Writing an AI policy for your organisation (in an afternoon)

Your team is probably using AI already, whether or not anyone has said it's allowed. A short AI policy doesn't slow that down. It gives people confidence to use the tools well and protects your clients, your data and your reputation.

Why a small organisation needs one

Large companies have legal teams to write long AI policies. Small businesses and charities need something different: one or two pages that everyone can read in five minutes and actually remember. A good policy answers three questions:

• Which tools can we use?
• What information must never go into them?
• Who is responsible for checking what AI produces?

The seven sections to include

1. Purpose

One or two sentences. For example: "We use AI to save time on routine tasks so we can spend more time with our clients. People stay responsible for everything we produce."

2. Approved tools

List the tools people can use for work, and how to request a new one. Where possible, use business accounts rather than personal ones, so you control the settings and can remove access when someone leaves.

3. Information that stays out

Be specific. Most organisations agree that the following must never be entered into an AI tool unless it has been approved for that purpose:

• Personal details about clients, customers, beneficiaries or staff
• Health, safeguarding or financial records
• Passwords, contracts and commercially sensitive information
• Anything shared with you in confidence

If you're unsure how a tool stores or uses data, check its business terms or ask before using it. Your existing data protection responsibilities still apply when AI is involved.

4. Checking the output

AI can produce confident, convincing mistakes. Agree that a person reads and checks anything before it reaches a client, goes on your website or is used to make a decision. Facts, figures, names and quotes deserve extra care.

5. Being open about AI use

Decide when you'll tell people AI was involved. Many organisations are happy to use AI for drafts without mentioning it, but choose to be open where it matters, such as automated replies on a website or images that could be mistaken for real photographs.

6. Fairness and judgement

AI shouldn't make decisions about people on its own, such as shortlisting job applicants or deciding who receives support. Use it to help with admin, and keep important judgements with people.

7. Ownership and review

Name one person who looks after the policy, and set a date to review it. Every six months is sensible, because the tools change quickly.

Roll it out without fuss

1. Share a draft with the team and ask what they already use. You'll learn a lot.
2. Agree the final version together, so it reflects how people really work.
3. Run a short session showing good and bad examples.
4. Keep the policy somewhere easy to find, such as your shared drive or staff handbook.

Want help putting it in place?

We help teams choose the right AI tools, write practical policies and train people to use them well. See our AI consultation service, or read where to start with AI tools if you're just beginning.

This guide is general information, not legal advice. If you handle particularly sensitive data, take advice specific to your organisation.