Guide · Governance, policy and return on investment
AI policy template: what to include and how to write yours
An AI policy template gives you the sections a workplace AI policy needs: approved tools and accounts, what information may go where, how hard to check the output, decisions about people, monitoring, reporting problems and review. Fill it with your own facts, consult your staff, and have a qualified person review it before you adopt it.
By Andrew Ward, Founder of ScorchsoftChecked 16 minute read
In short
- Start with what people already use, not with a ban: a policy that ignores real use can push it out of sight.
- Cover about two dozen sections, but keep each short. Staff also need a one-page team AI rule they can follow on Monday.
- Fix three things whatever else you decide: AI never decides about a person alone, monitoring is never covert, and honest mistakes can be reported without blame.
- UK rules on automated decisions changed on 5 February 2026. Have a qualified person check the draft against the law in force.
- Our policy skeleton, and for UK organisations a guided drafting exercise that runs in your own AI tool, download with no sign-up. Both end with a review notice you keep until a qualified person signs the policy off.
Written for: Owners, managers, HR and data protection leads in UK organisations of about 5 to 250 people that use AI tools at work.
What should an AI policy include?
A useful AI policy says which tools people may use and on which accounts, what information may go into them, how carefully to check what comes out, and who is responsible. It also fixes how AI is used in decisions about people, how any monitoring works, how to report problems, and when the policy is reviewed.
Here is every section in our template, with a short sample clause for each. The clauses are starting points to adapt, not wording to adopt unread. Where a clause says “(default)”, it is a cautious starting position your organisation can change once it has decided.
| Section | What it covers | Sample clause |
|---|---|---|
| 1. Purpose and scope | Who it applies to and where | “This policy applies to everyone who does work for us: employees, workers, contractors, agency staff and volunteers, on work devices and on any personal device used for work.” |
| 2. Plain definitions | One meaning per word | “A personal account is an AI account you set up yourself, free or paid, that the organisation doesn’t control.” |
| 3. Principles | The ideas the rest rests on | “AI touches tasks; people carry outcomes. Whoever uses AI for a piece of work is responsible for the result.” |
| 4. Approved tools and accounts | The approved list and how to ask for more | “A tool nobody has assessed is not approved. While any trust-check question is unanswered, use it for public information only.” (default) |
| 5. Personal accounts and devices | The commonest leak | “Don’t put work information into a personal AI account, free or paid.” (default) |
| 6. What information goes where | Green, amber and red information, including memory and saved instructions | “Client information, personal data and special category data are red until a data protection impact assessment (DPIA) or our data protection lead says otherwise.” (default) |
| 7. Checking in proportion to the stakes | How hard to check the output; sources checked one by one; nothing forwarded unread | “A person reviews anything AI helped produce before it leaves the organisation.” (default) |
| 8. Being open about AI use | Colleagues, clients, meetings, real people’s likenesses, labelling | “Before AI records or summarises a meeting, tell everyone in it. Whoever ran the meeting corrects the recap before it’s sent.” |
| 9. Decisions about people | Recruitment, performance, pay, discipline, care, with real human oversight | “AI never makes, or in effect makes, a decision about a person on its own. A person with the knowledge and authority to overrule it reviews the case properly.” (default) |
| 10. Monitoring | What is collected, why, who sees it | “Monitoring of AI use is never covert. We never use the amount someone uses AI as a target or a measure of performance.” (default) |
| 11. Intellectual property and confidentiality | What goes in and what comes out | “Client and third-party material stays confidential: it is red unless an approved tool is approved for it.” |
| 12. Connectors and MCP servers | Connectors, MCP servers and the lethal trifecta | “Connectors stay off unless approved; connect read-only first, with the least access the task needs. A tool that can read private data, read outside content and send things out needs explicit approval and a guardrail.” (default) |
| 13. Bots and agents that act without a person | Chatbots, agents and scheduled tasks, each with an owner who carries the outcome | “None goes live without approval. Each has a named owner, a written scope, a trust level, a way to stop it at once and a log. People are told when they are dealing with AI and can always reach a person.” (default) |
| 14. Guardrails | Rules that hold whatever the AI is asked | “Rules that must always hold are enforced by permissions and checks built into the tool or the process, not left to instructions. A person approves anything that can’t be undone.” (default) |
| 15. Shared prompts, skills and agents | Who keeps them current | “Every shared prompt, skill or agent has an owner, a version and a review date.” (default) |
| 16. Suppliers, contracts and AI terms | The trust check when buying or renewing software | “When we buy or renew any software, we ask whether it uses AI on our data, read its AI and data terms, and record the answers. We run the trust check again when the supplier changes its terms, its model or where our data is stored.” (default) |
| 17. New ideas for AI | Where ideas go, and a 90-day test before a use spreads | “Before a new use spreads beyond a small test, we run a 90-day test with a baseline, the cost per finished task and a stop rule agreed before it starts.” (default) |
| 18. AI literacy and training | Who is trained, and records | “Everyone who uses an approved AI tool has basic training first, and we keep a record.” (default) |
| 19. Reporting problems without blame | Getting mistakes out early | “Honest mistakes reported promptly are not disciplinary matters. Concerns about wrongdoing can also be raised under our whistleblowing policy.” |
| 20. AI incidents | Our own steps when AI goes wrong | “Stop or pause the tool if you can, tell the reporting contact within one working day, and keep what happened. Our data protection lead decides whether anything must be reported.” (default) |
| 21. Breaches | Fair, proportionate responses | “Nobody is disciplined for using AI before an approved route exists; past use reported during the amnesty is not a disciplinary matter.” (default) |
| 22. Roles | Who does what | “The data protection lead decides data questions, DPIAs and moving information between lanes.” |
| 23. Review and version history | Keeping it current | “This policy is reviewed within 90 days of adoption, then at least every 12 months.” (default) |
| 24. Mapping to frameworks (optional) | ISO/IEC 42001 or the NIST AI Risk Management Framework (AI RMF) | “This table maps our sections to the framework’s clauses. It is a mapping, not a certification.” |
| 25. Items to confirm | The gap list | Every open question, every default taken, and every point for a lawyer, HR or the data protection officer (DPO). |
| 26. Review notice | Honest status until sign-off | A drafting and review notice saying the draft is illustrative, from a training exercise, kept until a qualified person has reviewed the policy and a named owner has approved it. |
Several sections use names from The AI Stairway™ course, each explained in plain words in the policy itself so staff who haven’t taken the course can follow it. Section 6 uses the tramlines: green means go, with nothing private in it; amber means with care or approval; red means don’t (Module 1). Its partner is the three-second check: which account am I in, would I be OK if this were read out, and can this AI act or only answer? Section 7 uses the stakes ladder: the higher the stakes, the harder you check, up to anything about someone’s care, money or rights (Module 2).
Section 12 uses the lethal trifecta: private data, content from outsiders and a way to send things out should never meet in one tool without approval and a guardrail. Section 13 uses the control ladder (read, draft, ask before acting, or never), set by what’s at stake, and the trust scale: a new agent starts on L-plates and earns trust on each task, while anything that can’t be undone keeps a person’s approval (Module 9).
Section 4 uses the trust check, seven questions to ask of any AI service: who runs it, where your data is stored, whether it trains on your data, how long it’s kept, which terms apply, what it can reach and do, and whether your data protection lead would approve this use, for this data. Section 14 uses the layers of control: a prompt asks, a skill shapes, a permission is enforced, and checks built into the process make sure (Module 8). As Module 9 puts it, a prompt can ask; code can make sure.
Do we need a full policy, or is one page enough?
Most organisations benefit from both: a policy that sets the organisation’s rules and who owns them, and a one-page team AI rule that each team agrees and actually reads. The page applies the policy to the team’s own tools, information and meetings.
The one-page team AI rule comes from Module 6 of The AI Stairway™, One Chat, Whole Team, where teams draft theirs during the lesson. It has six headings:
- Approved tools and accounts.
- Green, amber and red uses, agreed as a team.
- What information goes where.
- Who owns shared prompts and skills.
- How to report a problem.
- A review date.
Two lines sit underneath: tell people before AI records a meeting and correct the recap before it’s sent, and AI never decides about a person on its own. A small organisation with no policy yet can start with the one-page rule and grow the policy around it. A larger one usually needs the policy first, so every team’s page follows the same rules.
How do you write an AI policy?
Ask how people use AI now before you write any rules, then gather the facts, draft from a template with cautious defaults, consult your staff, and have a qualified person review it before a named owner approves it. Treat the first version as a draft numbered 0.1, not the finished policy.
Step 1: Frame it
Agree what the policy is for and who will review it. Work with categories of information, never named staff or confidential records.
Step 2: Set the scope
Sector, size, which UK nations, any EU staff, customers or output, your regulator, and any union or consultation agreement.
Step 3: Find out what happens now
Ask which tools people already use and on which accounts. If nobody knows, run an anonymous, no-blame questionnaire first: shadow AI usually means people found something useful and nobody said what was allowed.
Step 4: Gather the facts
Existing policies to link to, approved tools, kinds of information, decisions about people, monitoring, owners and how cautious you want to be.
Step 5: Confirm a facts sheet
Write down what you know and mark every gap “to confirm”. Never fill a gap with a guess.
Step 6: Draft
Draft the team rule, the full policy or both from a template, labelling every default as a default.
Step 7: Consult
Share a plain summary, ask staff what’s unclear, what would stop them following it and what’s missing, and keep a “what we changed” log. Larger organisations add a briefing and any union steps.
Step 8: Check for a DPIA
Where personal data may go into AI tools, or staff use is monitored, ask your data protection lead whether a data protection impact assessment is needed.
Step 9: Self-check
List every open item, every default taken and every point for a lawyer, HR or your DPO.
Step 10: Review and sign off
A suitably qualified person reviews it, with legal advice where decisions about people, monitoring or regulated data are in scope. A named owner approves it.
Step 11: Version and review
Drafts are 0.x; version 1.0 comes after sign-off. Review within 90 days, then at least every 12 months, recording who was consulted.
Gareth manages a 40-person accountancy practice. The anonymous questionnaire shows client chasers being drafted in personal AI accounts. Hayley comes forward during the amnesty, and the draft moves her chasers onto the practice’s business account, with client figures red until the data protection lead decides. Staff comments add a line on meeting recaps, logged in “what we changed”. Version 0.3 goes to an employment solicitor for review.
Can AI help you draft an AI policy?
Yes, if the assistant asks before it drafts, marks every gap instead of guessing, and keeps a review notice on the result. The draft is still your organisation’s own: a qualified person reviews it before you adopt it.
An AI skill is a written procedure an AI assistant follows when the task comes up. Ours is a guided drafting exercise from The AI Stairway™ course, for UK organisations: an extended version of Module 6’s exercise, where learners draft their team’s AI rules from the course template. It runs in your own AI tool, so Scorchsoft never sees your answers or reviews what it drafts. It asks short rounds of questions, shows a facts sheet to confirm, then drafts with defaults marked and gaps listed, and ends every draft with a review notice. Its checker is a backstop, not a review: it can’t catch an invented fact or a person’s name, so the qualified reviewer checks those. Use it on an approved account, and keep confidential information out of it: it asks for categories, not records.
Free download, no sign-up · UK organisations
The AI policy skill
A guided drafting exercise from The AI Stairway™ course, an extended version of Module 6’s exercise where learners draft their team’s AI rules from the course template. It runs in your own AI tool: Scorchsoft never sees your answers or reviews what it drafts.
- It asks you short rounds of questions, then shows you a facts sheet to confirm before it drafts anything.
- It drafts your organisation’s own starting policy or one-page team AI rule, marking every default and every gap instead of guessing.
- Every draft ends with a notice that a suitably qualified person must review it before you adopt it.
ZIP, 268 KB · version 0.9.0 · UK law pointers checked on 29 October 2026
Install it (as of 29 October 2026)
- Claude on claude.ai: turn on code execution (“Create and edit files”) in Settings, Capabilities. Then open Customize, Skills, choose +, Create skill, Upload a skill, and pick the ZIP. On Team and Enterprise plans an owner may need to turn skills on first.
- Claude Code: unzip it into
~/.claude/skills/, or into a project’s.claude/skills/folder. - Other AI assistants (for example ChatGPT, Copilot or Gemini): paste
plain/INSTRUCTIONS.mdinto a project’s instructions and attach thetemplatesandreferencesfiles.
Menus change. If these steps don’t match what you see, check your assistant’s help pages.
What’s in the ZIP
SKILL.md: the steps your assistant followsTERMS.md: the terms you accept by downloadingreferences/andtemplates/: the questions, the policy sections, dated UK law pointers, and the templatesscripts/check_policy.py: a backstop check that the notice comes last and unaltered, and that every gap is listed. It can’t catch an invented fact or a person’s name, so the qualified reviewer checks thoseplain/: the instructions for other assistantsassets/: a card about the course, which the assistant shares once after the first draft
Prefer to write it yourself?
The policy skeleton has the same headings, sample wording and placeholders, with guidance notes for filling it in by hand, and ends with a review notice to keep until a qualified person has signed the policy off. It isn’t a policy ready to adopt. Download it:
Free to use and adapt within your own organisation. Not legal, HR or data protection advice: have every draft reviewed by a suitably qualified person before you adopt it.
What UK law does an AI policy need to reflect?
The UK has no AI Act and no general legal duty to have an AI policy. The rules come from existing law: data protection, equality and employment law, plus sector regulators. The rules on automated decisions about people changed in 2026, so check any draft against the law in force on the day. We aren’t solicitors: this is what we’d consider in our own policy.
We aren’t solicitors
Scorchsoft isn’t a law firm, and this section isn’t legal advice. It lists the points we know of and would consider in our own AI policy. We may have missed things that apply to you, especially in a regulated sector, so have a solicitor or other suitably qualified person check your draft against the law in force on the day.
Most organisations that use AI benefit from a policy, and some are told to consider one: the Department of Health and Social Care’s guidance for adult social care providers (29 September 2026) says all organisations should consider having an AI policy. As of 29 October 2026, these are the points we would check in our own policy. It’s a starting list, not a full statement of the law.
| Topic | Where it comes from | What it means for the policy |
|---|---|---|
| Automated decisions about people | Data (Use and Access) Act 2025, section 80 (opens in a new tab), which replaced UK GDPR Article 22 with Articles 22A to 22D from 5 February 2026 (SI 2026/82 (opens in a new tab)) | Where a significant decision is based solely on automated processing, safeguards apply (opens in a new tab), including a way to contest it and a review by a person. Section 9 keeps a person in every decision about people. |
| Complaints about personal data | Section 103 of the same Act, in force from 19 June 2026 (section 103 (opens in a new tab)) | Controllers must make complaints easy and acknowledge them within 30 days. Link the reporting route to your complaints process. |
| The regulator’s view on automated decisions | The Information Commissioner’s Office (ICO) automated decision-making guidance (opens in a new tab), still a draft (updated 31 March 2026; consultation closed 29 May 2026) | Useful on what counts as meaningful human involvement. Label it draft, and check whether the final version has been published. |
| Monitoring staff | The ICO’s monitoring workers guidance (opens in a new tab) (3 October 2023; the ICO says it is under review) | Tell people what is monitored and why, use the least intrusive means, and consider a DPIA. Section 10 rules out covert monitoring. |
| High-risk processing | UK GDPR Article 35 and the ICO’s page When do we need to do a DPIA? (opens in a new tab) | The ICO lists innovative technology, including AI, as a sign of high risk. Your data protection lead decides whether a DPIA is needed. |
| Fairness in decisions | Equality Act 2010 (opens in a new tab) | Check AI-assisted decisions for unfair effects, and make reasonable adjustments for disabled staff, which may include AI tools. |
| EU exposure | Article 4 of the EU AI Act, on AI literacy, as explained in the European Commission’s Q&A (opens in a new tab) (updated 20 October 2026) | It may apply to a UK organisation whose AI systems are used in the EU or affect people there. Ask your reviewer; don’t assume either way. Our AI literacy guide covers it. |
Don’t call the policy compliant
A policy can support your obligations; it can’t make any use of AI lawful by itself. Write “this policy is intended to support our obligations under UK data protection law”, never “this policy is compliant with UK GDPR”.
Frameworks such as ISO/IEC 42001 (a certifiable management-system standard) and the NIST AI Risk Management Framework (voluntary) are worth borrowing from, but they aren’t law. Our AI governance guide explains where they fit. This page covers UK practice. Northern Ireland, Scotland and Wales can differ on employment and sector rules, and regulated sectors such as health, social care, finance and law have their own.
Do we need to consult staff on an AI policy?
Staff input makes the policy work, so every route should include it, however small the organisation. Whether formal consultation is legally required depends on your contracts, any union or consultation agreement, and what the policy changes, which is a question for your reviewer.
Acas’s guidance on what to consult on (opens in a new tab) (updated 10 August 2026) is a good place to start, and the Information and Consultation of Employees Regulations 2004 may apply to larger organisations. Ask your reviewer which applies to you. A light route suits most small teams:
A light consultation route
- An anonymous “what do you use?” questionnaire, if nobody knows which tools people use.
- A one-page “what this means for you” summary of the draft.
- Three questions for staff: what’s unclear, what would stop you following it, and what have we missed?
- A comment window of about two weeks.
- A “what we changed” log, shared when the policy is adopted, with the consultees recorded in the version table.
What can we do this week?
You can make three moves this week without a budget: find out what people already use, agree a starting rule for information, and choose who owns the policy and who will review it. The draft can follow once you have those answers.
Step 1: Ask what people use (owner: the manager or HR lead)
Send the anonymous, no-blame questionnaire: which AI tools, which accounts, for what, and what has gone wrong. Say plainly that nobody is in trouble for past use.
Step 2: Set a starting rule for information (owner: the data protection lead)
Until the policy is agreed, client information, personal data and special category data stay out of AI tools that haven’t passed the trust check. Tell people the rule and why.
Step 3: Name an owner and a reviewer (owner: the director or partner responsible)
Pick who owns the policy and who will review it, such as an employment or data protection solicitor, your DPO or an HR adviser. Then download the skeleton and start the draft.
Every team then drafts its one-page rule, and Module 6 walks a team through that, including the trust check and a meeting recorded by AI.
Questions people ask
Is it a legal requirement to have an AI policy in the UK?
We found no general UK law that requires one, as of 29 October 2026. Most organisations that use AI benefit from one, because it gives staff clear rules and an approved way to use the tools, and some sector guidance asks providers to consider one: the Department of Health and Social Care says all adult social care organisations should consider having an AI policy.
Can we just ban AI at work?
You can, but a ban with no approved option risks pushing use out of sight rather than stopping it. Most organisations do better with approved tools on work accounts, clear rules about information, and an amnesty for past use, then tighten where the risks are real.
Can we use an AI policy template from the internet as it is?
Use one as a starting point, not as your policy. A template can’t know your tools, information, sector or agreements with staff. Fill it with your own facts, mark every gap, consult your staff, and have a suitably qualified person review it before you adopt it.
Does an AI policy replace our data protection or IT policies?
No. It should link to them rather than repeat them: data protection, information security, IT acceptable use, monitoring, disciplinary and whistleblowing policies all stay in force. The AI policy says how they apply when people use AI tools.
How often should we review our AI policy?
Review a first policy within about 90 days, because you will learn quickly how it works in practice, then at least every 12 months. Review it sooner if the law, a regulator’s guidance or your tools change.
Why does the skeleton end with a review notice?
Because a draft, whether written by hand or with an AI tool, is an illustrative starting point that nobody qualified has checked yet. The notice says so and carries sign-off fields. Once a qualified reviewer has signed the policy off, you can replace it with a short line recording who reviewed and approved it.
Start your AI policy
For UK organisations: a guided drafting exercise from the course that runs in your own AI tool, or a skeleton to fill in by hand. Either way, a qualified person reviews the result before you adopt it.
Get the skill or the skeletonSources
Every figure on this page comes from one of these. Links open in a new tab.
- The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82) (opens in a new tab). legislation.gov.uk, made 29 January 2026.
- Data (Use and Access) Act 2025, section 80: automated decision-making (opens in a new tab). legislation.gov.uk, read 29 October 2026.
- UK GDPR Article 22C: safeguards for automated decision-making (opens in a new tab). legislation.gov.uk, read 29 October 2026.
- Data (Use and Access) Act 2025, section 103: complaints by data subjects (opens in a new tab). legislation.gov.uk, read 29 October 2026.
- Automated decision-making, including profiling (draft guidance) (opens in a new tab). Information Commissioner’s Office, draft updated 31 March 2026.
- Employment practices and data protection: monitoring workers (opens in a new tab). Information Commissioner’s Office, 3 October 2023.
- When do we need to do a DPIA? (opens in a new tab) Information Commissioner’s Office, read 29 October 2026.
- Equality Act 2010 (opens in a new tab). legislation.gov.uk, read 29 October 2026.
- Using AI in adult social care (opens in a new tab). Department of Health and Social Care, 29 September 2026.
- AI literacy: questions and answers (opens in a new tab). European Commission, updated 20 October 2026.
- What to consult on: consulting employees and representatives (opens in a new tab). Acas, updated 10 August 2026.
- ISO/IEC 42001:2023, Information technology: Artificial intelligence: Management system (opens in a new tab). ISO, December 2023.
- AI Risk Management Framework (opens in a new tab). NIST, AI RMF 1.0, January 2023.
- Using Skills in Claude (opens in a new tab). Anthropic (Claude Help Center), read 29 October 2026.