Writing an AI Policy: 5 Things a UK Business Must Cover

Plenty of companies use AI with no written rules at all. The government’s Cyber Security Breaches Survey 2025/2026 found that among UK businesses using, adopting or considering AI, only 24% had cyber security practices in place to manage the risks.

A written AI policy fixes that. It doesn’t need to be long. It needs to answer five questions clearly, so managers can make decisions and staff know where they stand.

This post covers what goes in the written policy. For the short list of rules staff follow at their desks, see our nine everyday AI rules for staff.

1. Scope and approved tools

Start by saying what the policy covers: generative AI tools such as Copilot and ChatGPT, AI features inside other software, browser extensions and meeting note-takers.

Then list:

• The approved tools, and what each may be used for. For example, Copilot Chat for drafting and summarising, but not for client advice.
• How to get a new tool approved, and who decides.
• That work accounts must be used, never personal ones.
• What isn’t allowed, such as unapproved apps or add-ins that ask for access to your email or files.

Keep a simple register of approved tools: what each one is, who uses it, what data it can see and where that data is processed. Microsoft, for example, says Copilot customers outside the EU may have their queries processed in the US, the EU or other regions. That’s worth knowing and writing down.

2. What data can go in, and what can’t

This is the part that protects you most. Sort your information into three groups:

• Never: client personal data, special category data such as health information, anything confidential or legally privileged, passwords and other credentials.
• Only in approved tools with the right protections: internal documents, with any client details removed, in a tool your company has checked, such as Copilot signed in with a work account.
• Fine anywhere: information that’s already public.

The NCSC advises against putting sensitive information into public AI tools, or anything that would cause problems if it were made public. ICAEW and the SRA say the same about client information.

3. Human review and accountability

AI output is a draft, never a finished product. The policy should say:

• Who checks what. For example, anything going to a client is checked by someone qualified to give that advice.
• That the person sending it is responsible for it. The SRA states that solicitors remain accountable for their work however it was produced, and that’s a sound rule for any company.
• What must always be verified: facts, figures, names, dates, legal references and anything quoted.
• That AI doesn’t make significant decisions about people, such as recruitment, on its own.

4. Data protection

If AI touches personal data, UK GDPR applies. The ICO’s guidance on AI and data protection is under review following the Data (Use and Access) Act 2025, but its core expectations remain. Your policy should cover:

• Data protection impact assessments. The ICO says that in the vast majority of cases, using AI will involve processing likely to result in a high risk to individuals, which means a DPIA. Even where you decide it doesn’t, document why.
• Lawful basis and transparency. Check your privacy notice explains any use of AI on personal data.
• Contracts with AI providers. Where a provider processes personal data for you, UK GDPR requires a contract with specific terms, including security and the use of sub-processors.
• Accuracy and individual rights. How you’ll correct wrong information, and how you’ll handle requests from people about data processed by AI.

5. Ownership, records and review

Name the person who owns the policy and approves tools. Then decide what you’ll keep a record of: the tool register, approvals, DPIAs and any incidents, such as client data pasted into the wrong tool.

You don’t need to log every prompt. If you use Microsoft 365 Copilot, Microsoft Purview can retain Copilot interactions if you ever need them for compliance or legal reasons.

Review the policy at least once a year, and sooner if you approve a new tool, a provider changes its terms or your regulator publishes new guidance. Re-train staff after any significant change.

For solicitors and accountants

The SRA’s August 2026 warning notice expects firms to have effective systems and controls for AI use, proper supervision and trained staff, and stresses that every authority cited in court must be genuine. ICAEW reminds members that generative AI tools “are not fully qualified accountants” and that output needs professional scepticism. Your policy should reflect both.

From our work

Many of our clients didn’t realise that free AI tools can keep what staff type and use it for training. When we rolled out Copilot for one client, we put an AI policy in place alongside it, with training on Copilot Chat and Copilot, so staff had no reason to use free tools for work. The team now uses AI to help write case studies and some of their standard operating procedures.

David Gilbey, Just Gilbey IT Solutions

Turning the policy into practice

A good policy is short, specific and actually used. Pair it with a one-page summary for staff, put the approved tools where people can find them, and review it regularly. Our AI & Copilot service includes writing the policy with you, setting up the approved tools in Microsoft 365 and explaining the rules to your team.