Get Started

Sell AI usage policies, staff training and a risk register to small firms

In many small firms, staff already use ChatGPT or Copilot, some on personal accounts, some with client details pasted in, and nobody has written down what's allowed. Sell a pack that fixes it in two weeks: a plain-English policy built from one intake file, a one-page "can I paste this?" decision tree, an approved tools list, a scored risk register, a one-hour staff session and a sign-off sheet. Then review it every year.

150 minIntermediateTools: Free: Python and the kit. Your time: about 8 hours per packStep 1 free
A policy builderone intake file becomes the client's policy (editable and print-ready), approved tools list and staff sign-off sheet
A one-page data decision tree staff actually usefive questions from "is this tool approved?" to "go ahead and check it"
A risk register with ten scored risks for a small firm, each with controls, an owner and a next action
  • A one-hour staff training run sheet with five sector scenarios and model answers
  • A £695 pack plus a £295 annual review, with the maths, the outreach and the proposal
Before you start
  • Python 3.9 or newer, nothing else to install. New to the terminal? Terminal survival kit
  • Good working knowledge of the AI tools small firms use (ChatGPT, Microsoft 365 Copilot, Gemini) and their business plans
  • Clear writing and a calm, practical manner with business owners
  • Helpful first: Run paid half-day AI workshops for small teams, which pairs naturally with this pack
01/08Why small firms need an AI policy now0 done
STEP 01 of 08~15 min

Why small firms need an AI policy now

Understand the problem the owner has, so the pack solves it without scaring anyone.

  1. The owner of a 14-person lettings agency has a nagging worrysomeone in the office is probably pasting tenant emails into a personal ChatGPT account to draft replies. They don't want to ban AI (it saves time), and they don't know what the rules should be. Big companies have compliance teams for this. Small firms have nobody.

  2. What the pack gives themclear rules everyone understands, a list of tools that are allowed and how to sign in to them, a register showing the risks have been thought about, proof that staff were trained and signed, and a date to look at it all again. Personal data rules (UK GDPR) still apply to anything staff paste into an AI tool, and the pack is how a small firm shows it takes that seriously.

  3. What AI does in your workflowthe builder script assembles each client's policy from a tested template in seconds, so your hours go on the parts that need judgement: the intake conversation, checking each tool's terms, adapting the risks to their work, and running the training.

    Careful
    • What it takes. About 8 hours per pack: intake call, tool checks, drafting, the risk register, the training and admin.
    • Up-to-date knowledge of the main AI tools' business plans and data terms, re-checked every few months because they change.
    • A calm, practical tone: owners buy reassurance and clarity, not fear.
    • A clear line on what you're not: this is a business pack, not legal advice.
    • Who this suits: you're organised, you like turning messy reality into simple rules, and you can explain them to a room of people who'd rather be working. A background in office management, HR, IT support or compliance helps.
  4. The kitread the kit overview or download everything: the builder, a sample intake and its output, the decision tree, the risk register, the training run sheet, the pricing calculator and outreach scripts.

✓
CheckpointYou can describe the six parts of the pack and why a 14-person firm would want each one.
If it breaksDo I need a legal qualification?
Do I need a legal qualification?
No. You're selling clear internal rules, training and records, the same way an office manager or HR consultant would. Say plainly in your proposal that it isn't legal advice, and point clients to a solicitor for specific legal questions.
Still stuck? Ask the community
Next mission · Go darkFind out if your password has leaked, without sending it anywhere
→