AI POLICY TEMPLATE FOR UK BUSINESSES

Free template from Luxxstack (https://www.luxxstack.com)
This template is general guidance, not legal advice. Have it checked by a qualified adviser before you rely on it, especially if you handle sensitive personal data or work in a regulated sector.

How to use this template

Copy the text in each section, replace anything in [square brackets] and delete what does not apply. Keep it short. A one-page policy that people follow is better than a long one nobody reads.

Agree it with whoever is responsible for data protection in your business, then share it with everyone who uses AI tools.

1. Purpose and scope

This policy explains how [Company name] uses artificial intelligence (AI) tools, and what we expect of everyone who works for us, including employees, contractors and temporary staff.

It applies to any AI tool used for work, whether we provide it or not.

Policy owner: [Name and role]. Version: [1.0]. Date: [date]. Next review: [date].

2. Acceptable use

We use AI to take on routine work such as drafting, summarising, sorting and chasing, so our people have more time for clients and decisions.

AI must not be used to: [make final decisions about people, such as hiring, firing or disciplinary action]; [give advice to clients without a qualified person reviewing it]; [produce anything that is misleading or breaks the law]; [other, for example anything you want ruled out].

Everyone is responsible for the work they send out, whether or not AI helped to prepare it.

3. Approved tools

Only the following AI tools may be used for work: [list each tool, for example the AI teammate we have set up, and the approved version of any chat tool].

New tools must be approved by [name or role] before use. We check where the tool stores data, whether it uses our data to train its models, and whether there is a data processing agreement in place.

Personal accounts on free AI tools must not be used for work involving client or company information.

Approved tools register (copy into your own document)
Tool | What it is used for | Data it may see | Approved by | Date
[Tool name] | [Drafting emails] | [General business information only] | [Name] | [Date]
[Tool name] | [Chasing documents] | [Client contact details] | [Name] | [Date]

4. Data rules (UK GDPR)

We follow UK GDPR when we use AI. Before putting personal data into an AI tool, we check that we have a lawful reason to use it and that we only use what we need.

The following must never be entered into an AI tool unless it is an approved tool set up for that purpose: [special category data such as health information]; [payment card or bank details]; [passwords or access codes]; [other].

Where a supplier handles personal data for us, we have a data processing agreement with them. The person responsible for data protection is [name and role].

If anyone thinks personal data has been shared with an AI tool by mistake, they tell [name or role] straight away.

5. Human approval

AI prepares and a person approves. The following always need a person to check and approve before they are sent or acted on: [anything sent to a client or customer]; [anything that costs money or commits us to something]; [anything about an individual, such as a candidate or employee]; [regulated or compliance documents].

The person approving is responsible for checking facts, figures and tone. AI can be confidently wrong.

We keep a record of what AI prepared and who approved it, for at least [period].

6. Disclosure

We are open about our use of AI. Where it matters to the person on the other end, we tell them when AI has helped prepare something or is handling their enquiry.

We do not present AI as a human being. Our standard wording is: "[Add your wording, for example: This message was prepared with the help of AI and checked by a member of our team.]"

7. Review

We review this policy every [six or twelve] months, and whenever we add a new AI tool or the rules change.

We also review how AI is used in practice: what it does well, where it gets things wrong, and whether the approvals are working.

Questions about this policy go to [name and contact].