An AI policy your team will actually read (with a one-page template)

If your AI policy is a ban, your team is probably still using AI, just on personal accounts you can’t see. A short policy works better: one that says which tools are fine, what never goes in and who checks what. People will actually read it. There’s a one-page template at the end to copy and adapt.

Why bans don’t work

Blanket bans feel safe, but they rarely stop people using AI. Mostly, they hide it. In Microsoft and LinkedIn’s 2024 survey of 31,000 knowledge workers in 31 countries, 78% of people using AI at work were bringing their own tools, rising to 80% at small and medium-sized companies. More than half (52%) were reluctant to admit using it for their most important tasks. Microsoft sells AI tools, so treat that as a strong signal rather than gospel.

The problem with personal accounts is where the data goes. OpenAI, for example, says that on personal ChatGPT accounts “we may use your content to train our models” unless the user opts out, while business accounts aren’t used for training by default. So a ban can push client details into exactly the version you’d least want them in.

A good policy does the opposite. It gives people a safe, approved way to do what they’re already doing, and it’s short enough to remember.

What goes on the page

Six things, in plain language, on one side of A4:

• Approved tools. Name the tools and the accounts. For each, check two things in the terms: is there a data processing agreement, and is your data used to train the provider’s models? Choosing an AI assistant for your team covers the rest. Say how to request a new tool, or the list will go stale.
• What never goes in. Be concrete: “no case notes” is clearer than “no sensitive data”. A sensible starting list: personal details of clients and staff (unless a tool is approved for them), health and other special category information, passwords and anything under a confidentiality agreement.
• Checking outputs. AI drafts, people decide. Whoever sends, publishes or acts on AI output owns it, and facts, figures, names and references get checked against the source. Why AI gets things wrong explains why.
• Being open about it. You don’t need a disclaimer on every email. You do need to be honest where someone would reasonably expect a person: a chatbot on your website, advice to clients, anything published under someone’s name and decisions about people.
• Who to ask. Name a person, not a committee, and make it clear that owning up quickly to a slip (like pasting in something you shouldn’t have) is the right thing to do.
• A review date. AI tools change fast. Every six months is about right, with a named owner.

The legal bits, briefly

UK GDPR applies whenever personal data goes into an AI tool. You need a lawful basis for the processing, and the Information Commissioner’s Office (ICO) says that “in the vast majority of cases, the use of AI will involve a type of processing likely to result in a high risk to individuals’ rights and freedoms”. In practice, you’ll usually need a data protection impact assessment (DPIA) before you start. The ICO’s advice on third-party tools is blunt: if you can’t assess whether one would be compliant, choose a different one. Our UK GDPR checklist for AI tools goes through the steps.

The EU AI Act only reaches UK organisations in its scope: broadly, those that put AI systems on the EU market or whose AI outputs are used in the EU. Purely UK use isn’t caught. If you are in scope, Article 4 on AI literacy has applied since 2 February 2025. Its original text said providers (who build AI systems) and deployers (who use them at work) must “take measures to ensure, to their best extent, a sufficient level of AI literacy” among their staff. Amendments signed in July 2026, known as the Digital Omnibus, soften that to “take measures to support the development of AI literacy”, and add that this “does not require providers or deployers to guarantee any specific level of AI literacy of any individual”. A one-page policy and some practical training are a sensible place to start. Our guide to the EU AI Act in 2026 has more.

Make it stick

Write the policy with the two or three people who use AI most, not only the people who worry about it most. Then spend twenty minutes walking the whole team through it, using real examples from your own work. People follow a policy they helped shape and understand.

A one-page template you can copy

Copy this into a document, fill in the square brackets and cut anything that doesn’t apply.

[Organisation name]: how we use AI

Owner: [name]. Last reviewed: [date]. Next review: [date, six months on].

Why we have this policy

We want everyone to use AI where it helps, safely and in the open. This page explains how. If something isn’t covered, ask [name].

Tools you can use

• [Tool and account type] for drafting, summarising and research.
• [Tool] for [what it’s for].
• Use these on your work account only, never a personal one.
• Want to try something else? Ask [name] first and we’ll check the terms.

What never goes into an AI tool

• Personal details of [clients, service users, staff], unless the tool is approved for that above.
• Health information and other special category data.
• Passwords, access codes and bank details.
• Anything covered by a confidentiality agreement.
• [Anything specific to us, such as case notes or tender prices.]

Checking what AI produces

• AI drafts, people decide. If you send, publish or act on it, you own it.
• Check facts, figures, names, quotes and references against the original source.
• [Tasks where a second person checks before anything goes out, such as client advice or anything involving money.]

Being open about it

• We tell people when they’re dealing with an AI tool rather than a person.
• We say when AI has played a significant part in work a client would expect a person to have done.
• AI never makes decisions about people (hiring, eligibility, complaints) without a person properly reviewing them.

If something goes wrong, or you’re not sure

• Put something in that shouldn’t have gone in? Tell [name] straight away. Reporting it quickly is always the right call.
• Any other questions: ask [name] at [email or chat channel].