AI Use Policy Template: What To Include

Can your staff use ChatGPT, Copilot or other AI tools at work without putting customer data, confidential information or company content at risk? Yes, but you need clear rules before people start experimenting.

AI can save your team a huge amount of time. It can help draft emails, summarise notes, brainstorm social posts and tidy up documents. The risk is that it can also quietly copy sensitive information into tools you don't control, create inaccurate content, or blur who owns the work.

An AI use policy doesn't have to be complicated. A good one tells your staff which tools they can use, what they must never upload, who checks the output, and what happens if the rules aren't followed.

Do You Need An AI Use Policy At Work?

Yes, if your staff use generative AI for work, you should have a written AI use policy. Even a simple policy is better than relying on informal common sense, because different people will have very different ideas about what is safe.

For a UK business, the main legal risks usually sit in five places:

• Data protection: If staff put personal data into an AI tool, UK GDPR and the Data Protection Act 2018 can apply.
• Confidentiality: Staff might upload customer lists, pricing, strategy documents, code, contracts or supplier terms.
• Accuracy: AI tools can produce confident but wrong answers, which can cause real problems in customer communications, advice-style content or product descriptions.
• Intellectual property: You need to know whether your business can use the output commercially, and whether it might copy someone else's work.
• Employment management: If you want to discipline someone for misusing AI, you need clear rules that staff have actually seen.

The UK doesn't currently have one single AI law for small businesses. Instead, existing laws still do a lot of the work. That includes UK GDPR, the Consumer Rights Act 2015, employment law, confidentiality obligations, copyright law and your contracts with customers and suppliers.

The Data (Use and Access) Act 2025 has updated parts of the UK's data protection framework, but it hasn't removed the basic point: if your business is responsible for personal data, you need to control how staff use it, including through AI tools.

What Should An AI Use Policy Template Include?

An AI use policy template should include clear sections on permitted tools, banned data, human review, intellectual property, data retention, record keeping and consequences for misuse. Treat the template as a starting point, not a finished legal document, because the right rules depend on your tools, data and industry.

Here is a practical fill-in outline you can adapt with legal help before you use it:

1. Purpose Of The Policy: Explain that the policy sets rules for using AI safely, lawfully and consistently at work.
2. Who The Policy Applies To: Cover employees, workers, contractors, freelancers, interns and anyone else with access to your systems or information, including any acceptable use rules.
3. Approved AI Tools: List the tools staff can use, any account settings required, and who can approve new tools.
4. Permitted Uses: Give examples, such as drafting internal emails, summarising non-confidential notes, brainstorming ideas or creating first-draft marketing copy.
5. Prohibited Uses: Ban uploads of restricted data, automated decision-making about people without approval, impersonation, unlawful content and anything that breaches customer or supplier contracts.
6. Data And Confidentiality Rules: Set out what personal data, customer data, trade secrets and internal documents can and can't be entered into AI tools.
7. Human Review: Require a real person to check AI outputs before they're sent, published, relied on or added to customer work.
8. Intellectual Property: Explain who owns work created by staff, how AI-generated content can be used, and when legal approval is needed.
9. Record Keeping: Say when staff need to keep prompts, outputs, approval notes and tool details.
10. Breaches And Disciplinary Action: Explain how concerns should be reported and what may happen if someone ignores the policy.

A policy that simply says staff may use AI responsibly is usually too vague. Your staff need practical examples, especially around customer data and confidential information.

What Data Should Staff Never Put Into AI Tools?

Staff should never put personal data, confidential business information or customer material into an AI tool unless your business has checked the legal, contractual and security risks first. This is the heart of your employee AI policy.

Your policy should clearly restrict uploads of:

• customer names, addresses, emails, phone numbers or account details
• employee records, CVs, payroll information, health information or performance notes
• special category data, such as health, disability, biometric, ethnic origin or trade union information
• contracts, proposals, pricing, business plans and board papers
• source code, product roadmaps, technical designs or unpublished creative work
• login credentials, API keys, passwords or security settings
• customer support chats, complaints or call transcripts that identify people

Under UK GDPR, you need a lawful basis for processing personal data. You also need to follow principles like data minimisation, security, transparency and purpose limitation. If an AI provider processes personal data for you, you may also need proper processor terms and checks around where the data is stored or accessed.

If you use AI in a way that's likely to create a high risk to people, you may need a data protection impact assessment. This can come up where you're using new technology, processing sensitive data, profiling people, monitoring staff or making decisions that affect individuals.

A Worked Example

Say Priya runs a UK skincare eCommerce business with 8 staff and a mailing list of 4,000 customers. Her marketing assistant copies 200 customer emails, names and purchase notes into a free AI tool to create personalised email subject lines.

Priya's business now needs to assess what happened. The questions include: was personal data uploaded, did the AI provider keep it, could it be used to train the model, was there an international transfer, and is there a risk to those customers?

If the incident is likely to risk people's rights and freedoms, Priya may need to report it to the ICO within 72 hours of becoming aware of it. If there's a high risk to the customers, she may also need to tell them. A clear AI policy could have stopped the upload in the first place.

Can Employees Use ChatGPT For Customer Work?

Yes, employees can use ChatGPT and similar tools for customer work if your policy sets boundaries and the output is properly reviewed. You should be especially careful where the work will be sent to a client, published online, used in advertising or relied on to make a decision.

A sensible ChatGPT policy for employees might allow staff to use AI to:

• turn rough internal notes into a clearer first draft
• brainstorm blog topics, subject lines or campaign ideas
• summarise non-confidential meeting notes
• create simple checklists for internal use
• rewrite a paragraph in a more professional tone

It might require approval before staff use AI to:

• draft customer-facing advice or technical instructions
• create advertising claims, product descriptions or sales scripts
• respond to complaints or refund requests
• analyse staff performance, recruitment applications or customer behaviour
• translate legal, medical, financial or safety-related information

Your human review rules should be specific. For example, you might say that no AI-generated content can be sent to a customer until a manager checks it for accuracy, tone, confidentiality, bias, copyright risk and compliance with your usual approval process.

If AI helps create product descriptions or service promises, your business is still responsible for what customers read. For consumer sales, the Consumer Rights Act 2015 expects goods and services to match key descriptions and information you provide. AI doesn't give you a pass if the description is wrong.

Who Owns AI-Generated Work And Can You Use It?

It depends on how the work was created, the AI tool's terms, your employment contracts and whether the output is original enough to attract copyright protection. You shouldn't assume that every AI-generated image, slogan, code snippet or article is automatically safe to use.

Under the Copyright, Designs and Patents Act 1988, an employer will often own copyright in work created by an employee in the course of employment, unless there's an agreement saying otherwise. That rule is helpful, but AI adds extra uncertainty.

Your policy should cover:

• Tool terms: Some AI platforms restrict how outputs can be used, especially under free or trial plans.
• Input ownership: Staff should only upload material your business has the right to use.
• Output checks: Staff should check whether the output looks too similar to a competitor's content, stock image, code or branding.
• Brand assets: Staff shouldn't ask AI tools to copy another brand's style, logo, packaging or campaign.
• Contractor work: Contractors and freelancers should have written agreements that deal with AI use and IP ownership.

The UK IPO has continued to look closely at AI and copyright issues, and the law in this area is still developing. For now, your safest approach is to require human contribution, keep records of important AI-assisted work, and get approval before using AI outputs for major brand assets, paid advertising, software, product packaging or customer deliverables.

How Do You Roll Out The Policy And Enforce It?

You should roll out the policy through training, written acknowledgement and consistent management. A policy only helps if your team knows what it says and you can show that the rules were clear.

Start with these steps:

1. Audit Current AI Use: Ask staff what tools they already use, what data they enter and what tasks they use AI for.
2. Choose Approved Tools: Decide which tools are allowed and check privacy, cybersecurity, retention, training and account settings.
3. Update Related Documents: Align your AI policy with your employment contracts, confidentiality agreements, IT policy, privacy policy and data protection policies.
4. Train Your Team: Use real examples from your business, not abstract rules.
5. Get Written Acknowledgement: Ask staff to confirm they have read, understood and will follow the policy.
6. Review It Regularly: AI tools change quickly, so set a review date and update the approved tools list when needed.

Your policy should also explain what happens if something goes wrong. If someone uploads restricted data, your first steps should be to stop further use, preserve records, identify what was uploaded, check the AI provider settings and assess whether you need to notify customers, the ICO or a contractual partner.

For disciplinary action, follow your own procedure and the ACAS Code of Practice on disciplinary and grievance procedures. Be fair and consistent. If dismissal or a serious sanction is on the table, get tailored advice first, especially if the policy was new, unclear or not properly communicated.

Key Takeaways

• An AI use policy gives your staff clear rules for using tools like ChatGPT, Copilot and other generative AI platforms at work.
• Your policy should spell out approved tools, banned data, human review, IP ownership, record keeping and disciplinary consequences.
• Staff shouldn't upload customer data, employee data, confidential information or trade secrets unless your business has approved the use.
• AI-generated work still needs human checking, especially before it goes to customers, appears in advertising or forms part of client work.
• UK GDPR, the Data Protection Act 2018, copyright law, consumer law and employment rules can all affect how your business uses AI.
• A template can help you start, but it should be tailored to your systems, contracts, industry and risk level before you roll it out.

If you'd like help with your AI use policy, staff data rules, confidentiality protections and employment policies, you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.