If you are searching for an AI policy template for the UK, the one below is free, ungated and written to be copied: numbered clauses, a traffic-light table of what data can go into which tool, and a review date. Before the template, I'll cover how to write one in a week, who should sign it off, and why the policy is the smaller half of the job. This is practical guidance from someone who puts AI into businesses, not legal advice, so have your own adviser check the final version.
Most businesses I meet are in one of two places. Either there's no AI policy at all and staff are using personal ChatGPT accounts quietly, or there's a long policy that legal wrote, that nobody has read, and that bans things people do every day anyway. Both leave the business exposed. A good generative AI policy for employees is short, specific to the tools you actually license, and taught.
A policy nobody has been trained on is just a PDF.
How to write an AI policy in a week
You don't need a working group that meets for a quarter. You need four or five people and five working days.
- Day one: find out what's already happening. Ask IT for the list of AI tools in use (licences, browser extensions, expense claims). Send a two-question anonymous survey: which AI tools do you use for work, and for what? You'll learn more from that than from any vendor briefing.
- Day two: decide the approved tools. Usually one company-wide default plus perhaps a specialist tool for one or two teams. If you haven't chosen yet, my comparison of Copilot vs ChatGPT vs Claude for business sets out how I'd decide.
- Day three: draft from the template. Fill in the blanks below. Delete clauses that don't apply. Resist adding more.
- Day four: review. Data protection, HR, IT, and whoever owns client contracts read it once and send comments in writing.
- Day five: sign off and publish. The CEO signs. It goes into the handbook, and the training dates go in the diary the same day.
Who signs it off
The CEO or managing director signs. Before that, it needs review from whoever owns data protection (your DPO, if you have one), HR (because it's a conduct policy), IT or security (because they enforce the approved list), and finance or legal if you hold client confidentiality obligations. In a PE-backed business, send it to the board as well; it's one of the questions boards should be asking about AI anyway.
The UK legal context in one page
The UK has no single AI Act. What applies instead is the law you already follow, applied to a new tool.
UK GDPR applies to whatever staff paste in. If someone pastes a customer complaint, a CV or a payroll export into an AI tool, that's processing personal data. You need a lawful basis, appropriate security, suitable contract terms with the provider, and in some cases a data protection impact assessment. The ICO's guidance on AI and data protection is the main reference. The ICO's own page notes that because of changes made by the Data (Use and Access) Act 2025, the guidance is under review and may change, which is another reason to give your policy a review date.
Confidentiality still applies. Client contracts, NDAs and professional duties don't make an exception for AI tools. If a contract says client information stays within agreed systems, an unapproved tool breaks it.
Automated decisions about people need care. Using AI to make, rather than support, decisions about hiring, performance or credit raises specific UK GDPR obligations. Most mid-market businesses should simply require a human to make those decisions, which is what clause 6 below does.
If you sell into the EU, the EU AI Act may reach you. That's a question for your adviser, not a template.
Why a policy nobody is trained on is just a PDF
Here's the uncomfortable part. A policy nobody has been trained on is just a PDF. People don't read handbooks, and the ones who do can't turn "do not input confidential information into unapproved tools" into a decision at 4.45pm when a supplier spreadsheet needs summarising.
The national picture shows the gap. The ONS reported in July 2026 that around 35% of UK businesses with ten or more employees use AI, but only 11% say more than half their workforce has had AI-related training. Research cited by the government in January 2026 found only 21% of UK workers feel confident using AI at work. Policies are being written for people who haven't been shown how to work within them.
What works is teaching the rules while people use the tools on their own work. When a finance analyst builds a month-end commentary tool and has to decide whether the ledger export is amber or red data, the traffic-light table stops being abstract. That's how we run hands-on AI training: every build day starts by agreeing the data rules for that business, then everyone builds within them.
The AI policy template (copy and adapt)
Replace everything in [square brackets]. Keep it short. If a clause doesn't apply to you, delete it.
1. Purpose
1.1 This policy explains how [Company] staff may use artificial intelligence (AI) tools, including generative AI assistants, at work.
1.2 We want people to use AI to do better work faster. This policy sets out how to do that without putting customers, colleagues or the business at risk.
2. Scope
2.1 This policy applies to all employees, contractors, temporary staff and anyone else working on [Company]'s behalf.
2.2 It covers any AI tool used for work, on any device, including tools built into software we already use (for example email, office or CRM software) and tools staff build themselves.
3. Approved tools
3.1 The approved AI tools are listed below. Only use these tools for work, and only through accounts provided by [Company].
| Tool | Plan | Who may use it | Approved for data up to |
|---|---|---|---|
| [e.g. Microsoft 365 Copilot] | [Business account] | [All staff] | [Amber] |
| [e.g. Claude Team] | [Business account] | [Finance and legal] | [Amber] |
| [Public web tools, free and personal accounts] | n/a | Anyone | [Green only] |
3.2 Do not use personal or free accounts of any AI tool for work involving anything other than green data.
3.3 The approved list is maintained by [policy owner] and published at [location].
4. Data rules
4.1 Before putting any information into an AI tool, check its colour in the table below and the tool's approved level in clause 3.1.
| Colour | What it includes | Where it can go |
|---|---|---|
| Green | Public information, published marketing content, general questions, anonymised examples you have written yourself | Any approved tool, including public tools |
| Amber | Internal documents, non-sensitive business data, supplier and pricing information, internal reports, customer names and business contact details | Approved business accounts only, as listed in clause 3.1 |
| Red | Special category personal data (health, ethnicity, religion and similar), HR and disciplinary records, payroll and bank details, passwords and credentials, unreleased financial results, information a contract or NDA restricts, anything the client has asked us to keep within named systems | Not into any AI tool unless [policy owner] and [data protection lead] have approved that specific use in writing |
4.2 If you are not sure of the colour, treat it as red and ask [policy owner].
4.3 Remove names and identifying details where the task does not need them.
4.4 Do not connect an AI tool to company systems (email, file storage, CRM, finance systems) unless IT has approved that connection.
5. Prohibited uses
5.1 Do not use AI tools to:
(a) make final decisions about recruitment, pay, performance, discipline or dismissal;
(b) create content that is misleading, discriminatory, harassing or unlawful;
(c) impersonate a real person, or create images, audio or video of a real person without their consent;
(d) get round security controls, licence terms or this policy;
(e) process red data except as allowed in clause 4.1;
(f) give regulated advice (for example legal, financial or medical) to customers without the review required in clause 6.
6. Human review
6.1 You are responsible for any work you produce with AI, as if you had written it yourself.
6.2 AI tools make mistakes, including confident mistakes about facts, figures and sources. Check anything that will be relied on.
6.3 A named person must review AI output before it is:
(a) sent to a customer, supplier, regulator or the public;
(b) used in a financial figure, report or forecast;
(c) used to support a decision about a person.
6.4 Automated tools built with AI must have a named owner, a short written description of what they do, and a person who reviews exceptions.
7. Transparency and disclosure
7.1 Tell your manager if AI was used to produce a significant piece of work.
7.2 Tell a customer when AI has materially produced work they are paying for, if their contract requires it, or if they would reasonably expect to know.
7.3 Where customers interact with an AI tool directly (for example a chatbot), make it clear they are not talking to a person and give them a way to reach one.
8. Intellectual property and confidentiality
8.1 Work you create with AI tools in the course of your job belongs to [Company], as with any other work.
8.2 Do not put third-party confidential material, or material we licence under restrictive terms, into an AI tool unless its terms allow it.
8.3 Check AI output for content that may copy someone else's work, especially code, images and long passages of text, before you publish or ship it.
9. New tools and procurement
9.1 To request a new AI tool, or a new use of an approved tool involving red data, complete [request form] and send it to [policy owner].
9.2 Before approval, [IT/security] and [data protection lead] will check: the provider's data protection terms, where data is stored, whether our data is used to train models, security controls, and cost.
9.3 Do not buy AI tools on a company card or expense them without approval.
10. Training
10.1 Everyone who uses an approved AI tool must complete [Company]'s AI training within [30] days of being given access, and refresh it every [12] months.
10.2 Training covers what the tools are good and bad at, the data rules in this policy, and how to build and check AI-assisted work in your own role.
10.3 [HR] keeps a record of who has completed training.
11. Incidents
11.1 If you think red data has gone into an AI tool by mistake, or AI output has caused an error that reached a customer or a financial figure, report it to [policy owner] and [data protection lead] straight away, within [24 hours].
11.2 Reporting a mistake quickly will not, by itself, lead to disciplinary action. Hiding one may.
11.3 [Data protection lead] will decide whether the incident is a personal data breach that must be reported to the ICO.
12. Ownership and review
12.1 This policy is owned by [name and role].
12.2 It was approved by [CEO name] on [date] and will be reviewed by [date, no more than six months later], or sooner if the law, our tools or ICO guidance change.
12.3 Breaches of this policy may be dealt with under [Company]'s disciplinary procedure.
The one-page version for staff
Nobody remembers twelve clauses. Alongside the full policy, give every employee a one-page summary they can pin next to their screen. This is the version I'd use, and it's what people should be able to recite after training.
- Use the approved tools, through your work account. The list is at [location]. Personal accounts are for green data only.
- Check the colour before you paste. Green goes anywhere approved. Amber goes into business accounts only. Red doesn't go in without written approval. Not sure? It's red.
- You own the output. Check facts, figures and sources before anything leaves the building or goes into a number.
- People decide about people. AI can help draft, never decide, on hiring, pay, performance or discipline.
- Say so when it matters. Tell your manager about significant AI-assisted work, and the customer when they'd expect to know.
- Ask before you buy or connect. New tools and connections to company systems go through [policy owner].
- Report mistakes fast. Within [24 hours], to [policy owner]. Owning up quickly is treated well.
A worked example of the data rules
Here's how the table plays out on an ordinary Tuesday, using an illustrative accounts team.
The credit controller wants a firmer chasing email. She writes the draft herself with no names, and asks a public tool to tighten it. That's green. Fine anywhere.
She then wants a summary of the aged debt report to send her manager. Customer names and balances are amber, so she uses the company's business account, not her personal one. Fine.
Finally, she's asked to summarise a disciplinary note about a colleague's conduct. That's red. It doesn't go into any AI tool without written approval, and in most businesses the answer will be no.
Three decisions, each taking a few seconds, because the rule is concrete. That's the whole point of the table.
AI usage policy mistakes I see most often
A few patterns come up again and again when I read businesses' existing policies.
Banning everything. A blanket ban doesn't stop use; it moves it to personal phones. Approve a business tool and set rules for it.
No approved list. "Use AI responsibly" is not a rule. People need a tool name and an account.
Vague data rules. "Do not input confidential information" leaves every employee to decide what confidential means. The traffic-light table does that work for them.
No owner, no date. Tools change monthly. A policy without a named owner and a review date will be out of date by the spring.
No training. Covered above, and the most common gap by a distance.
Making the policy stick
Publish the policy and the approved list together, run the training within the month, and check six weeks later what people are actually doing. If you already pay for licences that nobody uses, the one-week licence audit is a good companion exercise, because the same survey answers both questions.
The policy sets the rules. People learn to work within them by using the tools on real work, with someone at the desk who can say "that's amber, use the business account" at the moment it matters. If you'd like your team to learn the rules that way, building something useful on their own job as they go, that's what our hands-on AI training is designed to do.
Questions
Does a UK business legally need an AI policy?
There is no UK law that requires a document called an AI policy. But UK GDPR already applies to any personal data staff paste into an AI tool, and you need to show you have appropriate measures in place. Confidentiality duties to clients and suppliers apply too. A short written policy, an approved tool list and training are the simplest way to show you have thought about it and told people what to do.
What should an AI acceptable use policy for employees include?
At minimum: which tools are approved, what data may and may not go into each, uses that are prohibited, when a person must review AI output before it is relied on, when to disclose AI use to clients, how intellectual property and confidentiality are handled, how to request a new tool, what training is required, how to report a mistake, and who owns the policy and when it will be reviewed.
Can employees use ChatGPT at work under UK GDPR?
Yes, if the business has assessed the tool, uses a business plan with suitable contractual and data protection terms, and staff follow clear rules on what data goes in. The common problem is personal accounts: free or consumer plans may not give the business the controls or terms it needs. Most policies allow approved business accounts and prohibit customer or employee personal data in personal accounts.
Who should sign off an AI policy?
Usually the CEO or managing director signs it, after review by whoever owns data protection (a DPO if you have one), HR, IT or security, and finance or legal if they hold client confidentiality obligations. In a PE-backed business, share it with the board too. Keep the drafting group small, agree it in a week, and set a review date no more than six months out.
