Free template
An AI policy your people will actually read
One page for staff, a traffic-light card for the common questions, and an outline of the annex for the people who run it. Copy it, fill in the square brackets, and issue it with your approved AI tool.
The test is what happens at the desk
Most AI policies we review are either a single line in an old IT policy or fourteen pages written for lawyers. Nobody reads either. The decisions they were meant to settle get made at each desk, one prompt at a time.
Picture someone in customer service with a complaint, three pages of emails and twenty minutes before a call. Can they paste the thread into the assistant and ask for a draft reply? If the answer takes more than a minute to find, the policy plays no part in what happens next.
So this template does three jobs. It settles routine uses in advance. It tells people where to go for the rest. And it is the record that the business took reasonable steps.
How we use AI at [Company]
The square brackets are the decisions your business has to make. Under each section is a note on why it is there. The notes are for you, not for the page you issue.
Why
We want everyone to use AI where it helps, safely. This page tells you what you can do without asking, what to check first, and what not to do. It applies to everyone, including directors, contractors and temporary staff.
Why it's there. It opens with permission, not prohibition. A policy that only restricts sends people back to their personal accounts. Naming directors matters: if the board is still on personal accounts, the policy is not credible. See why blocking AI tools makes the data risk worse.
Use our tools, on our accounts
For work, use only the tools in our approved list, signed in with your work account: [for example, the company Claude or Copilot workspace]. Do not use personal AI accounts, free tools or browser extensions for company or client information. If you need a tool that is not on the list, ask [owner]; we will look at it within [five working days].
Why it's there. Approving a product is not enough. "Claude is approved" can be read as covering a personal account, so the policy names the account as well as the tool. Business tiers come with terms that keep your data out of model training. See what "enterprise" means on an AI licence and no-training licence terms.
Know what you are putting in
Public information and your own general work can go into approved tools. Confidential company information and clients' information can go into approved tools only. Personal data about customers, colleagues or anyone else can go in only for the uses marked green or amber in the matrix, and never special-category data (health, ethnicity, religion, sexuality, criminal records, biometrics) without written approval. Passwords, keys and security details never go in.
Why it's there. This is the question people actually ask. The categories should match the data classification you already use for information security, so staff learn one scheme, not two.
Check before you use
AI makes things up and sounds sure when it does. You are responsible for anything you send, publish, decide or commit in code, whoever drafted it. Check facts, figures, names, citations and code before they leave you.
Why it's there. Responsibility stays with the person, not the tool. This one sentence prevents most of the embarrassing failures.
Say when it matters
Tell people when they are dealing with an AI rather than a person, and label AI-generated images, audio and video. If a client contract or a publisher's rules require you to disclose AI use, do so.
Why it's there. Transparency is a duty under the EU AI Act for chatbots and generated media. See does the EU AI Act apply to UK businesses?
Decisions about people
AI can help you prepare a decision about a person (hiring, performance, pay, credit, a complaint), but a person makes it, understands why, and can explain it. Using AI in these decisions needs [owner]'s approval first.
Why it's there. Hiring, worker management and credit are high-risk uses under the EU AI Act, and UK data protection law has its own rules on automated decisions. See human in the loop: where the threshold goes.
Automations and agents
Do not connect AI to email, systems, payments or customer accounts so that it can act on its own without approval from [owner].
Why it's there. An assistant that drafts is low risk. One that can send, buy, change or delete is a different system, and needs limits and logging. See the four levels of AI.
What we can see
Your conversations in our AI workspace are company records. We keep them for [period] and may search or produce them for security, legal or regulatory reasons, to answer a request someone makes about their own data, or to investigate a specific concern. We do not read them to monitor your productivity.
Why it's there. People should know before they type. Saying what you will not do with the records builds the trust that makes people report problems.
If something goes wrong
If you pasted something you should not have, or an AI output caused a problem, tell [contact] the same day. Reporting a mistake quickly is never a disciplinary matter in itself.
Why it's there. The early report is the most valuable governance information you will get. People only make it if it is safe to.
Owner and review
[Name, role] owns this policy. We review it every [six] months and whenever our tools change.
Why it's there. A policy with no owner and no review date goes stale within months. ISO/IEC 42001 expects top management to set the AI policy. See ISO 42001 in plain English.
The common questions, answered at a glance
Green: go ahead with an approved tool. Amber: go ahead once the condition is met. Red: not with these tools. It is sorted by use, not by product, because that is how the question arrives.
| Use | Light | Condition |
|---|---|---|
| Drafting, rewording, summarising your own or public material | Green | Approved tool; check before sending |
| Research on public information | Green | Check facts and sources before relying on them |
| Internal documents with confidential company information | Green | Approved tool on a business account only |
| Client documents and correspondence | Green | Approved tool only; not if the client contract forbids it |
| Writing and reviewing code in company repositories | Green | Approved coding tool; human review before merge; no secrets in prompts |
| Customer personal data, for example summarising a complaint | Amber | Approved tool; minimum data needed; covered by our privacy notice |
| Content published under the company's name | Amber | Named human reviewer; disclose where required |
| Customer-facing chat or email sent without a person reading it first | Amber | Owner approval, disclosure to customers, a route to a person |
| Anything that informs a decision about a person | Amber | Owner approval and an impact assessment first |
| Connecting AI to systems so it can act (send, buy, change, delete) | Amber | Owner approval; limits and logging |
| Special-category personal data | Red | Unless a specific use has written approval |
| Any company or client information in a personal or unapproved tool | Red | Always |
| Passwords, API keys, security configurations | Red | Always |
| Content that imitates a real person, brand or document | Red | Always |
Add the three uses most specific to your business, and delete any that do not apply. Keep it to one side of paper: past twenty rows, it has become a second policy.
What sits behind the page
The annex is for the people who run the policy, not for general reading. It can be as long as it needs to be.
Approved tools register
Each tool, the account type, the contract and data terms, who administers it, and which data it is approved for.
Data classification
How public, internal, confidential, personal and special category in the card map to your information security policy.
Roles
The policy owner, who approves amber uses, who handles requests for new tools, and who receives incident reports.
Exceptions
How an amber request is made, what it needs, and the target time for an answer. Five working days is a reasonable promise.
Linked policies
Information security, data protection, acceptable use, social media, records retention and disciplinary.
Training record
Who has been briefed, when, and on which version. The record is your evidence of AI literacy.
Five things that get a policy followed
- Launch the tool and the policy together. A policy that restricts without providing is a ban by another name.
- Start with the directors. Move the board onto business accounts first.
- Name an owner who answers. The response time on amber requests is the policy's real test.
- Make reporting mistakes safe. Otherwise the early warnings never arrive.
- Review it in ninety days. Ask which questions it did not answer, and which amber requests should become green.
Brief every team for twenty minutes: the approved tools, three things AI gets wrong, a green, an amber and a red example from their own work, and who to ask. Record who attended.
How the page and the card work together
Can I paste a client's contract into the assistant to summarise it?
Yes, in the approved workspace, unless that client's contract with us forbids sharing their documents with third parties. If you are not sure, ask the account owner.
Can I use the assistant to help write a reference for someone who used to work here?
Yes for the wording. A reference is a statement about a person, so the facts and the judgement must be yours, and keep their personal details to the minimum.
A supplier has asked us to run their document through our AI and send them the output. Is that all right?
Treat material from outside as untrusted. Reading and summarising it is green. Letting the AI act on instructions inside it, or sending its output without reading it, is not.
Is this template legal advice?
No. It is a starting point that covers what most businesses need. If you use AI in or near the EU AI Act's high-risk categories, take legal advice on those uses.
From one page to a governance system
This template is chapter 3 of GOVERN, our book on AI governance for businesses that use AI. Or we can set the policy, the tools and the training up with you.