// Free template

Free UK AI policy template

An AI use policy for UK businesses of 5 to 250 staff, written with UK GDPR in mind. Approved tools, data rules, checking output and an AI use register. Download it as a Word file, no sign-up.

What an AI policy is for

An AI use policy tells staff which AI tools they can use for work, what data must never go into them, and who checks the output. Most UK businesses need one now, because staff are already using ChatGPT, Copilot or Claude whether or not anyone has said they can.

This template is the one we start from with clients. It is short on purpose: a policy nobody reads protects nobody. Fill in the parts in square brackets, cut what does not apply, and have it checked against your contracts and sector rules.

Download the template (Word)

Version 1, October 2026. Free to use and edit inside your business. A starting point, not legal advice.

How to adopt it

  • Find out which AI tools staff use today. A short anonymous survey works.
  • Pick the tools you will approve, move them onto company accounts, and switch off training on your data.
  • Fill in the template and start the AI use register with those tools.
  • Agree it with whoever owns IT and data protection, and with HR if breaches link to your disciplinary procedure.
  • Brief every team, name an AI champion in each, and set a review date.

The template

[Company name] AI use policy

Version 1, October 2026

1. Purpose and scope

This policy sets out how staff at [Company name] may use artificial intelligence (AI) tools for work. It covers chat assistants such as ChatGPT, Microsoft Copilot, Claude and Gemini, AI features inside software we already use, and any AI system we build or buy.

It applies to all employees, contractors and temporary staff, on company and personal devices, whenever the work relates to [Company name], its customers or its staff.

2. Approved tools

Only the tools listed below may be used for work. They are set up on company accounts with settings that stop our data being used to train the provider's models. Personal accounts must not be used for work, even for the same tool.

  • [Tool name], [plan], for [what it is approved for]. Owner: [name or role].
  • [Tool name], [plan], for [what it is approved for]. Owner: [name or role].
  • To ask for a new tool to be approved, contact [AI policy owner].

3. What you can use AI for

  • Drafting and editing emails, documents and reports that you will check before they are sent.
  • Summarising long documents, meeting notes and research.
  • Brainstorming, planning and structuring work.
  • Writing and checking formulas, scripts and code.
  • Any use listed in the AI use register for your team.

4. Data you must never put into an AI tool

Unless the AI use register explicitly allows it for an approved tool, never enter:

  • Personal data about customers, staff or anyone else: names with contact details, dates of birth, addresses, health information, financial details or ID numbers.
  • Special category data under UK GDPR, such as health, ethnicity, religion or sexual orientation.
  • Customer contracts, pricing, or anything we have agreed to keep confidential.
  • Passwords, access keys or security details.
  • Unpublished financial results, plans or other commercially sensitive information.

5. Checking AI output

AI tools make mistakes, including confident ones. You are responsible for anything you send, publish or act on, whether or not AI helped write it.

  • Check facts, figures, names and references against a reliable source before relying on them.
  • Do not let AI make decisions about customers or staff on its own. A person must review any decision that affects someone.
  • Check that AI output does not copy someone else's work, and do not present it as original research.
  • If the output will go to a customer or the public, a second person checks it where [Company name] requires sign-off.

6. Being open about AI use

Tell customers when they are dealing with an AI system rather than a person, for example a chat assistant on our website. Where AI has played a significant part in advice or a decision about someone, say so if they ask.

7. Personal data and UK GDPR

Any AI use that processes personal data must have a lawful basis and appear in our records of processing. A data protection impact assessment (DPIA) is required before any AI use that is likely to result in a high risk to people's rights, including AI that makes or shapes decisions about customers or staff.

People have rights over decisions made about them solely by automated means. Speak to [data protection lead] before using AI in any decision of that kind.

8. Buying or building AI systems

  • Any new AI tool, AI feature or AI system must be approved by [AI policy owner] and added to the AI use register before use.
  • Suppliers must say where data is processed, whether it is used for training, and how long it is kept.
  • Systems that act automatically must log what they did, so any action can be traced and reversed.
  • If we sell AI systems or their output into the EU, check whether the EU AI Act applies before launch.

9. Training

Staff must complete [Company name]'s AI training before using approved tools for work. Each team has an AI champion, [names or roles], who can help with questions.

10. Reporting problems

If you think personal or confidential data has gone into an unapproved tool, or an AI system has produced something harmful or wrong that reached a customer, tell [AI policy owner] straight away. Data incidents follow our data breach procedure. Reporting an honest mistake quickly will not be treated as a disciplinary matter.

11. Ownership and review

This policy is owned by [AI policy owner]. It is reviewed every [six months] and whenever we approve a significant new AI use. Breaches of this policy may be handled under [Company name]'s disciplinary procedure.

Approved by: [name and role]. Date: [date]. Next review: [date].

Annex: AI use register

Keep one row for each AI tool or system in use. Suggested columns:

  • Tool or system, and the plan or version.
  • What it is used for, and by which teams.
  • What data it may receive, including whether personal data is allowed.
  • Where the data is processed, and whether the provider trains on it.
  • Owner, date approved, and date of the last review.
  • Risk check or DPIA reference, if one was needed.

Questions about AI policies

Does a UK business need an AI policy?

There is no law that requires one, but any business whose staff use AI tools for work should have one. UK GDPR already applies to personal data put into AI tools, and a policy is how you show you have controlled that. It also tells staff what is allowed, which makes them more willing to use AI openly.

What should an AI policy include?

At minimum: which tools are approved, what data must never go into them, who checks AI output, how to report a problem, and who owns the policy. Add a register of where AI is used. This template covers all of those and leaves the business-specific parts in square brackets.

Can we use this template for free?

Yes. Download it, edit it and use it inside your business. It is a starting point rather than legal advice, so have it checked against your contracts and any sector rules, such as FCA requirements, before you adopt it.

How often should an AI policy be reviewed?

Every six months is a sensible default, and whenever you approve a significant new AI use. The tools change quickly, so a policy written once and left alone goes out of date within a year.

Sources

Need more than a policy?

For a register, risk checks and the controls UK GDPR and the FCA expect, see AI governance and policy. To find out where AI would actually help, start with the AI readiness audit.