AI policy template for UK businesses
Luxxstack wrote this free AI policy template so a UK business can put simple rules in place for how its people use AI. Fill in the blanks, trim what you do not need and share it with your team. It covers acceptable use, approved tools, data rules under UK GDPR, human approval, disclosure and review.
Updated October 2026
This template is general guidance, not legal advice. Have it checked by a qualified adviser before you rely on it, especially if you handle sensitive personal data or work in a regulated sector.
How to use this template
Copy the text in each section, replace anything in [square brackets] and delete what does not apply. Keep it short. A one-page policy that people follow is better than a long one nobody reads.
Agree it with whoever is responsible for data protection in your business, then share it with everyone who uses AI tools.
1. Purpose and scope
This policy explains how [Company name] uses artificial intelligence (AI) tools, and what we expect of everyone who works for us, including employees, contractors and temporary staff.
It applies to any AI tool used for work, whether we provide it or not.
Policy owner: [Name and role]. Version: [1.0]. Date: [date]. Next review: [date].
2. Acceptable use
We use AI to take on routine work such as drafting, summarising, sorting and chasing, so our people have more time for clients and decisions.
AI must not be used to: [make final decisions about people, such as hiring, firing or disciplinary action]; [give advice to clients without a qualified person reviewing it]; [produce anything that is misleading or breaks the law]; [other, for example anything you want ruled out].
Everyone is responsible for the work they send out, whether or not AI helped to prepare it.
3. Approved tools
Only the following AI tools may be used for work: [list each tool, for example the AI teammate we have set up, and the approved version of any chat tool].
New tools must be approved by [name or role] before use. We check where the tool stores data, whether it uses our data to train its models, and whether there is a data processing agreement in place.
Personal accounts on free AI tools must not be used for work involving client or company information.
| Tool | What it is used for | Data it may see | Approved by | Date |
|---|---|---|---|---|
| [Tool name] | [Drafting emails] | [General business information only] | [Name] | [Date] |
| [Tool name] | [Chasing documents] | [Client contact details] | [Name] | [Date] |
4. Data rules (UK GDPR)
We follow UK GDPR when we use AI. Before putting personal data into an AI tool, we check that we have a lawful reason to use it and that we only use what we need.
The following must never be entered into an AI tool unless it is an approved tool set up for that purpose: [special category data such as health information]; [payment card or bank details]; [passwords or access codes]; [other].
Where a supplier handles personal data for us, we have a data processing agreement with them. The person responsible for data protection is [name and role].
If anyone thinks personal data has been shared with an AI tool by mistake, they tell [name or role] straight away.
5. Human approval
AI prepares and a person approves. The following always need a person to check and approve before they are sent or acted on: [anything sent to a client or customer]; [anything that costs money or commits us to something]; [anything about an individual, such as a candidate or employee]; [regulated or compliance documents].
The person approving is responsible for checking facts, figures and tone. AI can be confidently wrong.
We keep a record of what AI prepared and who approved it, for at least [period].
6. Disclosure
We are open about our use of AI. Where it matters to the person on the other end, we tell them when AI has helped prepare something or is handling their enquiry.
We do not present AI as a human being. Our standard wording is: "[Add your wording, for example: This message was prepared with the help of AI and checked by a member of our team.]"
7. Review
We review this policy every [six or twelve] months, and whenever we add a new AI tool or the rules change.
We also review how AI is used in practice: what it does well, where it gets things wrong, and whether the approvals are working.
Questions about this policy go to [name and contact].
Want this run for you automatically?
Luxxstack builds the approval steps, access controls and audit trail into every AI teammate and system.
Questions people ask
Does my business need an AI policy?
It is a good idea if anyone in your business uses AI tools, even informally. A short policy sets out what is allowed, what data must stay out and who approves what. It is not a legal requirement in itself, but it helps you stay on the right side of data protection rules.
How long should an AI policy be?
As short as you can make it. For most small businesses, one or two pages covering acceptable use, approved tools, data rules, approval and review is enough.
Is this template legal advice?
No. It is general guidance. Have a qualified adviser check it before you rely on it, especially if you handle sensitive personal data or work in a regulated sector.
Can I use it for free?
Yes. Use it, change it and share it with your team. There is nothing to sign up for.
Who should own the policy?
Someone senior, often whoever is responsible for data protection. They keep it up to date and answer questions about it.