Most growing businesses have some version of an AI policy. It probably says something like ‘don’t paste confidential information into ChatGPT’, and it was written several months ago by someone who’s since moved on.
That’s a starting point. But as your team grows and AI tools become more embedded in how you work, it’s worth asking: is it still fit for purpose?
LegalEdge’s Claire Pattie shares her practical tips for developing an AI usage policy that actually works for your business.
Why it matters for your business
This isn’t about ticking compliance boxes. It’s about protecting the things that matter most to a growing business: your IP, your customer relationships, and your ability to keep operating smoothly.
Your IP is at risk.
Pasting proprietary information – source code, client data, business plans – into a consumer AI tool can undermine your ability to protect it as confidential information. Under UK and EU law, trade secret protection depends on taking reasonable steps to keep information secret. Using an unsanctioned public AI tool may mean you haven’t.
Vendor terms shift without warning.
Most of the AI tools your team uses are updated regularly, sometimes in ways that change how your data is handled, who it’s shared with, or whether it’s used for training. If your policy was written once and hasn’t been reviewed since, there’s a good chance it no longer reflects how these tools actually work.
Enterprise customers and investors are asking.
Due diligence processes increasingly include questions about AI governance. A clear, documented approach signals maturity – and the absence of one can raise flags at exactly the wrong moment.
Regulators are catching up.
The EU AI Act came into full enforcement in August 2026, and UK GDPR enforcement continues to grow. For most SMEs the direct regulatory risk is manageable, but it’s real, it’s increasing, and it’s starting to show up in enterprise procurement and investor due diligence too.
What a practical policy looks like
It doesn’t need to be long. It needs to be usable – something your team will actually read and follow.
- A clear list of approved tools, and which ones aren’t approved. Not every AI tool carries the same risk. A consumer chatbot and an enterprise coding assistant need different rules.
- Simple data guidance – which types of information can go into which tools. The goal is to make it easy for your team to make the right call quickly, without needing to ask a lawyer every time.
- Human accountability for AI outputs, especially for code, customer communications, or anything that affects a real decision. AI is a useful starting point; a human should frequently be the final check.
- A process for higher-stakes use cases – if you’re using AI to screen candidates, prioritise support tickets, or make financial decisions, that needs a bit more thought and documentation than a writing assistant does.
- A way to keep up with vendor changes – tool approvals should be revisited when vendors update their terms, not just at annual review.
- Staff training and AI literacy – your policy is only as good as the people following it. It’s also a legal requirement: Article 4 of the EU AI Act, in force since February 2025, requires any business that uses or deploys AI to ensure staff have an appropriate level of AI literacy. Make sure your team understands what the tools they’re using actually do with their data, where the risks lie, and what they should and shouldn’t do. A short onboarding session, a one-page reference guide, and a record of who’s been trained is a reasonable starting point, and the kind of evidence regulators will expect to see.
Act Now
You don’t need a perfect policy. You need one that’s clear, current, and actually used.
The businesses that get ahead of this now will find it easier to move fast, pass due diligence, and handle the inevitable moment when something doesn’t go to plan. The ones that don’t will be scrambling to catch up at the worst possible time.
The good news: getting to a solid baseline doesn’t take months. It takes a few focused conversations and someone who knows what they’re doing.
LegalEdge works with scaling companies to build AI policies that are both defensible and usable – mapping data flows, classifying tools, and creating the governance infrastructure auditors expect to see. Get in touch to discuss your AI governance needs
