Writing an AI Use Policy for Your Staff

If your staff use computers, some are probably already using AI tools to draft emails, summarise documents or fix spreadsheet formulas. That is not necessarily a problem. The problem is when nobody has said what is sensible, so each person decides for themselves what to paste into a chatbot.

A short written policy gives staff a clear starting point. It does not need legal language: one or two pages people will actually read are worth more than a long document nobody opens.

Why a written policy helps

Banning AI outright is tempting if you are worried about data. A ban alone may not stop use, though, and can leave you unaware of what staff are doing. That does not mean nothing should be banned. A good policy can rule out particular tools, information or activities while allowing sensible use elsewhere. It also gives you something to show a customer, insurer or regulator who asks how you handle AI.

What to include

Copy the headings below into your own document and fill in the detail.

Approved tools and how to request a new one

List the tools staff may use. Include AI built into software you already have, browser extensions, meeting transcription and anything connected to email or shared drives, not just chatbots. Say which accounts and settings to use, require multi-factor authentication where available, and name who can authorise integrations or access permissions. Then explain how to request a new tool.

A business subscription or a promise not to train on your inputs is not enough by itself. Before approving a tool for personal data, check:

• your lawful basis
• whether the provider is your processor or a controller
• appropriate contract terms
• retention and deletion
• overseas transfers
• access controls
• whether you need a data protection impact assessment

The ICO website has guidance on each point.

What must not be entered

Separate what is never allowed from what is allowed only in approved workflows. Staff should never enter:

• passwords, access codes or other security details
• bank, card and other financial details
• confidential contracts or commercial terms
• anything covered by a non-disclosure agreement

Personal data about customers, staff, applicants, suppliers or anyone else identifiable should only go into tools and processes approved for it. Special category data, such as health information, ethnicity, religious beliefs or sexual orientation, needs stricter limits still, and many businesses keep it out entirely. Replacing a name does not necessarily make information anonymous. If in doubt, leave it out and ask.

Checking outputs

AI tools can produce confident text that is simply wrong. A person is responsible for anything that leaves the business, from quotes to social media posts, and facts, figures, dates and references must be verified against a reliable source.

Apply the same care internally before relying on AI for calculations, recruitment recommendations or code. AI agents should need explicit approval before sending messages, changing records or spending money.

Being open with customers

There is no blanket UK requirement to label all AI-assisted content, so set your own practice. Tell customers when they are chatting with an automated assistant, and say so when content is largely AI-generated and that would matter to the reader. Tidied grammar needs no label, but never mislead anyone. Data protection transparency duties also apply when you process personal data, so check whether your privacy notice needs updating.

Copyright and using others' work

Staff should not upload copyrighted material, such as paid reports or images, unless you have the right to use it that way. They should also be wary of output that closely copies an identifiable source. The law is still developing, so check GOV.UK and the Intellectual Property Office.

Recording what AI is used for

Keep a simple record of the main tasks AI is used for and which tools are involved. A shared spreadsheet is enough.

Reporting a mistake or data leak

Name who staff report to and set out the immediate steps: stop the activity, report promptly and keep the details, such as what was entered, where and when. Link this to your data breach process.

Speed matters. You must notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk to people's rights and freedoms. Where the risk is high, affected people must also be told without undue delay. All personal data breaches must be documented, including those not reported. None of this works unless staff report quickly and without fear of blame. The ICO website explains how to assess and report a breach.

Cover suspicious requests too. Staff should independently verify any request for payment or sensitive data, even if the voice or video appears genuine. Put the current fraud reporting route in your incident procedure, checked against official sources.

A short example structure

A policy might follow this order:

1. Purpose
2. Who it applies to: employees, contractors and anyone using business systems
3. Approved tools and requests
4. Information never allowed, and information allowed only in approved workflows
5. Checking outputs and responsibility
6. Being open with customers
7. Copyright
8. Record keeping
9. Reporting mistakes and breaches, linked to your breach process
10. Policy owner and next review date

Your situation may be slightly different. ask a question below ↓ and our editorial team will reply with our advice.

Rolling it out and keeping it current

1. Share the policy and ask everyone to confirm they have read it.
2. Run a brief training session on the "never enter" list and the reporting process, using realistic examples from your own work.
3. Name a person to ask about new tools or grey areas.
4. Add the policy to induction for new starters.
5. Review it every six months.

Providers add features and change their terms, and staff find new uses. Each review should update the approved list, recheck provider terms and look at your usage record. The NCSC's practical security guidance is useful to read alongside.

When to get specialist advice

This article is a starting point, not legal advice. If you work in a regulated sector, such as financial services, healthcare or legal services, or with children or vulnerable adults, your regulator may have specific expectations. Speak to a solicitor, your trade body or your regulator before finalising the policy. The same applies if you plan to use AI to make decisions about people, such as screening job applicants, as data protection law sets extra requirements.

Otherwise, start now: name an owner, brief staff and set the first review date.