As of 13 August 2026, AI can only partly create a bring your own device policy.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open your current information security policy, privacy notice, employment handbook and any mobile device management or remote access documentation.
   2. Ask your IT lead or managed service provider for the actual controls on personal devices, including permitted systems, authentication, encryption, updates, remote wipe, logging and incident response.
   3. Gather the business decisions on who may use personal devices, permitted personal use, payment of costs, support, accessibility, lost devices and access removal when someone leaves.
   4. Paste the gathered facts into the prompt, replacing each bracketed slot with a confirmed answer and leaving genuinely unknown items marked as unknown.
   5. Paste the resulting draft into your policy template and compare every operational statement against your actual IT controls, staff handbook and privacy notice.
   6. Send the draft and its unresolved decisions to your data protection lead and employment solicitor, then record their changes and approval before issuing it.
   7. Publish the approved policy through your normal staff channel and obtain any required acknowledgement without treating acknowledgement as a substitute for lawful monitoring or fair employment practice.

   Prompt

   Create a UK bring your own device policy for [BUSINESS NAME], a [BUSINESS TYPE] with [NUMBER OR DESCRIPTION OF WORKERS] workers. Use the facts below and do not invent any business rule, technical control, legal requirement, supplier, retention period or monitoring practice. If information is missing, mark it [DECISION NEEDED] and ask a concise question rather than guessing.
   
   Business facts:
   - Who may use personal devices: [STAFF, CONTRACTORS, OTHERS]
   - Devices and operating systems allowed: [DETAILS]
   - Business systems and data accessible from personal devices: [DETAILS]
   - Required security controls, such as passwords, screen lock, encryption, updates, antivirus, remote wipe or mobile device management: [DETAILS]
   - Whether personal use is allowed: [DETAILS]
   - Whether the business monitors devices, accounts, traffic or activity: [DETAILS]
   - What happens when a device is lost, stolen, shared or compromised: [DETAILS]
   - Who pays for devices, repairs, mobile data and support: [DETAILS]
   - Joiners, movers and leavers process: [DETAILS]
   - Incident reporting contact and timescale: [DETAILS]
   - Accessibility or reasonable adjustment requirements: [DETAILS]
   - Existing privacy notice, information security policy and disciplinary policy: [DETAILS]
   
   Draft a plain-English policy with these sections: purpose and scope; permitted use; security requirements; access to business data; personal use; monitoring and privacy; costs and support; lost or compromised devices; reporting incidents; leaving the business; breaches of the policy; accessibility and exceptions; responsibilities; approval and review. Separate employee obligations from the business's obligations. Identify every point that needs confirmation from our IT lead, data protection lead or employment solicitor. Do not claim that consent automatically makes monitoring lawful, do not give a definitive legal conclusion, and include the sentence "This draft is not professional advice." End with a short implementation checklist and a list of unresolved decisions.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.