Most AI incidents in small firms start the same way: someone pastes client information into a free tool on a personal account, because nobody told them which tool to use instead. The fix is one page. This template gives you that page and the register that keeps it accurate. The reasoning behind it is in the UK governance guide, and each provider’s data terms are in the provider comparison.
What’s inside the PDF:
- Why you need a policy, and why one page is enough
- The six decisions your policy must record, each explained with suggested wording
- The regulations that may apply to you, in plain English
- A worked example: a fictional 12-person firm’s completed policy and register
- The fill-in policy and register pages, and the amnesty-first adoption checklist
Here’s the one rule working in practice. A paraplanner wants to try a new transcription tool on client calls. Under the policy the answer isn’t “no”, there’s a route: they propose it, the owner checks the training exclusion and the DPA, and it goes on the register with its permitted uses. The firm ends up with a new tool instead of a secret one. That’s also why the policy starts with an amnesty: ask staff what they already use, without blame, and they’ll tell you things a ban would keep hidden.
Two habits stop the policy sitting on a shelf. The register is the gate, so tools go on it before first use. And the amnesty comes before any audit, on day one.
This page and the template are for information only. They aren’t regulated financial advice, legal advice or a compliance opinion. Adapt them with a qualified professional where regulation applies.