If anyone in your business uses AI tools, you need a written AI use policy. It does not need to be long. A page or two that says which tools are approved, what data can go into them and who checks what they produce covers most of the risk, and it tells staff they can use AI for work without guessing where the line is.
The template below is free to copy or to download as a Word file, and the notes after it explain each part.
What an AI policy is for
A public AI chatbot is as easy to use as a search engine, and staff use them to proofread emails and sort out spreadsheets. By default, a conversation with a public chatbot may be kept and used to train future models unless the user opts out, so a client list or HR note pasted into one has left the business. That is shadow AI: AI tools in use that the business has not approved.
A policy names the tools people may use, the data they may put into them and who is responsible for what comes out.
What to include
- Which AI tools are approved, and for what
- Data that must never go into an AI tool the business has not approved
- Who checks AI output before it is used, and when to say AI was involved
- How to ask for a new tool, and who decides
- Company accounts only, never personal ones
- What to do if something goes wrong
- Who owns the policy and when it is reviewed
The template
Download it as a Word document (40 KB, no sign-up), or copy it from below. Replace everything in square brackets. Keep the sentences short; staff should be able to read it in five minutes.
[Company name] AI use policy
1. Purpose. This policy lets our staff use AI tools to save time while keeping our clients’ and our own information safe. It applies to everyone who works for [Company name], including contractors, on any device used for our work.
2. Approved tools. You may use only the AI tools listed here, for the purposes listed, signed in with your work account.
Tool Approved for Data you may use [Microsoft 365 Copilot, work account] [Drafting, summarising and searching our own documents] [Anything you can already open in Microsoft 365] [Tool name] [Purpose] [Data allowed] Any AI tool not on this list is not approved for work, including free and personal versions of approved tools.
3. Data that never goes into an unapproved tool. Never put any of these into an AI tool that is not on the approved list: personal data about clients, staff or anyone else; client documents or anything a client has shared in confidence; contracts, prices or financial records; passwords, keys or system details; [anything else specific to your business].
4. Checking the output. AI can be wrong, and it can sound sure of itself when it is. A person checks every piece of AI output before it is used, sent or relied on, and that person is responsible for it. [Tell the client when AI has drafted something they will rely on, if your sector or your contracts expect it.]
5. Asking for a new tool. Ask [role, for example the operations manager] before using a new AI tool for work. They will check where the tool keeps and processes data, whether our data is used to train it, and whether we can manage accounts centrally. Approved tools are added to section 2.
6. Accounts. Use AI tools only through accounts [Company name] provides and controls, with multi-factor sign-in turned on. Do not use a personal account for work, even for an approved tool.
7. If something goes wrong. If you put data into a tool by mistake, or think AI output has caused a problem, tell [role] straight away. Reporting it quickly matters more than how it happened.
8. Ownership and review. [Role] owns this policy and reviews it every [six] months, or sooner when we add or remove a tool.
Last reviewed: [date]
This template is a starting point, not legal advice. Have whoever advises you on data protection read it before you issue it, particularly if you are in a regulated sector.
Notes on each part
Approved tools
Name the product and the version. “ChatGPT” covers a free personal account and a business plan with different data terms, so say which one is approved. If you use Microsoft 365 Copilot, remember that it shows each person whatever they can already open in Microsoft 365. Review who can see what before you buy licences, or Copilot will surface files people were never meant to find.
Data rules
Keep the list to the categories your staff actually handle, so it is short enough to remember.
Checking output
Make it plain that the person who uses AI output owns it, as they would own anything else they send.
New tools
A named person who can say yes stops people working around the policy. Without one, the quickest route is to use the tool and not mention it.
Review
AI tools change their terms and features often, so review the policy on a schedule and whenever you add or drop a tool.
UK GDPR and AI tools
Personal data put into an AI tool is still personal data under UK GDPR, so the usual rules about where it goes and why still apply. The Information Commissioner’s Office publishes guidance on AI and data protection. Before staff use a tool with personal information, find out where it processes and keeps data and whether the vendor uses it for training.
A policy works better with controls behind it
A policy on its own relies on everyone remembering it every time they open a browser. Browser security can show which AI tools are actually in use, allow the approved ones, restrict the rest, and stop sensitive data being pasted or uploaded into a tool that is not approved.
That is what our shadow AI protection does, using DefensX browser security. We write the AI use policy with you, put the controls in place to match it, and review Microsoft 365 permissions before any Copilot rollout. We run the same controls on our own staff.
If you are working out where AI fits in your business at all, our page on adopting AI with the right controls is the place to start, and Applied AI covers the rest of what we do.
We help businesses across the North East, including Newcastle and Darlington. Call us on 01642 661888 to talk it through.