Why every business needs one
Without a policy, staff do one of two things: avoid AI entirely (and miss out), or use whatever free tool they find (and risk your data). A short policy solves both by saying clearly what's allowed.
Keep it short. A policy nobody reads protects nobody.
The template
Copy, paste and adapt. Replace the bracketed text.
1. Purpose
[Business name] encourages staff to use AI tools to work more efficiently, as long as they're used safely and responsibly. This policy explains how.
2. Approved tools
You may use the following AI tools for work, signed in with your work account only: [e.g. Microsoft 365 Copilot / Copilot Chat, ChatGPT Business]. Do not use other AI tools, browser extensions or personal accounts for work without approval from [name].
3. Information you must never enter
- Passwords, bank details or payment card numbers
- Customer or employee personal data, unless the tool is approved for it
- Health, financial or other sensitive information about any person
- Confidential contracts, pricing or business plans, unless the tool is approved for it
4. Check everything
AI can be wrong, out of date or biased. You are responsible for anything you send, publish or decide using AI. Check facts, figures and names before using any output.
5. Be open
Tell your manager if AI produced a significant part of a document for a client or customer, where that's relevant. Never present AI output as professional advice without human review.
6. Customer-facing AI
Any AI that talks directly to customers (chatbots, automated replies) must be approved by [name] and must make clear the customer is interacting with an automated system where appropriate.
7. Problems
If you think you've entered information you shouldn't have, tell [name] straight away. Mistakes reported quickly are much easier to fix.
8. Review
This policy will be reviewed every [6/12] months. Last updated: [date].
Rolling it out
- Adapt the template and get it signed off.
- Make sure the approved tools are actually set up on business accounts.
- Run a 30-minute briefing — show examples of good and bad use.
- Add it to your staff handbook and new-starter process.
UK GDPR considerations
If AI tools process personal data, you'll need to consider your lawful basis, update your privacy notice where needed, and check the provider's data processing terms. For higher-risk uses — such as AI involved in decisions about people — a data protection impact assessment may be required. The ICO's guidance on AI and data protection is the authoritative source.
We can write and roll out your policy for you as part of AI policy & security.
