information or unpublished financial data into unapproved tools. In approved tools, enter only the minimum data necessary.
• Human review: AI-generated content must be checked by a competent person before it is used in customer-facing materials, contractual documents or decisions affecting individuals.
• Disclosure: Record AI use in [register] when [conditions]. Tell [role] before using AI in client-facing work where the client has asked for disclosure.
• Escalation: Report suspected data leaks, harmful outputs or unapproved use to [role] at [contact] immediately. Ask new-tool questions at [contact].
• Review: Owner: [role]. Version: [date]. Next review: [date].

ICO-aware prompts for drafting the fuller record

The one-page policy should point to a more detailed approval and assessment process. These prompts can help structure that work without turning the policy itself into a manual.

• What personal data, if any, will enter the tool, and is each data field necessary for the task?
• What is the lawful basis for processing, and has transparency information been updated where required?
• Does the vendor use customer inputs to train models, and can that be disabled or contracted out?
• Where is data processed and stored, and does any international transfer rely on an appropriate mechanism?
• What retention and deletion controls exist, and can the organisation retrieve or delete its data?
• Will the output inform a decision about an individual, and what human review is required?
• Does the use require a data protection impact assessment under the organisation’s own screening process?
• What security measures apply, including access control, logging and incident notification?

Making it stick

A policy becomes real through small operational choices. Put it where work happens: the intranet homepage, the onboarding pack, the procurement request form and the AI tool approval page. Use two or three worked examples that reflect actual roles. Train managers to answer the approved-tool and data-classification questions consistently. Review requests to use new tools on a fixed rhythm so the approved list does not become stale.

Above all, make the safe route the quick route. If approval takes three weeks and a personal account takes three minutes, the policy is competing against its own organisation. A one-page policy cannot solve that alone, but it can make the right decision obvious enough to choose.

The test is simple: can a member of staff read it for two minutes and know what to do next? If not, it is not yet a policy for use. It is only a document.