A minimal modern desk, a closed laptop and a notebook under one shaft of light

Free tool

AI policy generator: a UK acceptable use policy from nine answers

Do you need an AI policy? If anyone in your organisation uses AI tools for work, yes. No UK law names one, but UK GDPR and your regulator both expect that use to be governed, and a written policy is how you show it is. Tap nine answers and this drafts the whole thing, with the ICO position and your sector’s rules cited.

Each regulator has said so in its own words. The SRA’s warning notice of August 2026 ties AI use to a firm’s duty to have effective governance, systems and controls. ICAEW advises accountants to have appropriate policies and guidelines on how AI is used. The DfE tells schools to plan for uses of AI that nobody has approved, and the Charity Commission suggests trustees consider an internal AI policy. For most organisations the reason is simpler: your staff are already using AI, usually on accounts nobody signed off.

Nine answers

The page opens on a set of answers, so the complete draft is already below. Tap your own and it rewrites itself. Nothing you choose or type leaves this page.

1What kind of organisation is it?

This decides the regulator’s clauses: the SRA and the Law Society for a law firm, ICAEW for an accountancy practice, the DfE for a school, the Charity Commission for a charity. Every draft carries the ICO’s.

2What is it called?

Only used in the draft on this page and in the file you download.

3Which AI accounts will people use for work?
4Can personal data or confidential information ever go into an AI tool?
5Who approves a new AI tool?

They also approve any new use of an approved tool, and any use of AI in decisions about people.

6What must a person check before AI output is used?
7What will you tell people about AI use?
8Who owns the policy, and how often is training refreshed?

Training is refreshed

9How often is the policy reviewed?

The draft also sets a review whenever the law or your regulator’s guidance changes.

Your draft policy

A complete draft for an organisation, in 12 numbered sections.

It is a starting point: whoever is responsible for the policy reads it through and adapts it before it is adopted.

AI acceptable use policy

Policy owner
The managing director
New tools approved by
The policy owner
Drafted
27 September 2026
Next review due
27 September 2027

1. Purpose and scope

This policy sets out how the organisation uses artificial intelligence (AI) tools: which tools may be used, what may and may not go into them, how their output is checked, and who is responsible. Its purpose is to let people use AI where it helps, while protecting customers, staff and the organisation's confidential information, and keeping the organisation within data protection law.

It applies to everyone who works for or on behalf of the organisation, including employees, directors, temporary and agency staff, contractors and volunteers, on any device, whenever they use an AI tool for the organisation's work or with the organisation's information.

In this policy an AI tool means any software that generates text, images, audio, code or analysis in response to a prompt. That includes chatbots, writing and transcription assistants, meeting note takers, and AI features switched on inside software the organisation already uses.

The policy owner is the managing director. Questions about this policy go to the policy owner.

2. Approved tools and how a tool is approved

Only AI tools on the organisation's register of approved tools are used for work. The register records each tool, the type of account, the uses it is approved for, whether it may process personal data, and the date it was approved. The policy owner keeps the register and makes it available to everyone this policy applies to.

Approved business tools are used only through accounts the organisation controls, so that access can be removed the day someone leaves.

Public AI chatbots on free or personal accounts are not used for the organisation's work.

Anyone who wants to use a new AI tool, or an approved tool for a new purpose, asks the policy owner first. That includes AI features that appear in software the organisation already uses. A tool is approved only once the following are known and recorded:

  • what it will be used for, and by whom
  • what information it will handle, and whether any of it is personal data or confidential
  • what the provider's terms say about keeping what is entered, using it to train its models, where the data is held and for how long
  • where the tool will process personal data, that a written contract with the provider covers that processing, as UK GDPR Article 28 requires
  • whether a data protection impact assessment (DPIA) is needed and, if it is, that it has been completed (see section 4)
  • how access is given and removed

The approval, the reasons for it and any conditions are recorded on the register. A tool that has not been approved is not used for work, even on trial.

3. What must never go into an AI tool

The following never go into any AI tool, whatever the account:

  • passwords, access codes, security keys, and bank or card details

The following go only into an approved business tool, and only as sections 4 and 5 allow:

  • personal data about anyone: names, contact details, account and order details, HR records, or anything else that could identify a living person, alone or combined with other information
  • customer and supplier details, contracts, prices, financial information and anything else that is not already public
  • requests to find out about, or draw conclusions about, a named person

Removing names is not enough if the rest of the information could still identify who it is about. If in doubt, leave it out and ask the policy owner.

4. Personal data and UK GDPR

Personal data goes into an approved business tool only for the uses recorded on the register when the tool was approved, and only where all of the following are in place:

  • a lawful basis for the processing, identified and recorded before it starts. The ICO expects an appropriate lawful basis whenever personal data is processed with AI, whether to train a system or to use one
  • a completed DPIA. The ICO regards the vast majority of uses of AI as likely to result in a high risk to people, so the organisation completes a DPIA before any AI tool processes personal data, and records its reasoning if it decides one is not needed
  • a written contract with the provider covering the processing, as UK GDPR Article 28 requires
  • privacy information that tells people their personal data may be processed using AI tools, why, for how long and who it is shared with
  • no more personal data than the task needs. Names and details that are not needed are removed before anything is entered (data minimisation, UK GDPR Article 5(1)(c))

Special category data (health, ethnic origin, religion or belief, sexual orientation, political opinions, trade union membership, and genetic or biometric data) and criminal offence data go into an AI tool only where the DPIA for that use covers them specifically and a condition under Article 9 or Article 10 of UK GDPR has been identified.

AI output about a person is not a fact about them. Where it is kept on a person's record, the record says it was produced by an AI tool, so that it is read as an inference rather than a fact, and it is corrected if it turns out to be wrong.

If someone asks for a copy of their personal data, or asks for it to be corrected or deleted, anything held in an AI tool is included in the response.

5. Confidentiality

Information the organisation holds in confidence (customer and supplier details, contracts, prices, financial information and anything else that is not already public) goes only into approved business tools whose terms stop the provider using it to train its models or sharing it, and only for approved uses.

Where a contract restricts how a customer's or a supplier's information may be used, that restriction applies to AI tools too.

6. Checking outputs

AI tools produce fluent, confident text that can be wrong. They can invent facts, figures, quotations and references that look genuine, leave out what matters, repeat bias from their training, and be out of date. Whoever uses AI output is responsible for it as if they had written it themselves.

Before it is used, a person with the knowledge to judge it checks:

  • anything that leaves the organisation: emails, letters, quotes, proposals, reports, and anything published
  • every fact, figure, date, quotation and reference, against a reliable source, wherever it is used
  • anything that will inform a decision about a person (see section 7)

Checking means reading all of it, not skimming it: confirming facts and figures against the original source, tracing each quotation and reference to the document it came from, and making sure the output carries nobody else's confidential information.

7. Decisions about people

No decision that has a legal or similarly significant effect on a person is taken by an AI tool alone. That covers decisions about someone's job, pay or promotion, recruitment, or a customer's access to credit or to a service.

AI output may inform such a decision, but a person makes it. That person has the authority and the competence to change the outcome, considers all the relevant information, including anything the person affected has said, and records what they decided and why. Approving a recommendation without the ability or the information to change it is not a decision, and the ICO has said that a decision does not stop being automated because a person rubber-stamped it.

Under UK GDPR a decision is based solely on automated processing if there is no meaningful human involvement in it (Article 22A). Since 5 February 2026, Articles 22A to 22D have replaced Article 22. Where a significant decision is taken that way, the person must be given information about it and be able to make representations, obtain human intervention and contest it (Article 22C), and further restrictions apply where special category data is involved (Article 22B).

The organisation does not take significant decisions about people by solely automated means. Any proposal to use AI in making decisions about people needs a DPIA and written approval from the policy owner before it starts.

8. Disclosure

The organisation's privacy information explains that AI tools may be used, what for, and with what safeguards. Anyone who asks whether AI was used in work for them, or with their information, gets an honest and specific answer.

AI is never presented as a person. Where the organisation uses an AI tool to communicate with people directly, it says so.

9. Records

The organisation keeps:

  • the register of approved tools, with each approval, its conditions and its date
  • every DPIA, and the reasoning wherever one was judged unnecessary
  • the training record under section 10
  • a log of every incident under section 11, including those not reported to the ICO

Records are kept for as long as the organisation's retention schedule sets for the records they relate to.

10. Training

Nobody uses an AI tool for work until they have read this policy and been trained on it. Training covers what may and may not go into AI tools, how to check output, decisions about people, and how to report a problem.

Training is refreshed every year, and sooner whenever this policy or the register changes in a way that affects how people work. The policy owner makes sure training happens and keeps the training record.

11. Incidents

Report it to the policy owner straight away if:

  • personal data or confidential information has gone into an AI tool it should not have gone into
  • AI output containing an error has been sent, published or relied on
  • an AI tool has been used for work without approval
  • an AI tool shows information that appears to belong to someone else, or behaves in a way that suggests information is not secure

Do not delete the conversation or the output until the policy owner says so, because it is the record of what happened. A prompt, honest report is always the right thing to do, and it is treated that way.

The organisation then assesses the likely risk to the people affected. A personal data breach includes the unauthorised disclosure of, or access to, personal data. If a breach is likely to result in a risk to people's rights and freedoms, the organisation reports it to the ICO without undue delay and no later than 72 hours after becoming aware of it. If the risk to people is high, the organisation also tells them without undue delay. Every breach is recorded, whether or not it is reported.

12. Review

The policy owner reviews this policy every year, and sooner if the law, regulator guidance or the way the organisation uses AI changes. The next review is due by 27 September 2027. Changes to the policy are approved by the directors.

Two changes are already expected. The ICO's guidance on AI and data protection carries a notice that it is under review following the Data (Use and Access) Act 2025, and the ICO consulted in 2026 on updated guidance on automated decision-making. When either is published, this policy is checked against it.

Where this policy comes from

  1. ICO, Guidance on AI and data protection
  2. ICO, What are the accountability and governance implications of AI?
  3. ICO, How do we ensure lawfulness in AI?
  4. ICO, How do we ensure transparency in AI?
  5. ICO, What do we need to know about accuracy and statistical accuracy?
  6. ICO, How should we assess security and data minimisation in AI?
  7. ICO, How do we ensure individual rights in our AI systems?
  8. UK GDPR Articles 22A to 22D, inserted by the Data (Use and Access) Act 2025, in force 5 February 2026
  9. ICO, When is a contract needed and why is it important?
  10. ICO, Personal data breaches: a guide

A policy governs how people use AI. Knowing which jobs are worth handing to it is what the free audit does.

Take this to a free audit

How this works it out

The draft is put together in your browser from fixed clauses. Each answer switches clauses in or out, or changes a few words, and nothing you tap or type is sent anywhere. Every clause that cites a regulator rests on a source listed at the foot of the draft and again below, all of them read on 27 September 2026.

  • The sector

    Decides the regulator’s clauses: the SRA Codes of Conduct and its August 2026 warning notice for a law firm, ICAEW’s guidance for an accountancy practice, the DfE and Keeping children safe in education for a school, the Charity Commission for a charity. Every sector gets the ICO’s.

  • Accounts and data

    Decide whether personal and confidential information may go into any tool at all, and on what approval. Choosing public chatbots only keeps it out of every tool, because a free account comes with no contract covering your data.

  • Checks, disclosure and training

    Set what a person checks before output is used, what people are told, and how often training is refreshed. Decisions about people always stay with a person, whatever you tick.

  • Owner and review

    Put a role against the policy and a date against its next review, counted from today.

How to adapt the draft

  1. Start the register

    The policy refers to a register of approved tools. Begin it with the tools people already use, which an amnesty of the kind described in your staff are already using AI will surface in a morning.

  2. Read each sector clause against its source

    Guidance moves. The ICO’s own AI guidance is marked as under review, and the SRA published its warning notice in August 2026.

  3. Put names against the roles

    The owner and the approver, and make sure the approver is someone who can actually say no.

  4. Do the DPIA before personal data goes in

    If your answers let personal data into an approved tool, the draft requires a DPIA first. Do you need a DPIA sets out the test.

  5. Train people, then publish it

    Nobody should be held to a policy they have not been walked through. Then put it where people will find it, and put the review date in a diary.

What it will not do

  • Tell you whether a particular AI tool is safe or compliant
  • Choose your lawful basis or write your DPIA
  • Settle whether a disclosure affects legal professional privilege
  • Cover charity regulators outside England and Wales: the charity clauses follow the Charity Commission

What differs between the free and business plans of the same chatbot is covered in is ChatGPT GDPR compliant, and what a contract with an AI provider has to say is in what a data processing agreement is for. Law firms will find the reasoning behind their clauses in what an AI policy for a law firm has to cover, and accountancy practices in client data in AI tools. Where the regulator’s own AI guidance stands, and which parts are under review, is in what the ICO says about AI.

Questions people ask

Is an AI policy a legal requirement in the UK?
No UK law requires a document with that name. UK GDPR does make you accountable for how personal data is used in any AI tool, and regulators expect AI use to be governed: the SRA ties it to a firm’s duty under paragraph 2.1 of the Code of Conduct for Firms to have effective governance, systems and controls. A written policy is the simplest way to show that the decisions have been taken, and by whom.
Is this AI policy template free?
Yes. There is no sign up, no email and nothing to pay, and the whole policy is on the page to copy, print or download. It is built in your browser from your answers, and nothing you choose or type is sent to us. We do count that the tool was used, with none of your answers attached, so we know which tools are worth keeping. The only thing that ever reaches us is the summary on the audit button, and only if you press it, because it puts that summary into the form in front of you, where you can edit or delete it before sending anything.
Should an AI policy cover ChatGPT?
Yes, because public chatbots are what most staff reach for first. Depending on your answer, the draft either allows them for work with no personal data and nothing confidential in it, or rules them out. A free account comes with consumer terms rather than a contract covering your data, which is why the draft never lets personal or confidential information into one.
What does UK GDPR say about AI making decisions about people?
Since 5 February 2026, Articles 22A to 22D of UK GDPR have replaced Article 22. A decision with no meaningful human involvement is solely automated, and where it has a legal or similarly significant effect the person must be told about it and be able to make representations, obtain human intervention and contest it. The draft goes further and keeps a person in every significant decision, with the authority and the information to change it.
Do we need a DPIA before using AI?
Where personal data is involved, usually yes. The ICO says that in the vast majority of cases the use of AI involves processing likely to result in a high risk to individuals, which triggers the legal requirement for a DPIA, and that where you decide a particular use is not high risk you still need to document how you reached that view. The draft requires a DPIA before any AI tool processes personal data.
Does the draft work for a school or a charity?
Yes. Choosing a school adds the DfE’s guidance on generative AI in education and the online safety parts of Keeping children safe in education 2026, including pupil use, safeguarding and pupils’ own work. Choosing a charity adds the Charity Commission’s position that trustees stay responsible for decisions and must not rely on AI-generated advice alone. The Charity Commission regulates charities in England and Wales.

Where this policy comes from

  1. ICO, Guidance on AI and data protection, read 27 September 2026. Marked last updated 15 March 2023, with a notice reading "Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change"
  2. ICO, What are the accountability and governance implications of AI?, read 27 September 2026. "In the vast majority of cases, the use of AI will involve a type of processing likely to result in a high risk to individuals’ rights and freedoms, and will therefore trigger the legal requirement for you to undertake a DPIA." The basis of the draft’s DPIA rule
  3. ICO, How do we ensure lawfulness in AI?, read 27 September 2026. Processing personal data to train an AI system or to make predictions with one needs "an appropriate lawful basis to do so"
  4. ICO, How do we ensure transparency in AI?, read 27 September 2026. Privacy information has to cover your purposes, your retention periods and who you share the data with, given at the time you collect it
  5. ICO, What do we need to know about accuracy and statistical accuracy?, read 27 September 2026. AI outputs are often "not intended to be treated as factual information about the individual", and records should show they are "statistically informed guesses rather than facts"
  6. ICO, How should we assess security and data minimisation in AI?, read 27 September 2026. Personal data must be "adequate, relevant and limited to what is necessary", UK GDPR Article 5(1)(c)
  7. ICO, How do we ensure individual rights in our AI systems?, read 27 September 2026. Human review "must be carried out by someone with the appropriate authority and capability to change that decision", and a decision is not taken out of scope "just because a human has ‘rubber-stamped’ it"
  8. UK GDPR Article 22A, legislation.gov.uk, read 27 September 2026. Inserted by the Data (Use and Access) Act 2025 and in force from 5 February 2026, replacing Article 22: a decision is based solely on automated processing "if there is no meaningful human involvement in the taking of the decision", and is significant if it has a legal or similarly significant effect
  9. UK GDPR Articles 22B and 22C, legislation.gov.uk, read 27 September 2026. Article 22C requires safeguards for a significant solely automated decision: information about it, and the ability to make representations, obtain human intervention and contest it. Article 22B restricts such decisions based on special category data
  10. ICO, Consultation on draft guidance about automated decision-making, including profiling, read 27 September 2026. Updates "follow the introduction of the Data (Use and Access) Act 2025". The consultation closed on 29 May 2026
  11. ICO, When is a contract needed and why is it important?, read 27 September 2026. Under Article 28(3), "every time a controller uses a processor to process personal data, there must be a written contract"
  12. ICO, Personal data breaches: a guide, read 27 September 2026. "If a risk is likely, you must notify the ICO", no later than 72 hours after becoming aware; individuals are told where the risk is high; and you keep "a record of any personal data breaches, regardless of whether you are required to notify"
  13. SRA, Misuse of AI: warning notice, 17 August 2026, read 27 September 2026. "Client information should only be entered into AI systems where appropriate contractual, technical and organisational safeguards are in place to protect confidentiality." Also the source for citation checking, supervision under paragraph 3.5, and privilege that "may be permanently waived"
  14. SRA, Risk Outlook report: the use of artificial intelligence in the legal market, 20 November 2023, read 27 September 2026. "Tell clients when you will be using AI with their case, and how it will operate", and train staff on "the difference between casual use of online AI such as ChatGPT and using systems you have formally adopted"
  15. SRA Code of Conduct for Firms, paragraphs 2.1, 2.2, 3.9, 4.4, 6.3 and 9.1, read 27 September 2026. Governance and controls, records to demonstrate compliance, reporting serious breaches to the SRA, supervision, confidentiality, and the COLP’s duties
  16. Law Society, Generative AI: the essentials, read 27 September 2026. "It is advisable that you and your clients decide on whether and how generative AI tools might be used", and where a tool keeps no history, "document all inputs, outputs and system errors"
  17. ICAEW, Generative AI guide: Generative AI and ethics, read 27 September 2026. Confidentiality "means not loading confidential information into public Generative AI tools, even if such information has become publicly available"
  18. ICAEW, Generative AI guide: Do’s and don’ts, read 27 September 2026. "Ensure you have appropriate policies and guidelines in place on how AI should be used", and "Keep client and confidential internal data off public AI tools"
  19. Department for Education, Generative artificial intelligence (AI) in education, updated 12 August 2025, read 27 September 2026. "It is recommended that personal data is not used in generative AI tools." Also the source for pupil supervision and age restrictions, pupils’ original work, and planning for uses "that have not been explicitly approved"
  20. Department for Education, Keeping children safe in education 2026, in force from 1 September 2026, read 27 September 2026. Paragraph 165 lists harmful interaction with "generative AI applications" and explicit images "generated using AI" among online safety risks; paragraph 167 points schools to the DfE’s generative AI guidance
  21. Charity Commission, Charities and Artificial Intelligence, 2 April 2024, read 27 September 2026. Trustees should consider "if having an internal AI policy would be beneficial", and decision making must not be "delegated to AI or based on AI generated content alone"
  22. Charity Commission, The essential trustee (CC3), read 27 September 2026. Trustees must "act with reasonable care and skill", and "cannot delegate their overall responsibility"
  23. Charity Commission, How to report a serious incident in your charity, read 27 September 2026. Lists "a significant data breach or loss within your charity" among the incidents trustees should report

Last checked 27 September 2026.

Our workings are on the methodology page.

Free audit

Find out what the repeated work costs you

The audit counts every job the business repeats, ranks them by the hours they eat, and maps the five worth automating first. It is free, you keep everything, and there is no obligation at the end of it.

Book a free audit Try another free tool

Other free tools

All of free tools

Guides that go with this