Writing an employee AI policy that people follow
By the Day Seven team · Updated 14 October 2026
An employee AI policy should state which AI tools are approved, what data must never be entered, when a person has to check or sign off AI output, when to tell others AI was used, who is accountable, and how to raise a concern. Keep it short enough to read in five minutes, and back it with training on real tasks — a policy nobody understands does not reduce risk.
Summary
- Approved tools, banned data, human review and accountability are the core.
- Distinguish consumer accounts from business or enterprise tools.
- UK GDPR still applies to personal data used with AI.
- Set a regular review date — we suggest around every six months as a planning guide, not a legal requirement — because tools change quickly.
What the policy should contain
As a suggested starting point (not a legal requirement), many organisations keep the core policy to a page or two, adding depth for higher-risk teams. Most cover the same core areas.
| Section | What it says | Example wording |
|---|---|---|
| Approved tools | Which tools and account types may be used | Use only the company Copilot or ChatGPT business workspace. |
| Data rules | What may never be entered | Never enter client names, personal data or unpublished financials. |
| Human review | When output must be checked or signed off | A person checks every AI-assisted document before it is sent. |
| Transparency | When to disclose AI use | Tell the reviewer when a draft was AI-assisted. |
| Accountability | Who owns the output and the policy | You remain responsible for anything you send. |
| Reporting | How to raise a mistake or concern | Report incidents to the data protection lead. |
Data protection and confidentiality
If AI is used with personal data, UK GDPR applies as it does to any other processing. The ICO's guidance on AI and data protection explains the principles, and a data protection impact assessment is expected where processing is likely to be high risk.
Check the vendor's business terms: enterprise and business tiers from the main providers state how customer data is handled, which often differs from consumer accounts.
Human review and accountability
AI tools can produce confident, wrong answers. The policy should make clear that the person using the tool owns the result, and should define higher-risk uses — legal, HR, financial or customer-facing decisions — where review is mandatory.
If you operate in the EU
The EU AI Act applies to organisations placing AI systems on the EU market or using them in the EU, and includes an obligation on providers and deployers to take measures to ensure sufficient AI literacy among staff. Being based in the UK does not by itself take an organisation outside its scope: under Article 2(1)(c) it can also apply to providers and deployers established outside the EU where the output produced by the AI system is used in the EU. Whether it applies to you depends on your specific circumstances, so take legal advice on your position.
Rolling the policy out
Publish the policy alongside training that applies it to real tasks, name a contact for questions, and review it regularly. Organisations seeking a formal, auditable approach can build towards ISO/IEC 42001.
- Short briefing for all staff on the core rules.
- Role-specific sessions for higher-risk teams such as HR, legal and finance.
- A leadership session on oversight and accountability.
- A scheduled review date.
Frequently asked questions
Sources
Related
Want help applying this to your organisation?
Training is delivered on-site at your premises or live online, scoped after a short conversation. Individuals can join the in-person Leeds AI Fundamentals Workshop.