Free template
Most AI policies are either a one line ban or a legal document nobody reads. This template is the middle ground: short enough to be read, specific enough to be followed and structured so that it satisfies UK GDPR, the UK AI principles and the parts of the EU AI Act that reach UK companies.
By Christopher Fagan, Managing Partner, PEF Consulting Partners
A note before you start
Most of the AI policies I see fall into one of two camps. Either they ban everything, so people use the tools anyway and nobody knows, or they run to twenty pages that nobody reads. This one is meant to sit in the middle: short enough that people will actually read it, and specific enough that you can tell whether someone followed it. Change it to suit how you work, and please do not file it and forget it. The tools move faster than any policy, so look at it again in six months.
Christopher Fagan, Managing Partner, PEF Consulting Partners
Replace the bracketed text, delete the sections that do not apply and keep the whole thing under four pages. Approve it at board or executive level, publish it where people will find it and review it every six months, because the tools and the rules will both have changed.
The policy works alongside an AI inventory and a risk assessment process. It is not a substitute for them. Our AI governance framework guide explains how the three fit together.
[Organisation name] | Version 0.1 | [Date] | Owner: [Name, role]
This policy sets out how [Organisation] uses artificial intelligence, including generative AI tools, machine learning models and AI features built into software we already use. It applies to all staff, contractors and third parties acting for us, on any device, whether the tool was provided by us or chosen by the individual.
AI system: any software that generates content, predictions, recommendations or decisions from data with limited human instruction. Approved tool: an AI system listed in the AI inventory with an assigned owner and risk rating. Confidential information: personal data, client data, commercially sensitive information and anything marked restricted.
Staff may use approved tools for drafting, summarising, research, analysis and coding support, provided outputs are reviewed before use. Staff must not use any AI tool to make or substantially inform decisions about individuals (recruitment, performance, credit, eligibility) unless the tool is approved for that purpose and a human reviews every decision. Staff must not enter confidential information into any tool that has not been approved for it, and must not present AI generated content as their own original analysis to clients or regulators without review.
Personal data may only be processed by AI tools covered by a data protection impact assessment and a contract that prohibits the vendor from training on our data. [Named role] maintains the list of tools approved for personal data. Client data is subject to the client’s own terms, which take precedence.
AI outputs can be wrong, biased or fabricated. Every output used in our work must be checked by a person competent to judge it, and the person remains accountable for the result. Outputs that affect customers, finances, legal positions or safety require a second review by [role].
We tell people when they are interacting with an AI system and when content provided to them was substantially generated by one. Where AI informs a decision about an individual, we explain that in plain language and offer a route to a human review.
New AI tools and features, including those switched on inside existing software, require approval by [role] before use, an entry in the AI inventory, a risk rating and, where the rating requires it, a full risk and impact assessment. Vendor contracts must cover data use, model changes, audit rights and exit.
The [Executive role] is accountable for this policy. [Role] owns the AI inventory and the approval process. Each approved tool has a named business owner. Managers are responsible for compliance in their teams.
Suspected misuse, data leakage, harmful or discriminatory outputs and security concerns involving AI must be reported to [role or mailbox] within one working day and are handled under the incident process, with the same seriousness as a data breach.
All staff complete AI awareness training on joining and annually. Staff who approve, build or operate AI systems complete role specific training. Records are kept by [role].
This policy is reviewed every six months by [role] and approved by [body]. Version history:
| Version | Date | Change | Approved by |
|---|---|---|---|
Template by PEF Consulting Partners, pefconsultingpartners.co.uk. Free to use and adapt.
Related reading: a practical AI governance framework, the EU AI Act for UK companies, ISO 42001 explained, the free AI readiness check, AI readiness, governance and implementation consultancy.
No. The best ones are three or four pages, written so that a new starter can follow them. Detailed procedures for approving tools or assessing risk belong in separate documents the policy points to.
It is structured to meet UK GDPR obligations around personal data and automated decisions, the UK AI principles that regulators apply and the transparency and literacy duties of the EU AI Act. It is a template rather than legal advice, so have your data protection lead or counsel review the finished version.
A ban rarely works and drives use underground. A policy that approves specific tools for specific uses, forbids confidential data in unapproved ones and requires human review is more likely to be followed and to stand up to scrutiny.
If you want the policy turned into a working governance framework, with the inventory, assessments and controls behind it, a short confidential conversation is the place to start.