The AI policy gap: what SMEs need to know (downloadable AI policy template included)

AI adoption has accelerated significantly since ChatGPT became widely available to the public in 2022 with 54% of UK firms now actively using AI, up from 35% in 2025, as businesses of all sizes look for ways to improve efficiency, streamline processes, and reduce costs.

However, the introduction of new tools and ways of working also brings a new set of risks. For SMEs, which often have fewer resources and personnel dedicated to managing these risks than larger organisations, this could leave businesses exposed to potential data, security, copyright and reputational issues.

Rob Rees, Divisional Director at Markel Direct, highlights why SMEs should consider whether an AI policy or guidance would be appropriate for their business, even if AI is not formally adopted within the organisation.

Why does an SME need an AI policy?  

1. Your employees could already be using AI

Even if your business is not currently incorporating AI into its workflows or technology stack, that does not necessarily mean your employees are not already using it.

“Shadow AI” is a term used to refer to the unauthorised use of AI tools, applications or features by employees without the knowledge, approval or oversight of the business. Employees may be turning to free and easily accessible tools such as ChatGPT and Claude to help them complete tasks more efficiently, such as drafting content, summarising meeting transcripts, data analysis or simply supporting their day-to-day work.

While this can improve efficiency, it can also introduce risks if employees are entering confidential business information, customer data or other sensitive material into AI tools without understanding how that information may be handled, stored or used.

2. AI can create a data protection headache

One of the biggest risks associated with the use of AI is what happens to the information employees enter into these tools. Personal data, customer information, confidential business details and financial information can all be highly sensitive, and employees may not always understand how an AI platform handles the information they submit.

Before using an AI tool, businesses should understand how data is processed, stored and used by the provider, as well as whether information entered into the platform could be retained or used to improve its services. Some AI providers may use information entered into their platforms to improve or train their models, although practices vary between providers and products.

Businesses should review the provider's terms, privacy notices and data handling arrangements before use.

It is important that business owners set clear boundaries around data use when it comes to AI, and these should complement, rather than replace, existing GDPR, data protection and information security policies; think of this as an extension to the way your business handles other data.

Additionally, businesses should ensure any use of customer data within AI systems complies with UK data protection requirements, including identifying an appropriate lawful basis for processing, meeting transparency obligations, and understanding how any third-party AI provider handles that data.

3. What happens when AI gets something wrong?

Just as Wikipedia should not be relied on as a source of absolute truth due to its open editing feature, neither should AI. AI can generate responses that appear convincing and authoritative but may contain inaccuracies or fabricated information.

This makes human oversight over AI’s outputs particularly important when used within a business. The UK Jurisdiction Taskforce has highlighted that professionals remain responsible for exercising reasonable care and skill in their use of AI – including checking the accuracy of AI tool’s outputs before relying on them.

Any AI-generated information or sourced data should be reviewed and fact-checked before it is relied upon, particularly when it is being used for customer-facing content, business decisions or professional advice.

It is important to consider that an incorrect AI-generated statement could mislead customers, damage a business' reputation or result in poor decisions being made. These checks are essential for maintaining credibility and trust and protecting your business against allegations of professional negligence.

It is important to remember that businesses should ensure clear accountability for reviewing, approving and using AI-generated outputs.

4. Intellectual property and copyright risks

A mistake many people make when using AI is assuming that AI-generated content is free to use and without copyright or intellectual property risks, because it was made for them. However, as AI draws from existing materials that exist on the internet, there may be circumstances where AI-generated content reproduces or closely resembles protected material, potentially creating intellectual property or copyright risks.

Employees may also inadvertently expose the business to risk by uploading the company's own intellectual property, such as proprietary information, original content or commercially sensitive material, into an AI platform, potentially leading others to use the brand’s intellectual property within AI-generated materials.

What should an SME AI policy cover? 

An SME AI policy should establish:

• Approved AI tools: Outline which platforms employees can use.
• Permitted uses: Make clear what tasks AI can and cannot be used for.
• Data protection: Have a robust list of what information must never be entered into AI tools.
• Human oversight: Establish when AI-generated outputs must be checked and by who.
• Accountability: Make obvious who is responsible for the final work.
• Copyright and IP: Lay out how AI-generated content should be reviewed.
• Incident reporting: Have a process in place which details what employees should do if sensitive information is accidentally shared or AI produces problematic content.
• Insurance: An AI policy could help mitigate issues before they occur. Businesses should review their insurance arrangements, including professional indemnity insurance, to understand whether, and to what extent, AI-related activities and liabilities may be covered. Cover will depend on the terms, conditions and exclusions of the policy.

To help SMEs get started, we have created a downloadable AI policy template covering approved AI tools, data protection, human oversight, accountability, intellectual property considerations and incident reporting.

AI policy template

Discover help and guidance for small businesses and self-employed professionals in our knowledge centre, or read more about cyber insurance.

Please note: This article provides guidance for information purposes only and is accurate at the time of production. It should not be relied upon wholly when making or taking important business decisions – always seek the services of an appropriately qualified professional. The views expressed by websites referred to are limited to those of the websites, and do not necessarily reflect the views of Markel Direct. Markel Direct is not affiliated with any of the brands, companies or websites mentioned in this article.