An AI policy for your business: what to include, with a template outline
Why every business needs a short AI policy, what to put in it, how to sort data into safe, careful and never, and a plain-English outline you can adapt.
By Logic NI5 min read
If your staff use AI at work, and the evidence says they probably do, you need a written policy. It doesn't have to be long or legal. It has to be clear, short and findable. This guide explains what to include and gives an outline you can adapt. It is general guidance, not legal advice. For the data protection background, read AI and UK GDPR, and for the bigger picture, the complete guide to AI automation.
Why you need one
| What was found | Who found it | Read it with care |
|---|---|---|
| 83% of respondents used AI tools such as ChatGPT, Copilot and AI features in everyday software, and 73% had not put formal AI policies in place | Galvia for Belfast Chamber, reported by The Irish News, 15 January 2026 | An online survey of 211 participants from 202 organisations. Counts informal use |
| 19% of Northern Ireland firms with 20 or more employees were formally using AI | GCD Technologies with the Institute of Directors NI, reported by The Irish News, 8 October 2025 | About 200 businesses. Formal use only |
The gap between informal use and formal use is where problems happen: customer details pasted into a public chatbot, confidential documents summarised in a personal account, or an unchecked AI draft sent to a client. A policy is the cheapest way to prevent these.
What a good policy does
- Tells staff which tools are approved and which are not.
- Says what may and may not be entered.
- Requires a person to check AI output that matters.
- Names who is responsible and who to ask.
- Explains what to do if something goes wrong.
- Is short enough that people read it.
Sort your information into three groups
This is the most practical part. Give staff a simple traffic light:
| Group | Examples | Rule |
|---|---|---|
| Fine | Public information, your own published web content, generic questions, drafts with no real names or figures | May be used with approved tools |
| Careful | Internal documents, anonymised examples, supplier information, your own business figures | Only in approved business tools, and share the minimum |
| Never | Customer or staff personal data, contracts, passwords and access codes, financial account details, anything confidential under an agreement | Must never be entered into a public AI tool, and only into an approved tool where the task genuinely requires it and a manager has approved |
Adapt the examples to your business. A recruitment firm, a clinic and a builder will each draw the lines in different places.
A template outline
Below is a plain-English outline. Copy it, change the specifics and keep it to one or two pages.
1. Purpose. Why we have this policy: to get the benefits of AI while protecting our customers, our staff and our business.
2. Who it applies to. Everyone who works for us, including contractors and temporary staff.
3. Approved tools. The AI tools you may use for work are: [list]. Do not use other AI tools for work, including free versions on personal accounts, unless [name] has approved them.
4. What you may use AI for. [Examples: drafting, summarising, brainstorming, formatting, research starting points.]
5. What you must never enter. [List the Never group.]
6. Checking the output. AI can be wrong, biased or out of date. A person must read and take responsibility for anything that goes to a customer, supplier or the public, or that supports a decision. Do not present AI output as fact without checking it.
7. Decisions about people. AI must not be used to make decisions about hiring, discipline, pay or access to services. It may support a person who makes the decision. Ask [name] before using AI in any process affecting individuals.
8. Confidentiality and customers. Do not tell customers an AI wrote something if it would mislead them. [Add your own rule on disclosure.]
9. If something goes wrong. If you enter something you shouldn't, or the AI produces something harmful, tell [name] straight away. Quick reporting matters more than blame.
10. Questions and review. Ask [name] if unsure. We will review this policy every [six or twelve] months, or sooner if the tools or the law change.
Make it work in practice
- Provide an approved tool. If the only option is a free public one, people will use it.
- Explain the why, with one real example of what could go wrong.
- Keep it findable. Pin it somewhere everyone looks.
- Review it. AI tools and the law are changing. The ICO's automated decision-making guidance was updated in draft in March 2026, and its AI guidance is under review.
- Back it with controls where you can, such as managing which tools are available on company devices.
- Include it in induction for new starters.
How the traffic light works in practice
Staff don't want a legal essay. They want to know whether they can do the thing in front of them. A few worked scenarios in the policy make the rules concrete:
| Situation | Verdict | Why |
|---|---|---|
| Asking an approved tool to tidy the wording of a public web page | Fine | No private information involved |
| Asking an approved tool to summarise a supplier's public brochure | Fine | Public information |
| Pasting a customer's complaint, with their name and order details, into a free chatbot on a personal account | Never | Personal data in an unapproved tool |
| Asking the approved business tool to draft a reply to that same complaint, with the name removed | Careful | Approved tool, minimum data, a person checks and sends |
| Uploading a signed client contract to summarise it | Never, unless a manager has approved the tool and the task | Confidential and possibly covered by an agreement |
| Using AI to rank job applicants and reject the lowest | Never as a sole decision | Decisions about people need a person with real authority |
Add three or four scenarios from your own business. People remember examples far better than rules.
What a policy doesn't do
A policy doesn't replace UK GDPR obligations, such as impact assessments for high-risk processing, supplier checks and meeting individuals' rights. It supports them. If AI will make or shape significant decisions about people, take advice first. The ICO's guidance for organisations is the place to check current requirements.
Where we can help
We can help you decide which AI tools suit your business, set them up with sensible controls and write a policy that fits how you actually work. See the AI automation service and business systems, or talk to us.