Loading...
Governance · Free template
An AI policy template your team will actually follow
A free AI policy template that outlines a UK AI acceptable use policy, section by section. Use it as a starting point, then tailor it to your firm, your clients and your regulator.
In focus →
Live routingHover to pause
Incoming
Checking…
AI handles0
A person decides0
UK firms (10+ staff) using AI0%Up from around 12% in late 2023.
Source: Office for National Statistics ↗Large UK firms (250+) using AI0%Against 28% of firms with 0 to 9 staff.
Source: Office for National Statistics ↗Where the line sits
Why you need an AI usage policy now
Your staff are probably already using AI tools, with or without permission.
An AI policy for employees turns that into something you can see, manage and defend.
The government’s SME Digital Adoption Taskforce found that SMEs with clear internal policies permitting AI use are more likely to adopt AI tools.
A good policy is short, specific and built around one idea: a person stays responsible for anything the AI produces.
The AI policy template below sets out nine sections, and it is a starting point rather than legal advice.
What staff can use AI for
- Drafting and rewording internal documents
- Summarising public or approved material
- Brainstorming and outlining
- Tidying and translating low-risk text
- Searching approved internal knowledge
What always needs a person
- Anything that leaves the building
- Advice to clients, patients or customers
- Decisions about people, such as hiring or pay
- Checking facts, figures and citations
- Approving new tools and new uses
The template, part one
AI acceptable use policy: the everyday rules
Here is the AI policy template we recommend for a UK acceptable use policy.
Keep each section to a few plain sentences, so people actually read it.
The first five sections set the rules for everyday use.
The most important is data: the NCSC recommends not including sensitive information in queries to public AI tools.
The next most important is human review, because AI output can be confidently wrong.
Name the reviewer by role, not just “a manager”, so it is clear who signs off.
- Purpose and scope: why the policy exists, who it covers and which tools count as AI.
- Approved tools: the named AI tools staff may use, and how to request a new one.
- Data you must never enter: personal, client and patient data, passwords and anything confidential.
- Human review: a named person checks every AI output before anything leaves the building.
- Disclosure: when you tell clients, customers or colleagues that AI helped produce something.
85%
AI acts alone
130
65% of 200 cases
Goes to a person
70
35% of 200 cases
Illustrative batch with a typical confidence spread. Your real split comes from a pilot on your own work. Some decisions go to a person whatever the score.
The template, part two
Ownership, training and what happens when it goes wrong
The last four sections of the AI policy template make it stick.
An accountability owner gives staff one person to ask, and gives the board one person to hold to account.
Training matters because a policy nobody understands will be ignored.
Our AI literacy training is designed to sit alongside a policy like this.
Incident reporting should be blame-free, so people report mistakes early.
Link it to your data breach process, because an AI leak may also be a personal data breach.
- Accountability owner: the named person who owns the policy and approves exceptions.
- Training: what everyone completes before using AI at work, and how often it is refreshed.
- Incident reporting: how to report a mistake, leak or misuse, and to whom.
- Review cycle: at least once a year, after any incident and whenever a new tool is approved.
AI drafts
Check
Person decides
Learns
01 / 04
UK sources
What to base your AI policy on
You do not need to write this from scratch.
The ICO’s guidance on AI and data protection explains how UK GDPR applies when AI uses personal data.
The NCSC also covers the security risks of AI tools, including prompt injection and leaked queries.
The government’s AI Playbook sets out 10 principles for civil servants, including meaningful human control.
Those principles translate well to private firms, especially the idea that people stay accountable for AI-assisted work.
If your policy touches decisions about people, check the ICO’s rules on automated decision-making too.
You do not need to write this from scratch.
Tailoring
Use this AI policy template as a starting point, not legal advice
This AI policy template is general guidance and not legal advice.
Regulated firms will need to add their regulator’s rules, for example on confidentiality or record keeping.
We help you tailor it: naming the tools, setting the data rules and designing the human review step.
If you want evidence that the policy works in practice, our AI assurance review tests it.
Get in touch and we will turn the outline into a policy your team can use.
This AI policy template is general guidance and not legal advice.
How it works
Four steps, one owner
Each system ships with a named person accountable for what it does.
01
01
Find out
List the AI tools people already use, including free ones on personal accounts.
02
02
Decide
Agree approved tools, banned data and who reviews output, with leadership signing off.
03
03
Write
Fill in the nine sections in plain English, with examples from your own work.
04
04
Train and review
Brief every team, log incidents and review the policy at least once a year.
Questions
Asked and answered
Further reading
From the source
Information Commissioner’s OfficeGuidance on AI and data protection ↗National Cyber Security CentreChatGPT and large language models: what’s the risk? ↗Why sensitive information should stay out of public AI tools.Government Digital ServiceAI Playbook for the UK Government ↗Principle 4: meaningful human control at the right stages.GOV.UKSME Digital Adoption Taskforce: final report ↗Finds clear internal AI policies help small firms adopt AI.Information Commissioner’s OfficeRights related to automated decision-making including profiling ↗When UK GDPR requires a human to be able to step in.Office for National StatisticsArtificial intelligence in UK businesses: 2023 to 2026 ↗How many UK firms use AI, by size.
Keep reading
Related pages
GovernanceAI assurance →AI assurance, with evidence a person can stand behindTrainingAI literacy training →AI literacy training for everyone who touches AI at workTrainingAI governance course →An AI governance course for the people who design the controlsGovernanceAI readiness assessment →An AI readiness assessment that names the human checkpoint
Next step
Tell us the work. We’ll show you where the line goes.
A 30-minute call. We map one workflow, what the AI could take, and where a person must stay in the loop.