In this guide
An AI policy template is a starting point for telling staff how artificial intelligence may be used at work. It should turn broad principles into decisions people can follow during an ordinary working day.
The best policy is specific to the business. Replace every placeholder with real products, information types, owners and approval routes. Have appropriate legal, data-protection or sector specialists review it where the use requires that expertise.
1. Purpose and scope
Template wording: This policy sets the rules for selecting and using AI systems for company work. It applies to employees, contractors and other authorised users, including AI features inside existing software.
State which companies, teams and devices are covered. Make clear that the policy applies whether a tool is free, paid, built in or bought separately.
2. Approved tools and accounts
Template wording: Staff may use only the AI products and work accounts listed in the approved-tools register. New products and connected data sources require approval from [role].
Keep the register outside the policy so it can be updated without rewriting the whole document. Include the product, owner, approved purpose, permitted information and review date.
3. Information that may not be entered
Template wording: Do not enter personal, confidential, commercially sensitive, security-related or client information unless the product and use have been specifically approved for that information.
Replace the categories with examples from your business. Staff need to recognise the rule when they see a payroll file, customer case, contract, password, health record or unpublished proposal.
Where personal data is involved, use the ICO guidance on AI and data protection to assess lawfulness, fairness, transparency, minimisation, accuracy and security.
4. Human review
Template wording: AI output is a draft unless an approved process states otherwise. The person using the output is responsible for checking accuracy, completeness, tone, source support, confidentiality and suitability before it is used.
Name work that always requires qualified review. Examples may include customer commitments, contracts, financial information, recruitment decisions, clinical material, safety guidance and regulated advice.
5. Prohibited uses
Template wording: Staff must not use AI to impersonate a person, bypass security, conceal a required disclosure, make an unapproved decision about an individual, create deceptive evidence or perform work they are not authorised or qualified to approve.
Add sector-specific restrictions. Keep the list short enough to remember and support it with examples during training.
6. Accuracy, sources and records
Template wording: Important claims must be checked against reliable source material. Where an AI-supported output affects a material decision, retain the inputs, sources, reviewer and final decision in the appropriate company system.
A fluent answer is not proof. The policy should explain what evidence must be retained without encouraging unnecessary storage of prompts or personal information.
7. Transparency
Template wording: Tell customers, staff or other affected people about AI use where required by law, contract, professional duty or company policy. Do not imply that an automated output was independently prepared by a named person when it was not.
The right disclosure depends on the use and audience. Avoid one generic statement for every situation.
8. Security and connected tools
Template wording: Do not connect an AI product to company email, files, calendars, customer records or other systems without approval. Access must be limited to what the approved use requires.
Include account security, sharing, access removal and supplier-change checks. The NCSC secure AI guidance is a useful reference for deployment and operation.
9. Reporting concerns
Template wording: Report an unintended disclosure, unsafe output, unexpected system behaviour or policy breach immediately to [contact]. Do not hide or continue a use that may cause harm.
Give staff one clear route and explain what happens next. A useful reporting process supports early action rather than blame.
10. Ownership, training and review
Template wording: [role] owns this policy. Managers are responsible for approved use in their teams. Users must complete required training. The policy and approved-tools register will be reviewed on [schedule] and when material changes occur.
Connect the policy to the wider AI governance framework. The government's AI Management Essentials guidance can help the business check its internal processes, risk management and communication.
How to roll the policy out
- Inventory current use before announcing new rules.
- Resolve obvious gaps in approved tools and accounts.
- Review the wording with workflow, security and data owners.
- Train staff with examples from their work.
- Provide a simple approval and incident route.
- Sample real use and improve unclear rules.
Blue Canvas helps businesses turn a template into practical policy and training. Book a free 15-minute call to discuss your rollout.
If this is the kind of work you want help with, read about our AI consultancy service.
Phil runs Blue Canvas AI, a Derry-based consultancy helping UK and Irish SMEs scope, train for, and implement practical AI workflows.
FAQ
Frequently asked questions
What should a company AI policy include?
It should cover scope, approved tools, information rules, human review, prohibited uses, records, transparency, security, incident reporting, ownership and training.
Can a business use this AI policy template unchanged?
No. Replace the placeholders with real tools, information types, owners and approval routes, then obtain specialist review where the context requires it.
Who should own an AI policy?
A named senior owner should be accountable, with managers responsible for approved use in their workflows and appropriate input from security, data protection and HR.
Should AI output always be reviewed?
The policy should define proportionate review. Important, external, sensitive or regulated work normally needs a suitably qualified person to check and approve it.