Building an internal AI policy for a UAE company

Key Takeaways

• A usable policy answers four questions: which tools staff may use, what data can never be pasted into a public tool, who reviews AI-assisted client work before it goes out, and who approves a new tool request.
• Client and employee personal data going into a public AI tool is a processing activity under UAE PDPL considerations. Treat "which tool" as a data-handling decision, not an IT preference.
• A one-page policy that people actually read beats a fifteen-page one that sits unread in a shared drive.
• This is operational guidance, not legal advice. Have actual counsel review the policy before you circulate it.

A workable internal AI policy fits on one page and answers four questions: which tools are staff allowed to use, what information must never go into a public tool, who checks AI-drafted client work before it ships, and who signs off when someone wants to try a new tool. Most companies skip straight to a vendor shortlist and never write the policy at all: then find out during a client complaint or a data incident that nobody had actually decided the rules.

The gap matters more in the UAE than it might elsewhere, because a meaningful share of SME work here touches regulated or sensitive information (banking details, Emirates ID numbers, visa files, payroll, client contracts) and pasting any of it into a consumer chatbot is a data-handling decision whether or not anyone framed it that way.

Decide which tools are approved, and say so explicitly

The default state in most offices right now is "everyone uses whatever they found," which means a mix of personal ChatGPT accounts, browser extensions nobody vetted, and the occasional tool with terms of service nobody read. That is not a policy; it is an absence of one.

The fix is a short, named list: which AI tools are approved for company use, under which account type (a business or enterprise tier with a signed data processing agreement, not a free personal account), and for which tasks. A tool approved for drafting internal meeting notes is not automatically approved for drafting a client contract clause. Naming the tools also does the quiet work of closing off the free-tier trap: free consumer AI products routinely reserve the right to train on submitted content, which is precisely the arrangement you do not want for anything touching a client's business.

Keep the list short enough that people can remember it without checking. Three or four approved tools, each with a one-line note on what it is for, works better than a long table nobody opens. Run the licensing cost of moving three or four tools from free personal accounts to proper business-tier subscriptions against the expected productivity gain through the ROI calculator before finalising the shortlist, since that upgrade is a real, recurring cost worth justifying rather than assuming.

What staff can and cannot paste into a public AI tool

This is the section that actually prevents incidents, and it needs to be concrete rather than aspirational. A useful policy gives people a short, memorable rule plus a handful of named examples, because "use good judgement" is not a rule.

A workable starting rule: nothing goes into a public or free-tier AI tool that you would not be comfortable posting in a public forum. Then name the categories explicitly:

• Never paste: client names tied to deal terms or pricing, Emirates ID or passport numbers, bank account or IBAN details, employee salary or visa data, unsigned contracts or NDAs, anything a client has marked confidential.
• Paste only with identifying details removed: draft text for templates, general research questions, code snippets stripped of API keys and credentials, structural or formatting questions.
• Fine to paste: publicly available information, your own already-published content, hypothetical or anonymised scenarios.

Personal data of clients, employees, or job applicants is where UAE law becomes directly relevant. Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, in force since 2 January 2022, sets out a consent-based framework for processing personal data with rights of access, correction, and erasure for the data subject, and it applies to processing carried out inside the UAE regardless of which tool does the processing (Federal Decree-Law No. 45 of 2021, retrieved 2026-09-03). Feeding a client's personal data into a third-party AI tool without a lawful basis and without knowing where that data then lives is exactly the kind of processing the law is concerned with. This is general orientation, not a compliance determination for your specific data flows. Get actual legal counsel to confirm what your policy needs to say about consent, data residency, and vendor agreements before you publish it.

Review requirements for AI-generated, client-facing work

AI-drafted text should never reach a client at the same trust level as text a person wrote and checked. The policy needs to say, specifically, what "reviewed" means for each category of output:

• Internal drafts (meeting notes, first-pass research): usable as-is, spot-checked occasionally.
• Client-facing communication (emails, proposals, reports): a named human reviews every one before it sends, checking facts and figures against a source, not just tone.
• Anything with numbers, dates, or legal language: verified against the original source document, not against the AI's own confidence. Models produce fluent, wrong numbers as readily as fluent, right ones, and a client cannot tell the difference from the prose alone.
• Anything published externally (marketing copy, website content, a report bearing the company's name): a second reviewer, separate from whoever drafted it.

The point of naming these tiers is that "someone should check it" without saying who and for what turns into nobody checking it within about three weeks.

Who owns approving new tools

Someone specific needs to own the answer to "can we use this new tool," and it should not default to whoever asks first. A workable structure is a single named approver (often whoever already owns IT or operations decisions in a small company) who checks three things before adding anything to the approved list: does the vendor offer a business tier with a data processing agreement, does the tool's terms of service allow training on submitted data (it should not, for business use), and is there a task this tool is actually needed for versus one already covered.

This person is also who staff ask when a client or a new hire requests something outside the approved list. Without a named owner, tool sprawl is the default outcome: a different assistant in every team, none reviewed, and no one able to say what data went where when something eventually goes wrong.

For a broader look at where AI automation fits your operations before you formalise a policy around it, the AI readiness guide covers process selection and cost, and the AI readiness assessment is a starting point for scoping which processes and tools are actually relevant to your business.

A one-page policy outline you can adapt

A policy that fits on one page gets read. One that runs to several pages gets filed. Here is a structure that covers the ground above without padding:

1. Purpose (one sentence): why the company has this policy and who it applies to.
2. Approved tools: named list, account tier required, and what each is approved for.
3. Never paste this: the named categories of data that cannot go into any public or free-tier tool.
4. Review tiers: what level of human check applies to internal drafts, client communication, and anything published externally.
5. New tool requests: who to ask, and the three questions that get checked before approval.
6. What happens if this is not followed: a short, calm statement: most incidents are honest mistakes, and a policy that reads as punitive gets worked around rather than followed.
7. Review date: when the policy itself gets revisited, since approved tools and their terms change faster than most internal documents do.

Circulate it, get a signature or acknowledgement from each employee, and put the review date on a calendar. A policy nobody remembers exists is functionally the same as no policy.

Frequently asked questions

Do we need a written AI policy if we only use ChatGPT occasionally?

Yes. "Occasional" use is exactly how sensitive data ends up in a tool nobody vetted: a rushed employee pastes a client email to get a quick summary. A short written policy, even one page, gives staff a clear default instead of individual judgement calls made under time pressure.

Can employees use their personal AI accounts for work tasks?

Generally no, for anything involving company or client data. Personal accounts are usually free-tier, may allow the vendor to train on submitted content, and sit outside any data processing agreement the company has negotiated. Work tasks belong on company-approved, business-tier accounts.

Who should approve new AI tools in a small company?

One named person, not a committee and not "whoever asks first." In most SMEs this is the same person who already owns IT or operations decisions. Their job is checking data-handling terms and confirming a genuine need before anything gets added to the approved list.

This guide was reviewed and verified on 3 September 2026. It is operational guidance, not legal advice: have employment and data-protection counsel review your actual policy before publishing it.