Free AI policy template for UK businesses

Before you start: three decisions

1. Who owns AI use. Pick one named person, such as a director or the office manager. They approve tools, answer questions and keep the register.
2. What is already in use. Ask each team what they use now, including phone apps, browser extensions and AI features inside software you already pay for. Ask without blame, or people will hide it.
3. Your data levels. Sort real examples from your business into Green, Amber and Red (section 4 of the template).

The AI acceptable use policy template

[Business name] AI acceptable use policy Version [1.0]. Owner: [name, role]. Approved by [name] on [date].

The six rules (put these on the noticeboard)

1. Use only approved AI tools, signed in with your work account.
2. Keep Red information out of AI tools unless that exact workflow is approved for it.
3. Treat every output as a draft. You are responsible for what you use.
4. AI must not send, publish, pay or delete anything outside the approved workflow and review rules in section 5.
5. Report problems to [AI owner] straight away, including your own mistakes.
6. If you are unsure, ask first.

1. Purpose

This policy tells everyone at [Business name] which artificial intelligence (AI) tools they may use for work, what information may go into them and who checks the results. We want AI used where it saves time or improves quality, while we protect personal data, client information, our systems and the standard of our work.

2. Scope

Everyone who does work for [Business name] must follow this policy, including directors, contractors and temporary staff. It covers:

• standalone AI tools, such as chat assistants and transcription apps
• AI features inside software we already use, such as email, documents, CRM and accounts packages
• automated workflows and agents that use AI to read, write or act on our information
• any device used for our work, including personal phones.

If this policy conflicts with our [data protection policy] or [information security policy], follow the stricter rule.

3. Approved tools

3.1 Use only the AI tools and account types in our AI tool register at [location]. The register shows what each tool is approved for and the highest data level allowed.

3.2 Use your work account for work tasks, never a personal one.

3.3 To request a new tool, plug-in, browser extension or AI feature, tell [AI owner] the task, the information it will see, the systems it will connect to, the supplier and who will check the output. Do not install, switch on or connect it until it is approved. Switching on a new AI feature in software we already use counts as a new tool.

3.4 [AI owner] reviews the register every [three] months.

4. Data rules

4.1 Before you enter anything into an AI tool, decide its level.

4.2 Personal data is any information relating to an identified or identifiable living person, whether a client, colleague, supplier or member of the public. Enter it only where the tool and workflow are approved for it. If made-up names or anonymised details will do the job, use them.

4.3 Special category data (health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, genetic data, and biometric data used to identify someone) and criminal offence data need written approval from [data protection lead] every time.

4.4 Client confidential information is anything a client gives us, or we create for them, that is not public, such as contracts, accounts, correspondence and case files. Check the client’s contract or engagement letter first, because some restrict which suppliers may handle their information. Treat it as Red either way.

4.5 Never enter passwords, multi-factor codes, API keys or payment card details into any AI tool.

4.6 Share the smallest amount needed: the paragraph, not the whole file or mailbox.

5. Accuracy and human review

5.1 AI tools can be wrong while sounding certain. Check facts, figures, names, dates, sources and links before you use any output.

5.2 You are responsible for any work you send, publish or act on, whether or not AI helped.

5.3 A named person must approve AI output before it is sent to a client, published, or used for legal, financial, tax, employment or health and safety advice, prices, quotes or contracts.

5.4 Before using AI in decisions about people, [data protection lead] must assess the applicable rules and safeguards. Our policy requires meaningful human review of decisions with legal or similarly significant effects, such as recruitment or discipline. The reviewer must consider the actual outcome and be able to change it.

5.5 An automated workflow or agent must not send messages, change records, make payments or delete information unless [AI owner] has approved that step, it has been tested and its actions are logged.

6. Intellectual property

6.1 Only put material into an AI tool if we own it or have permission to use it that way. Paid reports, licensed images and client documents stay out unless the licence or contract allows it.

6.2 Before approving a tool, [AI owner] checks who owns its outputs and whether our inputs may be used to train its models.

7. Security

7.1 Use multi-factor authentication on every AI account that offers it. Do not share logins.

7.2 Do not connect an AI tool to email, file storage, calendars or other systems without approval. A connected tool should reach only the folders, mailboxes or records its task needs.

7.3 Take care with AI that reads emails, web pages or documents from outside the business. Hidden instructions in them can try to make the tool reveal information or take actions. Report anything unexpected.

7.4 Confirm any request for payment, passwords or data through a contact route you already know.

7.5 [IT lead] removes AI access when someone leaves or no longer needs it.

8. Disclosure to clients

8.1 If a client asks whether AI was used in their work, tell them.

8.2 Where a contract, engagement letter, regulator or professional body requires us to tell clients about AI use or to get their agreement, we do so before the work starts.

8.3 If clients or the public deal with an AI tool directly, such as a website chat assistant, make it clear it is AI and offer an easy route to a person.

8.4 [Data protection lead] keeps our privacy notice up to date with how we use personal data in AI tools.

9. Training

9.1 Everyone completes AI training before using approved tools for work, and again after significant changes to this policy.

9.2 Training covers approved tools, data levels, checking outputs, security and reporting, with examples from each person’s own role. [AI owner] records who has completed it and when.

10. Breaches and reporting

10.1 Tell [AI owner] at [phone or email] straight away if:

• Red information went into a tool not approved for it
• an AI tool or workflow sent, changed or deleted something it should not have
• an output was harmful, discriminatory or exposed confidential information
• you think an AI account has been compromised.

10.2 Report even if you are unsure, and even if it was your mistake. Do not delete the chat or file involved unless [AI owner] asks you to.

10.3 [AI owner] and [data protection lead] contain the problem and decide whether it is a personal data breach. If it is reportable, we tell the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. We record every personal data breach, reported or not.

10.4 Deliberate or repeated breaches of this policy may lead to action under our [disciplinary policy].

11. Review date

[AI owner] reviews this policy every [six] months, and sooner if we adopt a new tool, a supplier changes its terms, the law changes or something goes wrong. Next review: [date].

Staff acknowledgement: I have read this policy and know who to ask. Name: [ ] Signature: [ ] Date: [ ]

How to adapt this AI policy template

Spend most of your time on sections 3, 4 and 8.

Approved tools. Read the business terms for each tool before you list it. Free and business versions may handle data differently. Microsoft, for example, says Microsoft Copilot and Microsoft Copilot Chat, as used by organisations, are covered by its Data Protection Addendum and Product Terms, and that “your data isn’t used to train foundation models”. Ask every supplier for the same in writing. Running Microsoft 365? See our Microsoft 365 security audit and Microsoft Copilot training.

Data rules. Swap our examples for yours. A solicitor’s Red list includes case files. An estate agent’s includes landlord and tenant records. Our pages on AI for solicitors, AI for accountants and AI for estate agents give sector examples.

Human review. Section 5.4 is an internal policy control. Human review alone does not establish that every automated use is lawful: assess the purpose, lawful basis, data, applicable decision-making rules and safeguards with your adviser.

Intellectual property. Check the rights and licence terms for source material and outputs before finalising section 6. The government’s copyright and AI material is a starting point, not permission to reuse third-party content.

Security. Clause 7.3 covers prompt injection, which the NCSC calls “one of the most widely reported weaknesses” in large language models. It matters most once AI can read your inbox or act in other systems. See our guide to cyber security for small business.

Disclosure. Check your client terms and your professional body’s guidance before finalising section 8.

Connect the policy to your data protection work

A policy is one part of accountable AI use. Where personal data is involved, assess lawful basis, transparency, data minimisation, security, retention and individual rights. Check whether a data protection impact assessment is required for the particular processing and record your reasoning.

Keep a tool register, approval records and training records alongside the policy. Give staff a clear reporting route, and make sure your incident process covers AI tools and their connected systems.

The ICO’s AI and data protection guidance and DPIA guidance explain the questions to address. The ICO marks AI guidance as under review following the Data (Use and Access) Act, so check the current position when adapting your policy.

Rolling out an AI usage policy for employees

An AI usage policy for employees fails when people cannot see their own job in it. Add a page of role examples before you launch.

Then run a short session for each team on their real tasks. When we trained all staff at Farmvet Systems, the company behind VetIMPRESS, the training covered five functions: marketing, finance, administration, business development and engineering. One generic example would not have fitted all five.

Keep signed acknowledgements, but a signature only shows someone received the policy. Revisit the rules in team meetings and whenever your software adds an AI feature. Our AI training courses build sessions around your own tools, roles and data rules.

Four mistakes to avoid

1. Copying a template and stopping. Unfilled brackets tell staff the policy is not meant seriously.
2. No owner. If nobody approves tools, people approve their own.
3. Banning everything. Staff who find AI useful will carry on, out of sight and on personal accounts.
4. Forgetting automation. Rules written for chat tools miss workflows that send emails or change records on their own. Clause 5.5 closes that gap.

Want help putting it into practice?

• Free 15-minute call. Tell us which AI tools your staff use and where this template does not fit. We will suggest a first step.
• AI audit, fixed at £750. We review your workflows and their risks, rank the opportunities and write up a plan. The plan is yours, whether you use it with us, your own team or another supplier. See our prices.
• Staff training. Workshops built around your tools, roles and data rules, quoted on team size, format and duration.

Not sure where your business stands yet? Start with our AI readiness assessment.

Book a free 15-minute call

A companion checklist for a specific AI workflow

The staff policy sets general rules. Use this shorter record for each proposed tool or automation, including AI features added to software already in use.

Keep the completed record with the tool register. Revisit it when a connector gains access, a supplier changes a setting or a workflow starts taking actions. Ask staff about unofficial tools without blame: discovering shadow AI is more useful than having a policy nobody admits breaking.

For Power Automate, platform-level controls also matter. The separate Power Automate governance and data policies guide covers environments, connectors and ownership; a general staff policy does not replace those settings.

FAQ

Is this AI policy template free to use? Yes. Copy it, change it and use it in your own business. You can copy the full template from this page into your own document. You do not need to give us your email address to get it.

Is an AI policy a legal requirement in the UK? If AI processes personal data, you are responsible for complying with data protection law and for showing that you comply. The ICO also says you need to align your training requirements and policies with your AI governance. A written AI policy, a tool register and training records are practical evidence. Ask your adviser whether your sector or contracts need more.

Do we need a DPIA as well as an AI policy? A DPIA is required when the particular processing is likely to result in high risk to people’s rights and freedoms. Assess your AI use against the ICO’s criteria and document the decision. The policy sets organisation-wide rules; a DPIA assesses a specific use and its risks.

Can staff use free AI tools under this policy? That is your decision. The template only allows the tools and account types on your approved list. It also keeps personal and client information out of any tool not approved for it. Check each tool’s terms before you approve it.

How often should we review our AI policy? The template suggests every six months. Review it sooner if you adopt a new tool, a supplier changes its terms, the law changes or something goes wrong. The ICO’s AI guidance is itself under review following the Data (Use and Access) Act.

Can Blue Canvas help us put an AI policy in place? Yes. Start with a free 15-minute call. Our fixed-price £750 AI audit covers your workflows and their risks, and our staff training covers checking output and handling business data.