In research for Microsoft published in October 2025, 71% of UK employees said they had used AI tools at work that their employer hadn’t approved, and half of them did so every week. The most common reason was simply that it’s what they use at home. Only around a third said they worried about the privacy of the company or customer information they typed in.
In a small business that usually means client emails, quotes and spreadsheets being pasted into free AI tools on personal accounts. A short, practical AI policy fixes most of that, and it doesn’t need to be long.
Why it matters
- Data protection still applies. The ICO (now the Information Commission) is clear that there is no “AI exemption” to data protection law, and that the law applies even when personal data is processed incidentally or unintentionally. Pasting a client’s details into a chatbot is still processing their personal data.
- Free tools may keep what you type. The NCSC warns that data shared with unapproved AI services may be kept or used to improve them, and the business loses sight of where it went.
- AI gets things wrong. The NCSC notes that AI can present incorrect statements as facts, so someone has to check the output before it reaches a client.
- Banning it rarely works. The NCSC’s advice is to reduce the risk rather than assume it can be eliminated: give staff approved tools that meet their needs, and make it easy to ask.
What to include: eight points
- Approved tools. Name the AI tools staff may use for work, such as Microsoft Copilot with their work account, and how to ask for a new one to be added.
- Work accounts only. Use business plans signed in with work accounts, protected by multi-factor authentication, never personal accounts. Cyber Essentials treats cloud services as in scope and requires multi-factor sign-in for them.
- What must never go in. For example personal data about clients or staff, financial and bank details, passwords, health information and anything confidential to a client, unless the tool is approved for it.
- Human review. A person checks every AI-assisted email, document, figure or piece of advice before it’s used or sent, and stays responsible for it.
- Being open with clients. Say when AI has been used where it matters, for example in reports, advice or meeting notes, and before recording or summarising a meeting.
- Confidentiality and ownership. Don’t upload documents you don’t have the right to share, and check that anything you publish is accurate and original enough to stand behind.
- Reporting mistakes. If someone pastes something they shouldn’t have, they report it straight away without fear of blame, so it can be dealt with quickly.
- Training and review. Show staff how to use the approved tools well, and review the policy at least once a year as the tools change.
If you work with EU customers
The EU AI Act includes an “AI literacy” duty for organisations that use AI. Following changes agreed in July 2026, organisations must take measures to support the AI literacy of their staff, but no certificate or specific level is required, and keeping internal training records is enough. It can apply to a UK business whose use of AI affects people in the EU, so a short policy plus basic training is a sensible way to cover it.
Make it work in practice
Acas recommends consulting staff before introducing AI, setting clear rules and training people. The NCSC adds that an open culture matters: if people feel they’ll be told off, they’ll simply hide what they use.
- Keep the policy to one or two pages, in plain English.
- Pair it with a good approved tool, so staff aren’t tempted back to free apps.
- Back it up with technical settings where you can, such as blocking unapproved AI sites and protecting sensitive files.
Related articles
- ChatGPT, Copilot, Claude or Gemini? How business AI plans handle your data
- How to use Microsoft Copilot safely in your business
- How to get the most from a paid Microsoft Copilot licence
- Fake ChatGPT adverts are tricking staff into installing malware
- Cyber Essentials explained for small businesses
Sources
- NCSC: The hidden risks of shadow AI (7 September 2026)
- Microsoft UK: Rise in shadow AI tools raising security concerns (13 October 2025)
- ICO: Generative AI consultation response, tackling misconceptions
- NCSC: AI and cyber security, what you need to know (31 July 2026)
- Acas: Tips for employers introducing AI (15 May 2025)
- European Commission: AI literacy questions and answers (27 July 2026)
- NCSC: Cyber Essentials requirements v3.3 (27 April 2026)
Details are correct at the time of writing. Check the sources above for any later changes.
Want help with this in your business? Call 01787 209 003, see our cyber security service, or book a free IT consultation.