An AI and agents policy for your business: template and checklist

You don’t need a 40-page document. You need a page your team will actually read, that answers three questions: what can we use, what can we put in it, and who decides. Large organisations publish fuller frameworks you can borrow from; the UK government’s AI Playbook, for example, sets out ten principles for using AI safely and effectively. The template below scales that thinking down for a small business.

The principles

1. People stay accountable. A named person owns each AI tool or agent and answers for what it does.
2. Least access. Tools get only the data and permissions the job needs.
3. Humans approve what matters. Anything sent outside the business, any payment and anything deleted or shared is approved by a person.
4. Protect people’s data. Personal and confidential data only goes into approved tools, anonymised wherever possible.
5. Test before trusting. New uses are tested on real examples and run in shadow mode first.
6. Be honest about AI. We don’t present AI output as checked fact without checking it, and we’re open with customers where it matters.
7. Measure and review. Each use has a review date to decide keep, change or stop.

Template: copy and adapt

[BUSINESS NAME]: Using AI tools and agents
Owner: [NAME]   Last reviewed: [DATE]   Next review: [DATE]

1. Approved tools
   [Tool] for [purpose], on our [business/team] account. Owner: [name].
   Using other AI tools for work needs [owner]'s OK first.

2. What can go in
   OK: public information, our own drafts, anonymised examples.
   Approved tools only: customer, staff and financial information.
   Never: passwords, keys, card numbers, health information.

3. What AI can do on its own
   Read, summarise, draft, sort.
   Needs a person's approval: sending anything outside the business,
   payments or refunds, deleting or sharing files, posting publicly.

4. Checking
   You are responsible for anything you send or publish, even if AI drafted it.
   Check facts, names, numbers and promises before it goes out.

5. Problems
   If AI does something unexpected, or you think data has gone
   somewhere it shouldn't, tell [name] straight away. No blame.

6. Review
   We review each use every [90] days: keep, change or stop.

Go-live checklist for a new tool or agent

• There’s a named owner and a written purpose.
• We’ve checked the provider’s terms on training, retention and location, and we’re on the right plan.
• If personal data is involved, we’ve considered UK GDPR and the ICO’s AI guidance, and done an assessment if the risk is high.
• Permissions are the narrowest that work, and enforced by the systems.
• External, financial and destructive actions need a person’s approval.
• It passed our test set, including trick cases, and ran in shadow mode.
• Actions are logged and someone reviews them.
• We know how to switch it off, and we’ve tried it.
• There’s a review date and a measure of whether it pays back.

The NCSC’s advice sums it up: if you can’t understand, monitor or contain an agent’s actions, it isn’t ready for deployment.

Adapt this AI policy to my business.
Business: [what you do, number of staff]
AI tools we use or plan to use: [list, with what each is for]
Data we handle: [e.g. customer contact details, payroll, client files]
Anything regulated: [e.g. FCA-regulated, health data, children's data, or "none"]

1. Rewrite the policy below for my business in plain British English, keeping it to one page.
2. Fill in sensible approval rules for each tool I listed.
3. List any areas where I should get specialist advice (legal, data protection, regulatory) rather than rely on this policy.
POLICY:
"""[paste the template from this page]"""

Sources

1. GOV.UK, "AI Playbook for the UK Government" (February 2025) Government guidance
2. NCSC blog, "Thinking carefully before adopting agentic AI" (15 May 2026) Government guidance
3. ICO, Guidance on AI and data protection Regulator guidance
4. NIST, AI Risk Management Framework Standards body