An AI policy for employees
What a workable AI use policy covers, written for organisations whose staff already use public AI tools.
Last updated 30 October 2026
The short answer
An AI policy tells staff which AI tools they may use, for what, and with which data. A good one is short, names the approved tools, sets clear data rules and says who to ask.
A policy on its own rarely stops confidential data reaching public AI tools. Staff use them because they are useful, so the policy works best alongside an approved alternative that is good enough to use instead.
What the policy should cover
- Scope. Who it applies to, and which tools count, including AI features built into software you already use.
- Approved tools and accounts. Which tools are allowed, and that work happens in accounts your organisation controls, not personal ones.
- Data rules. What must never go into a public tool, such as client confidential material, personal data, special category data and privileged advice, ideally tied to the classification staff already know.
- Checking the output. A person is responsible for anything AI helped to write, and checks facts, figures and references before it is used.
- Being open about it. When colleagues, clients or customers should be told that AI was used.
- Reporting mistakes. How to report pasting something that should not have gone in, without fear, so it can be dealt with quickly.
- Ownership. Who owns the policy, and that it is reviewed when tools or rules change.
What UK GDPR and regulators expect
For most UK organisations, the duties that matter come from data protection law and from sector regulators. The ICO guidance on AI expects a lawful basis for processing personal data, a data protection impact assessment where the processing is likely to be high risk, and a clear view of who is controller and who is processor.
- Legal. The Solicitors Regulation Authority has warned about confidential client information being entered into AI tools without proper safeguards.
- Financial services. The FCA has said its existing rules apply to the use of AI.
A policy is how you show staff what those duties mean in practice. Our guide, is ChatGPT safe for confidential data, covers the data protection side in more detail.
Why a policy alone is not enough
A policy cannot see what someone pastes into a browser. If the approved route is slow or poor, the useful tool wins, and banning public tools outright usually moves the use to personal phones, where nobody can see it at all.
That is why the policy should come with three other things: an approved tool for the work that matters, a simple way to ask whether something is allowed, and a look at what staff actually use AI for, because that shows where AI is worth investing in.
Giving staff an approved alternative
Match the tool to the data, not to the headline:
Low risk work
A business tier of a public AI tool, under a proper contract, for material that is already public or not sensitive.
Everyday Microsoft 365 work
Microsoft 365 Copilot, if you have it, answers from what each person can already open. See whether Copilot is enough.
Confidential documents
A private AI platform in your own cloud or data centre, for client files, research and regulated records.
Where to start
- Find out which AI tools staff use now, and for what. An anonymous survey gets more honest answers.
- Agree which kinds of data may go where, using the classification you already have.
- Write the policy short enough to read in a few minutes, with examples.
- Choose the approved tools, and make them easy to reach.
- Review the policy when tools, contracts or regulator guidance change.
An AI readiness assessment covers the data and use case work behind steps one and two.
Start with an assessment.
An assessment shows which of your data is safe to use with which tools, so your policy rests on facts.
Thank you. Your request is on its way. We will reply from info@tlgsolutions.co.uk to arrange a first discussion.
That did not send. Please email info@tlgsolutions.co.uk instead, and we will reply from there.