An AI policy for employees is a short document that tells staff which AI tools they may use at work, what information they must never put into them, and who stays responsible for the result. If anyone in your team already uses a public chatbot to draft emails, summarise notes or rewrite a job advert, you need one now. Without it, each person is making their own rules about your company’s data and your employees’ personal data.
Why a UK employer needs an AI policy for employees now
Acas tells employers to develop clear policies on AI at work, check approved tools with IT, and keep business-sensitive and personal information out of public tools. The risks a policy deals with:
- Confidentiality. Anything typed into a public tool leaves your control. Depending on the provider’s terms, it may be stored or used to improve the tool.
- Personal data. Names, pay, sickness records and disciplinary notes are personal data under UK GDPR, and health data is special category data. Putting them into an AI tool is processing, so you need a lawful basis, transparency and proper security. The ICO’s guidance on AI and data protection sets out what it expects.
- Accuracy. AI tools can produce confident, wrong answers, including on UK employment law and tax.
- Copyright and IP. Outputs can reproduce other people’s material, and who owns AI-generated content is not fully settled. Check your client contracts too: some forbid using AI on their work.
- Bias. Outputs can reflect bias in the data the tool learned from. That matters under the Equality Act 2010 if AI feeds into decisions about people.
- Record keeping. Prompts and outputs about a named person can be personal data that person can ask for in a subject access request.
For the wider legal picture, read our guide to AI and employment law in the UK.
Who should own it
An AI policy sits across three areas, so give it three owners and one named lead.
| Owner | Responsible for |
|---|---|
| HR | Wording, consultation, training records, link to the disciplinary policy |
| IT | Approved and banned tools, accounts, security settings |
| Data protection lead (or DPO) | What data may go into which tool, DPIAs, privacy notices |
AI acceptable use policy template (UK)
Copy the wording below and replace everything in [square brackets]. Check it against your contracts, privacy notice and other policies. It is a starting point, not legal advice.
1. Purpose and scope
1.1 This policy sets out how [Company name] expects you to use artificial intelligence (AI) tools at work.
1.2 It applies to all employees, workers, contractors, agency staff and volunteers who use [Company name] systems, devices or data, or who work for us on their own devices.
1.3 It covers generative AI tools that create text, images, audio, code or summaries, and AI features built into other software.
2. Approved and banned tools
2.1 You may use only the AI tools on our approved list, with a company account: [list approved tools].
2.2 You must not use these for work: [list banned tools or categories, e.g. free consumer AI apps, AI browser extensions, AI meeting note-takers not on the approved list].
2.3 To request a new tool, contact [IT contact]. We check security, data protection and the supplier’s terms before approving it.
2.4 The current approved list is at [location].
3. Information you must never enter
3.1 Unless a tool is approved for that type of information, never enter:
- personal data about colleagues, candidates, customers or anyone else, including names, contact details, ID numbers and photos
- payroll and HR records: pay, tax codes, National Insurance numbers, bank and pension details, sickness and absence records, disciplinary and grievance files
- special category data, such as health, ethnicity, religion, sexual orientation or trade union membership
- client confidential information, contracts and pricing
- [Company name] confidential information, including financial results, plans, source code, passwords and security details.
3.2 If you are unsure, do not enter it. Ask [data protection lead].
4. Human review of outputs
4.1 You are responsible for anything you produce with AI help.
4.2 Check every output for accuracy, bias, tone and confidential information before you use or share it. Check facts, figures and legal or tax points against an official source such as GOV.UK.
5. Disclosure
5.1 Tell your manager, and the recipient where relevant, when AI has produced a substantial part of [client reports / published content / code / other].
5.2 You do not need to disclose minor uses such as spelling and grammar checks.
6. Decisions about people
6.1 AI must not make decisions about recruitment, pay, performance, promotion, discipline, dismissal or redundancy.
6.2 A person with the authority and knowledge to change the outcome must make each decision and be able to explain it.
6.3 Before any AI tool is used to support decisions about people, [HR lead] and [data protection lead] must approve it and a data protection impact assessment (DPIA) must be completed.
7. Security and accounts
7.1 Use company accounts for approved tools, with [single sign-on / multi-factor authentication]. Never use personal accounts for work.
7.2 Switch off chat history or model training settings where IT tells you to.
7.3 Do not install AI plug-ins, extensions or meeting bots without approval.
7.4 Report any suspected data leak to [contact] straight away, and within [X] hours at most.
8. Training
8.1 You must complete [training name] before using approved AI tools, and refresher training [every 12 months / when tools change].
9. Monitoring and breaches
9.1 We may monitor use of approved AI tools on company systems to protect data and check this policy is followed, as explained in our [staff privacy notice / monitoring policy].
9.2 Breaching this policy may lead to action under our [disciplinary policy]. Serious breaches, such as deliberately entering personal or confidential data into a banned tool, may be treated as gross misconduct.
10. Review
10.1 This policy is owned by [role]. It was last reviewed on [date] and will be reviewed again by [date], or sooner if the law, our tools or official guidance change. Questions go to [contact].
Worked example: applying the policy
Here is how the template answers five everyday requests in a 40-person business with one approved, company-licensed AI tool.
| Request | Allowed? | Why |
|---|---|---|
| Rewrite a job advert in the approved tool, no names | Yes | No personal data; review the output (clause 4) |
| Paste an employee’s sickness record into a free chatbot to draft a letter | No | Special category data in a banned tool (clauses 2 and 3) |
| Summarise anonymised survey comments in the approved tool | Yes, with care | Check that no comment identifies someone |
| Ask AI to rank 12 candidates and reject the bottom 8 | No | Decision about people (clause 6) |
| Draft a client report with AI help | Yes | Disclose if substantial (clause 5) |
How to roll it out
- Consult. Acas advises consulting staff and any representatives before introducing AI. If some roles will be expected to use it, their terms and conditions may need to change.
- Train. Walk through clauses 3, 4 and 6 with real examples like the table above. Keep a record of who attended.
- Get an acknowledgement. Ask each person to confirm they have read the policy, and keep that record with their file.
- Review every 6 to 12 months. Tools, supplier terms and guidance change quickly. Update the approved list in between if you need to.
Where Givver fits
If you run HR in Givver, AI policy creation lets admins draft a policy like this one and share it with employees through policies. Once it is assigned, the AI policy assistant answers employees’ questions about the policies assigned to them, in the Givver app and on the web, so fewer questions land with HR. Customer data is not used to train AI models. See how AI works in Givver.
FAQs
Do UK employers have to have an AI policy?
No law requires a standalone AI policy. But UK GDPR makes you accountable for how staff handle personal data, including in AI tools, and Acas recommends a clear policy.
What should a generative AI policy for employees include?
At least: approved and banned tools, data that must never be entered, human review of outputs, disclosure, a ban on AI making decisions about people, security, training, monitoring, breaches and a review date. The template above covers each.
Can staff use free AI tools at work?
Only if your policy allows it. Many employers ban free consumer tools for work because they cannot control what happens to the data.
How often should we review an AI usage policy for employees?
Every 6 to 12 months, and whenever you add a tool, a supplier changes its terms or new guidance is published.
Is this sample AI policy for employees legal advice?
No. It is a starting template. Have it checked against your contracts and other policies, and speak to an employment or data protection adviser for anything specific.
Next steps
Start with clauses 3 and 6, then name your owners, consult and train. See how Givver handles policies and AI.