AI policy starter

Your starting draft (a starting draft, not legal advice)

[Organisation name]: how we use AI tools at work
DRAFT for discussion. Prepared with the AI Tools Academy policy starter on [date].
This is a starting draft, not legal advice. Before adopting it, check it against your data protection obligations, contracts and any sector rules, and involve your data protection lead or adviser.

1. Why we have these rules
AI tools can save time on drafting, summarising and research. They can also get things wrong and expose information we are responsible for. These rules say which tools we use, what we can put into them, and how we check what comes out.

2. Approved tools
No AI tools are approved for work use yet. Until the list below is agreed, do not put any work information into AI tools.
- [Add approved tools here]
Anything not on this list needs approval from [named person or role] before it is used with work information.

3. What can go into an AI tool
Always fine:
- Public information
Only in approved tools:
- Internal business information
Never:
- Passwords, access codes, bank or card details
- Customer or client information
- Personal data about staff, customers or the public
If you are not sure which group something is in, treat it as 'Never' and ask [named person or role].

4. Checking what AI produces
A person reads and checks everything AI produces before it is used, sent or published. You are responsible for it as if you wrote it.
Check facts, figures, names, dates and quotes against the source. AI tools can state wrong information confidently.

5. Things we do not use AI for
- Making final decisions about people (hiring, discipline, grading, eligibility)
- Uploading documents marked confidential or restricted

6. Being open about AI use
Tell colleagues when a document was substantially drafted with AI. If a customer or member of the public could reasonably expect to know, tell them too.

7. Mistakes and questions
If you think information went into an AI tool that shouldn't have, tell [named person or role] straight away, without waiting to be sure. Reporting quickly matters more than blame.

8. Keeping this current
[named person or role] owns these rules and reviews them at least every twelve months, or sooner when our tools or their terms change.

Built in your browser. Nothing you type here is saved or sent.