AI policy for employees: a UK template you can adapt today
An AI policy for employees in the UK fits on two pages and covers six things: approved tools, data that must never go in, client confidentiality, file uploads, personal accounts and what happens if the rules are broken. The template below covers all six. Copy it, change the names, publish it, and get a dated agreement from each person. AI is welcome. Company and client data stay out of it.
What a staff AI policy needs to do
A policy has one job. It tells staff what they can do, in plain words.
It should not be a ban. Bans tend to push AI use onto personal phones, where you cannot see it. A good policy says yes to AI, then draws a clear line around data.
It also needs to be short. If staff will not read it, it does not protect anyone.
Rule of thumb: if a new starter cannot read your AI policy in five minutes and explain it back, it is too long.
Before you start: three facts to gather
- Which AI tools people already use. Ask. Or check. Our guide on how to find out which AI tools your staff are using walks through it.
- Which tools you will pay for. A business plan usually gives you more control than a free personal account.
- Who owns the policy. One named person. Usually the owner or practice manager.
The UK AI policy template for employees
The example uses a fictional firm, Ashcombe. Swap in your own details.
1. Purpose
Ashcombe welcomes the use of AI tools to save time and improve our work. This policy sets out how to use them without putting company or client data at risk. It applies to everyone who works for or with Ashcombe, including contractors.
2. Approved tools
You may use these AI tools for work:
- ChatGPT, through the Ashcombe business account only
- Microsoft Copilot, signed in with your Ashcombe account
Any other AI tool needs approval from the policy owner first. This includes browser add-ons, note-takers and apps that summarise meetings. If you are unsure, ask before you use it.
3. Data you must never put into an AI tool
Even in an approved tool, never paste, type or upload:
- Card numbers or bank account details
- National Insurance or NHS numbers
- Passwords, PINs or secret keys
- Health information about anyone
- Lists of people, such as client, staff or contact lists
- Anything marked confidential
4. Client confidentiality
Do not enter client names or anything that identifies a client. Replace names with a stand-in such as "Client A". Remove addresses, account numbers and reference numbers.
So Tom asks: "Draft a polite chaser for Client A about an overdue invoice." Not: "Draft a chaser for Fenwick Joinery, invoice 4471." The question still goes. The client stays out of it.
5. File uploads
Do not upload client files to any AI tool. This covers Excel, Word, PowerPoint, PDF and text files. Internal files with no personal or client data may be uploaded to approved tools only. If a file has a single client name in it, it does not go.
6. Personal accounts
Do not use a personal AI account for Ashcombe work. That includes free accounts, accounts on your own phone and accounts paid for yourself. Work goes through Ashcombe accounts only.
7. Checking the output
AI can be wrong. You are responsible for anything you send or file. Check facts, figures and tone before it leaves Ashcombe.
8. Mistakes and reporting
If you put something into an AI tool that you should not have, tell the policy owner the same day. You will not be in trouble for reporting a genuine mistake. Hiding one is a different matter.
9. Breaking the policy
Deliberate or repeated breaches of this policy may lead to action under Ashcombe's disciplinary procedure.
10. Agreement
I have read and understood this policy and agree to follow it.
Name. Role. Date.
How to adapt the template
Most of it works as written. A few parts need your own details.
- Approved tools. List only what you pay for and have set up. Remove anything you do not use.
- Forbidden data. Add anything specific to your work. A recruiter might add CVs. An accountant might add tax references.
- Regulated firms. Solicitors, accountants and financial advisers have extra duties. Check your regulator's guidance and add a line on it.
- Consequences. Link section 9 to your existing disciplinary process. Do not invent a new one.
- The reporting promise. Keep section 8. Early reports matter. Our guide on whether pasting a client email into ChatGPT is a data breach explains why.
Prefer to answer a few questions instead? The free AI policy generator builds a version for your firm.
Publish it and collect dated agreement
A policy nobody has agreed to is hard to rely on. Clients, insurers and auditors increasingly ask to see who agreed and when.
- Put the policy somewhere everyone can find it.
- Send it to each person with a clear deadline.
- Record each agreement with a name and a date.
- Chase anyone who has not agreed.
- Ask new starters to agree in their first week.
- Ask everyone again when the policy changes.
A spreadsheet works for a small team. Keep it up to date. Ashcombe's might read: 22 of 24 agreed by 6 October 2026. Priya and Liam outstanding.
A policy says what should happen. A record shows it did.
Where a written policy stops
A policy relies on people remembering it. On a busy day, someone will paste the wrong thing.
Helio Guard records each person's dated agreement to your AI policy. It also checks pastes, messages and file uploads on listed AI sites. Sensitive items are taken out and swapped for labels, so the question still goes. Checked on the PC. We never see what your team types. It is £1 a person a month, from 5 people, with 14 days free and no card needed. The details are on the pricing page.
Common questions about staff AI policies
Is an AI policy a legal requirement in the UK?
No UK law names an AI policy as a requirement for businesses. But UK GDPR expects firms to take sensible organisational steps to protect personal data. A written AI policy, agreed by staff, is one of the simplest ways to show that. Regulated firms may also find their regulator expects one.
Do employees have to sign an AI policy?
A signature is not strictly needed for an AI policy to apply at work. A dated agreement from each employee is still worth collecting. It shows each person saw the rules, and it is what clients, insurers and auditors usually ask for when they check how a firm controls AI use.
How often should an AI policy for employees be reviewed?
Review an employee AI policy at least once a year. Also review it whenever you add or drop an AI tool, or when a regulator changes its guidance. AI tools change quickly. After each update, ask staff to agree again so the dated record matches the current version.
Related: Shadow AI in small businesses: how to find it and what to do, How to monitor employee AI use without spying on staff, How to let staff use AI safely: a four-week rollout for small firms