The pattern behind most AI incidents in small firms is not exotic: someone pasted client information into a personal account of a free tool, because no approved alternative was named. The fix is one page. This template gives you that page and the register that keeps it true, with the reasoning covered in the UK governance guide and the provider-by-provider data terms in the providers cluster.
What’s inside the PDF:
- Why a policy, and why one page is enough
- The six decisions your policy must record, each explained with suggested wording
- The regulations that may apply to you, in plain English
- A worked example: a fictional 12-person firm’s completed policy and register
- The fill-in policy and register pages, and the amnesty-first adoption checklist
A worked example of the one rule in action: a paraplanner wants to try a new transcription tool on client calls. Under the policy, the answer is not “no”, it is a route: propose it, the owner checks training exclusion and the DPA, it goes on the register with its permitted uses, and the firm gains a tool instead of a secret. That is the difference between governance and prohibition, and it is why the amnesty opening works: staff surface what a ban would bury.
Work through the checklist above, then take the fillable PDF away. Two habits make it real rather than shelf-ware: the register is the gate (tools go on before first use), and the amnesty beats the audit (ask staff what they already use, without blame, on day one).
This page and the template are for informational purposes only and do not constitute regulated financial advice, legal advice, or a compliance opinion. Adapt with a qualified professional where regulation applies.