An AI policy is a short internal document that sets out which AI tools your staff may use, for which tasks, with what data, and who checks the results. The policy is how you show you are meeting obligations that already apply, chiefly UK GDPR. The regulator, now the Information Commission (it replaced the Information Commissioner's Office, the ICO, on 30 September 2026), says in its AI guidance that in the vast majority of cases, using AI will involve processing likely to result in a high risk to individuals, which triggers a data protection impact assessment (DPIA). Since 5 February 2026, new UK GDPR rules on automated decision-making have also been fully in force. Below is a template structure you can adapt, followed by a checklist for approving new tools.
Why a written policy matters now
- Accountability sits with the organisation. The ICO's guidance on AI and data protection states that these issues cannot be delegated to data scientists or engineering teams. Senior management is accountable, and overall accountability lies with the controller, which is your organisation;
- DPIAs are the default. Article 35 of UK GDPR requires a DPIA before processing that is likely to result in a high risk, "in particular using new technologies". Where you decide a particular AI use is not high risk, the regulator expects you to document how you reached that view;
- Automated decisions have new safeguards. The Data (Use and Access) Act 2025 replaced Article 22 of UK GDPR with Articles 22A to 22D, in force in full from 5 February 2026. Where a significant decision about a person is based solely on automated processing, meaning there is no meaningful human involvement, you must tell them about it, let them make representations, let them obtain human intervention and let them contest the decision. Stricter limits apply where special category data is used;
- Security expectations are written down. The government's AI Cyber Security Code of Practice (January 2025) is voluntary. Its 13 principles, from raising staff awareness to secure disposal of data and models, are a ready-made benchmark for your controls.
Note that the ICO says its AI guidance is under review following the Data (Use and Access) Act, so parts of it still refer to the old Article 22.
AI policy template: the sections to include
- Purpose and scope. Which staff, contractors and systems the policy covers. Include AI features built into existing software, such as email, accounting or CRM tools, not just standalone chatbots;
- Roles. A named owner for the policy, who approves new tools, and how this links to your data protection lead or DPO;
- Approved tools register. A list of tools approved for use, the version or licence tier (consumer or business), and the uses each is approved for;
- Data rules. What may never be entered into an AI tool (for example client personal data, special category data, payroll records or confidential financial information) and what may be entered into approved business-tier tools only;
- Permitted and prohibited uses. Such as drafting, summarising and coding with review, compared with final advice to clients, decisions about individuals or anything presented as verified fact without checking;
- Human review. Who must check AI output before it is relied on or sent out, and what "checked" means in practice;
- Automated decisions. Whether any process makes significant decisions about people without meaningful human involvement. If so, describe the Article 22C safeguards in place;
- DPIA trigger. A rule that any new AI use involving personal data needs a DPIA screening before launch, with the outcome recorded;
- Transparency. When customers, candidates or staff are told that AI is used, and how privacy notices are updated;
- Security and suppliers. Access controls, supplier due diligence, data location, and whether the provider uses your inputs to train its models;
- Incidents. How to report a data leak, a harmful output or a suspected error, and how it links to your breach procedure;
- Training and review. Who must be trained, how often, and a fixed review date for the policy itself.
Checklist before approving a new AI tool
- Business need. What task the tool does and who will use it;
- Personal data. Whether it will process personal data, and whether you are the controller and the provider your processor;
- DPIA screening. Completed, with the decision and reasoning recorded;
- Contract terms. Data processing terms in place, with clarity on retention, location and model training;
- Access. Business accounts with single sign-on or managed access, not personal logins;
- Output checks. A named reviewer and a sample-checking routine for the first months;
- Decision impact. Confirmation that any significant decision keeps meaningful human involvement, or that Article 22C safeguards are built in;
- Exit. How data is deleted when you stop using the tool.
Worked example
Illustration only. A 40-person firm finds that staff are pasting client emails into a free chatbot to draft replies. Its new policy approves one business-tier assistant whose contract excludes training on customer data. It bans client personal data in any other tool and requires the sender to read every AI-drafted reply before it goes out.
The firm also uses a recruitment screening feature. That feature would have rejected applicants automatically. Because rejecting an applicant is likely to have a similarly significant effect on them, the firm changes the process so that a trained person reviews every rejection with the authority to overturn it. A review that only rubber-stamps the tool's output would not count as meaningful human involvement. It records this in a DPIA.
Keeping the policy alive
Most AI policies fail because they go out of date, not because they are badly written. Keep the tools register current, review the policy at a fixed interval and whenever a major tool is added, and run short refresher training. Principle 1 of the Code of Practice is raising awareness of AI security threats among staff. Audit a sample of use against the policy, as you would any other control.
Primary sources: the ICO's Guidance on AI and data protection, UK GDPR Article 22C and Article 35, and the AI Cyber Security Code of Practice. See also our guides to AI in accounting and outsourced data protection officers.
If you would like your AI policy tested against how tools are actually used, our GDPR audit and IT risk teams can review the policy, the tools register and your DPIAs.