What is an AI policy?
An AI policy (also called an AI usage policy or AI acceptable use policy) is a short written set of rules for how your business uses AI tools. It covers which tools are approved, what data can go into them, how output gets checked, and what happens when someone makes a mistake.
No policy is still a decision
If you have not written anything down, your staff are making the rules up as they go. The Microsoft and LinkedIn 2024 Work Trend Index found 75% of knowledge workers use generative AI at work, and 78% of them bring their own tools. That is shadow AI: well-meant, invisible to you, and running outside your Microsoft 365 security, backups and logging.
Under UK GDPR you need to show “appropriate technical and organisational measures” to protect personal data. If a client list ends up in a free chatbot, “we were going to sort a policy” will not help much. A written policy is the simplest evidence that you considered the risk.
The five things every AI policy must cover
Approved tools.
List what is allowed, what is allowed with conditions, and what is blocked. Use business accounts with single sign-on and multi-factor authentication, never personal logins.
What data can go in.
Split data into public, internal and confidential. Customer details, bank details, payroll, health information and HR records never go into free or personal AI tools.
Checking the output.
AI gives you a first draft, not a finished one. Someone checks facts and judgement before anything reaches a client, a contract or an HR letter.
Reporting mistakes.
Tell staff exactly who to tell and how fast. Personal data breaches that carry a risk must be reported to the ICO within 72 hours of you becoming aware, so early reporting matters.
Ownership and review.
Name a senior owner, usually the MD, with IT handling the technical side. Review it every six months; AI tools change faster than most policies.
Write it so people actually follow it
Keep it to three to five pages in plain English, with a one-page summary at the front. Use headings that match the questions staff ask: what can I use, what can I share, what if I get it wrong? Then give real examples.
Do
Use Copilot with your work account to summarise a Teams meeting
Use Copilot in Word to draft an internal update
Check every figure before it goes to a client
Do
Upload a customer database to a free AI website
Paste disciplinary notes into a personal ChatGPT account
Copy AI output straight into a contract
Build it into onboarding for new starters and cover it in annual refresher training.
Copilot vs public AI tools
Microsoft 365 Copilot works inside your tenant, using data from Outlook, Teams, SharePoint and OneDrive under your existing Microsoft data protection terms. Free and personal AI accounts sit outside all of that.
Microsoft 365 Copilot | Free or personal AI accounts | |
|---|---|---|
Where it runs | Inside your Microsoft 365 tenant | On the provider’s service, often outside the UK |
Used to train models | No | Often, unless the user opts out |
Who can see activity | Logged and auditable by your IT | Nobody at your business |
Sign-in | Work account with SSO and MFA | Personal email and password |
Contract | Your Microsoft data processing terms | The user’s own consumer terms |
One catch: Copilot respects your existing permissions, so it can surface anything a user can already reach. If your SharePoint is overshared, Copilot will find it. Business plans of ChatGPT, Claude and Gemini are a different conversation too; with the right settings they can be approved tools.
The GDPR angle
Putting personal data into a public AI tool can count as an unauthorised disclosure under UK GDPR. Prompts may be stored, used for training, and processed outside the UK, which raises international transfer questions as well.
The usual examples are mundane. HR pastes a disciplinary letter into ChatGPT. Finance uploads an invoice spreadsheet to a free tool. A manager asks a chatbot to tidy up performance notes that mention someone’s health. You may be heading for a problem if:
staff use public AI tools with work data and there is no written policy
you do not know where the tool stores data or what its terms say
nobody has done a data protection impact assessment for AI use
there is no data classification, logging or risk assessment in place
Most of the businesses we talk to are not worried about AI. They are worried they do not know what their team is already doing with it. A two-page policy and an hour of conversation usually fixes that.
Get the free AI policy template
An editable Word template written for UK small and medium businesses. Allow 30 to 45 minutes to tailor it. You will need to decide three things: which AI tools you actually approve, who owns the policy, and whether the Microsoft 365 sensitivity labels section applies to you.
Inside the template:
- Purpose and scope
- Approved, conditional and blocked AI tools
- Data that never goes into AI tools
- Checking AI output before it reaches a client
- Telling clients, tenders and insurers how you use AI
- Microsoft 365 sensitivity labels and Copilot
- Reporting mistakes and the 72-hour clock
- Ownership, breaches and review dates
How we help
A policy on paper is a good start. Our AI Security Pack makes it stick, with three parts that work together for businesses across Bristol and the South West.
Policy.
We tailor the template to your business and check it lines up with your acceptable use, information security and data protection policies, so nothing contradicts.
Training.
Through Let’s Copilot, your team learns how AI works, what good use looks like, and where human judgement still has to come in.
Enforcement.
Data classification, sensitivity labels, data loss prevention, audit trails and blocking of AI tools you have not approved. The rules apply in practice, not just on paper.
Commonly asked questions about AI Policies for Co-Pilot
Why does my business need an AI policy?
Your staff are probably using AI already. A written policy gives them clear rules, cuts the risk of a data breach, and shows the ICO you took reasonable steps if something goes wrong.
What should an AI policy include?
Approved tools, rules on what data can go in, how output is checked, how mistakes are reported, and who owns the policy. Keep it short and make sure it fits your existing IT and data protection policies.
What is shadow AI?
Staff using AI tools that IT has not approved and cannot see. The risks are uncontrolled data sharing and no audit trail. A policy plus web filtering that blocks unapproved tools deals with most of it.
How is a Copilot policy different from a general AI policy?
A general AI policy sets the rules for every AI tool. A Copilot policy adds detail on using it in Word, Excel, Outlook and Teams, and on tidying up permissions before you switch it on.
Is using ChatGPT at work a GDPR risk?
Not automatically. It becomes one when staff paste personal or confidential data into a personal account. Ban that in your policy, and give people an approved business tool to use instead.
Do charities need an AI policy?
Yes, arguably more so. Charities often hold sensitive data about beneficiaries and donors, and volunteers may use personal devices. The template works for charities as written; just adjust the ownership section to name your trustees or CEO.
Next steps: talk it through with Adam
Your team is already using AI. The question is whether they are doing it safely. Download the template and spend 30 to 45 minutes on it with your leadership team, or book a free 30-minute AI review with Adam and we will go through it with you.
Reassuring Availability
There is nothing more annoying than an IT glitch that stops you working efficiently. However, knowing you have access to immediate attention to the glitch and a solution to it, is very reassuring and that is provided by We Do Your IT. We have so appreciated the availability and response given by the team at We Do Your IT, enabling us to remain a productive firm.
Richard Sharp – Sharp Family Law