An AI acceptable-use policy a UK business can adopt this week.

Staff are already using AI at work. CIPD’s 2025 research found that a majority of UK organisations allowed generative AI for work tasks while fewer than a third had developed a formal policy in the previous year, and fewer still had provided training. The ICO expects organisations of any size that process personal data through AI tools to be able to show how they govern that use, and the practical evidence is a written policy staff have read. A policy nobody reads provides no evidence at all, which is why this one is a page.

Two principles run through it. The policy names tools and plans, because the data position differs between a personal ChatGPT or Claude account and a Business or Team workspace, and a policy that says “use AI responsibly” without saying which AI is not a policy. And every rule has an example, because “do not paste confidential information” is ignored and “do not paste a client’s bank details, a candidate’s CV or an unsigned contract” is followed.

Replace the bracketed items. Everything else can stand.

Clause 1 exists because the data position turns on the plan. ChatGPT Business, Claude Team and Enterprise workspaces are not used for training and are covered by a data processing addendum; the consumer plans on both sides use conversations for training unless each person changes a setting. A policy that permits “ChatGPT” without saying which is permitting both.

Clauses 2 and 3 do the work most policies skip: they give examples. The list of what may not go in is drawn from the incidents firms actually have, which are almost never about state secrets and almost always about a CV, an invoice or a contract pasted in for a quick summary.

Clause 4 is the ICO’s accuracy principle and the employment-law point CIPD makes about automated decisions in one sentence: a human is accountable for the output, and a human decides anything that affects an individual. It also protects the firm commercially; the fee earner who signs the advice owns it.

Clause 5 is UK GDPR in the form staff can follow: minimisation, the right plan, special-category data gated behind a lawful basis and a DPIA, and deletion. The DPIA point matters more than it looks. The ICO’s screening criteria catch profiling and special-category data at scale, and a firm that has a policy but no DPIA for its candidate-screening or patient-triage use is exposed on exactly the process most likely to be complained about.

Clause 6 covers professional obligations, which vary by sector: the SRA, FCA, ICAEW and NHS each have positions on AI use and client transparency, and the engagement letter is where the firm’s own promise is recorded.

Clause 7 is the monitoring rule. Employees must be told what is monitored and why before it happens, and monitoring must be necessary and proportionate. Saying that conversations are not read routinely, and only reviewed for stated reasons, is both the lawful position and the one that keeps staff using the sanctioned tool instead of a personal one.

Clause 8 makes the policy enforceable and keeps it alive. CIPD recommends updating employment contracts and pairing the policy with training; the six-month review is what stops the policy naming a plan that no longer exists.

A policy on its own changes little. Four things make it work. Put the firm on business plans and cancel the expensed personal accounts the same week, so clause 1 is true. Build two or three shared projects or custom GPTs on the firm’s own templates, so the sanctioned tool is the easier one to use. Run a ninety-minute session per team on the two tasks that team does most, and walk through clauses 2 to 5 with real examples from that team’s work. And add Anthropic or OpenAI to the record of processing activities with the DPA reference, so the policy and the paperwork agree.

Sector add-ons are short. A law firm adds a line on privilege and the SRA’s expectations; an accountancy practice adds the ICAEW position and HMRC data; a clinic adds the NHS and CQC position on patient data and a blanket ban on identifiable patient information outside an approved system; a recruitment agency adds a rule that AI screening output is advisory and a recruiter decides.