Your team is probably already using AI tools, whether or not you've approved them. That's not a bad thing: AI can save hours every week. But without guidance, people may paste customer data into consumer tools, publish unchecked AI content or use AI in ways customers wouldn't expect. A short, practical AI policy fixes that. Here's what to include, with a template you can adapt.
Why a policy helps
- Protects data: clear rules on what never goes into AI tools
- Maintains quality: human review before anything reaches customers
- Builds trust: honesty with customers about AI use
- Encourages adoption: staff use AI confidently instead of secretly
- Supports compliance: with UK GDPR and sector rules
The key sections
| Section | What it covers |
|---|---|
| Purpose and scope | Why the policy exists and who it applies to |
| Approved tools | Which AI tools can be used, and on which plans |
| Data rules | What can and can't be entered into AI tools |
| Human review | When outputs must be checked and by whom |
| Transparency | When to tell customers or colleagues AI was used |
| Prohibited uses | Uses that aren't allowed |
| Intellectual property | Ownership and checking of AI-generated work |
| Roles | Who owns the policy and approves new tools |
| Training | How staff learn to use AI well |
| Reporting | How to report mistakes or concerns |
Data rules: the most important part
| Category | Rule |
|---|---|
| Public information | Fine to use |
| Internal, non-sensitive information | Only in approved tools with business privacy terms |
| Customer personal data | Only in approved tools with appropriate data protection terms, and only when necessary |
| Confidential client or commercial data | Not without explicit approval |
| Special category data (health, finances, etc.) | Never in general AI tools |
| Passwords, keys and credentials | Never |
Choose business plans for AI tools where possible; they generally offer stronger privacy controls than free consumer versions. Check each provider's terms on data retention and model training.
Human review rules
- Anything sent to customers, published or used in decisions must be reviewed by a person
- Facts, figures, quotes and legal or regulatory statements must be verified
- The person who sends or publishes is responsible for the content, not the AI
Transparency
Decide when disclosure is expected. For example: label AI chat assistants clearly as AI, tell customers if AI is used to process their data in new ways, and avoid presenting AI-generated images as real photos of your work or people.
Copy-and-paste template
[COMPANY] AI ACCEPTABLE USE POLICY
Version: 1.0 Owner: [Name] Review date: [Date]
1. Purpose
This policy helps everyone at [Company] use AI tools safely,
responsibly and effectively.
2. Scope
Applies to all staff, contractors and freelancers using AI
tools for [Company] work.
3. Approved tools
- [Tool, plan] for [uses]
- [Tool, plan] for [uses]
New tools must be approved by [Role] before use.
4. Data rules
- Never enter passwords, credentials or special category data.
- Never enter confidential client information without approval.
- Personal data only in approved tools, and only when necessary.
- Prefer anonymised or summarised information.
5. Human review
All AI output used externally or for decisions must be reviewed
by a person, who is responsible for its accuracy.
6. Transparency
- AI chat assistants are clearly labelled as AI.
- We don't present AI-generated images as real photos of our work.
7. Prohibited uses
- Making final decisions about people (hiring, discipline)
based solely on AI.
- Creating misleading content, fake reviews or impersonations.
8. Intellectual property
Check AI output doesn't copy others' work. Don't enter
third-party confidential material.
9. Training and support
Staff receive guidance on good prompts and checking output.
10. Reporting
Report mistakes, data concerns or misuse to [Role] promptly.
Keep it practical
- Keep the policy to two pages
- Add examples of good and bad use
- Review it every six months as tools change
- Combine it with training, not just a document to sign
Regulation to keep an eye on
UK GDPR applies whenever personal data is involved, and the ICO publishes guidance on AI and data protection. If you serve EU customers, the EU AI Act introduces obligations that depend on how AI is used. This article isn't legal advice; for higher-risk uses, take legal advice.
Rolling out the policy
- Draft it with input from people who already use AI tools.
- Choose approved tools and set up business accounts.
- Run a short session explaining the rules, with real examples.
- Share a one-page summary people can keep handy.
- Make it easy to ask questions and suggest new tools.
- Review after three months, then every six months.
Examples of good and bad AI use
| Good use | Problem use |
|---|---|
| Drafting a blog outline, then adding real expertise | Publishing an AI article without checking facts |
| Summarising an internal meeting transcript | Pasting a client's confidential contract into a free tool |
| Rewriting a policy in plainer language | Letting AI decide who to shortlist for a job |
| Brainstorming campaign ideas | Creating fake reviews or testimonials |
| Explaining a spreadsheet formula | Entering customer bank details into a chatbot |
| Drafting a reply for a person to review | Sending AI replies to customers unreviewed |
Concrete examples like these make the policy easier to follow than abstract rules alone.
How we help
Our AI strategy workshops and AI readiness assessments include simple governance guidelines tailored to your business. For everyday use, see our guide to using ChatGPT safely and effectively.
The short version
An AI policy lists approved tools, sets clear data rules, requires human review for anything external, defines transparency, bans risky uses, assigns an owner and explains how to report problems. Keep it short, practical and reviewed regularly.
