The marketing manager at a thirty-person consultancy in Bristol opens ChatGPT every morning before her first coffee. She drafts client emails in it, summarises the previous day’s meeting notes, and occasionally pastes in a chunk of a tender document to ask for a tighter version. Her firm has no AI policy. Her managing director thinks the team “isn’t really using AI yet.” Both things are true at the same time, and the gap between them is where almost every small business now sits.
Deloitte’s 2024 UK research found that 75% of office workers used generative AI tools at least once a month. The Chartered Management Institute and other UK trade research has put the figure on employer policies at around 28% in the same period. Whatever the exact number, the pattern is consistent. Staff have adopted AI privately, faster than employers have written rules for it. Microsoft’s 2024 Work Trend Index found that 78% of frequent AI users had introduced AI into their workflow themselves, not via IT or management. If you’re an owner-operator wondering how to get your non-technical team using AI, the honest first step is to assume they already are, and design from there.
Why won’t staff use AI just because you buy a licence?
Buying licences is the easy part, building the habit is the hard part. PwC’s 2024 UK CEO survey found 69% of CEOs named lack of skills as the biggest barrier to AI adoption, ahead of technology cost. Workday’s UK research on worker-positive AI argues that the rollouts that stick are framed as workforce projects with role-specific training and templates, not technology purchases. Without that, you’ll have paid for software nobody opens after week two.
The other thing that holds staff back is fear of getting it wrong. Without a clear policy, every member of the team is privately calculating whether pasting a client email into a public tool will get them in trouble. Many resolve that uncertainty by either using AI in secret or not using it at all, and neither outcome is what you want. A short written policy turns a private guessing game into a shared set of rules everyone can work to.
What does a workable AI policy look like for an SME?
A workable policy is two to four pages, written in plain English, signed by everyone, and reviewed annually. The Scottish AI Alliance publishes a small-business template covering scope, permitted uses, prohibited uses, roles, training and incident reporting. The UK Government’s AI Playbook condenses expectations into ten principles, including meaningful human control at the right stage and using the right tool for the job. You can adapt either of these in an afternoon.
Three rules belong in every SME policy regardless of sector. First, no customer personal data or confidential commercial data goes into any tool that hasn’t been approved in writing, in line with ICO guidance on generative AI. Second, every user is personally accountable for verifying AI outputs before they leave the building. Third, a named person, your AI Policy Owner, is the route for any question or incident. Experis recommends classifying use cases into low, medium and high risk tiers so the policy can be proportionate rather than blanket-restrictive.
Where should staff actually start using AI?
The fastest confidence comes from low-risk, high-volume tasks where a human always edits the output before it goes anywhere. The UK Government AI Playbook explicitly tells teams to prioritise these and warns against early use in sensitive decisions like hiring, credit or access to services. For a 5-to-50 person services firm, four use cases consistently land well: drafting routine emails, summarising meeting notes, producing first-draft marketing copy, and creating template documents from a brief.
Microsoft’s research on Copilot for Microsoft 365 reports users saving an average of 14 minutes per hour on certain content-creation tasks. A 2024 study of customer support agents using generative AI found a 14% increase in issues resolved per hour, with the biggest gains among less-experienced staff. Both numbers depend on staff treating AI as an assistant whose work they edit, not a replacement for their own judgement. Set that expectation explicitly during training and reinforce it every time a senior person reviews AI-assisted output.
When should you turn AI on inside the tools you already have?
Almost immediately, and before introducing any specialist AI tool. If your firm runs on Microsoft 365, Copilot lives inside Outlook, Word, Excel and Teams. If you’re on Google Workspace, Gemini for Workspace puts the same capability inside Gmail, Docs and Sheets. Staff don’t have to learn a new app or remember a new password. The AI shows up where they already work, which is what makes everyday adoption stick.
Experis specifically advises deploying enterprise AI inside your existing security perimeter rather than leaving staff on public tools. The reason is simple. Public tools may store prompts and outputs, and the NCSC has been explicit that sensitive business or client data should not be entered into them without a risk assessment. An enterprise instance inside Microsoft 365 or Google Workspace handles that question by default.
Start with a pilot group of five to ten people across two or three roles. Give them the policy, a one-page prompt sheet for their job, and a 60-to-90 minute live session covering banned inputs, approved use cases, and the verify-before-sending rule. Run it for four weeks. Collect what worked, what didn’t, and any near-misses on the policy. Then widen access, role by role, with the prompt sheet adapted each time. This is slower than a firm-wide launch and far more likely to produce real adoption.
Who owns AI inside the business, and what do they actually do?
Two named roles cover what’s needed in a small firm. The AI Policy Owner is a senior person, often the managing director or operations director, who signs off the policy, owns the use-case register, and handles any incident. The AI Steward is a tech-comfortable staffer who answers day-to-day questions, maintains the prompt sheets, and triages new tool requests. Together they can run AI governance for a 5-to-50 person firm in a few hours a week.
The Scottish AI Playbook also recommends keeping a shared spreadsheet of approved use cases, classified by risk, with a column for what data is involved and what human checks apply. This sounds bureaucratic and isn’t. Once the first ten or fifteen use cases are in it, new requests slot in quickly, and the register becomes a living record of how the firm actually works with AI. Review it quarterly against any updates from the ICO, FCA if you’re regulated, and the EU AI Act if you serve EU customers.
If you’d like a peer view on where to start with your team, book a conversation.
