As of 13 August 2026, AI can only partly create a whistleblowing policy for your UK business.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open the GOV.UK guidance on whistleblowing and copy the relevant current sections or links into a working document for reference.
   2. Gather your business name, sector, workforce groups, reporting channels, named roles, alternative contacts, investigation process, record-keeping arrangements and policy owner, leaving unknown items marked as TO CONFIRM.
   3. Remove names, phone numbers, case details and other personal data from the material before pasting the business information into the chatbot with the prompt.
   4. Paste the prompt and business information into ChatGPT, Claude or Gemini, then save the policy, implementation checklist and unresolved-decisions table it produces.
   5. Compare every legal or regulatory statement and every external reporting route in the draft with the current GOV.UK material, and replace invented or unconfirmed details with the correct business information.
   6. Send the revised policy and unresolved decisions to an employment solicitor or suitably qualified HR adviser, then obtain the business owner's approval before publishing it and briefing workers on the reporting routes.

   Prompt

   Create a whistleblowing policy for a UK business using the information below. Write it for employees and workers in plain British English, with clear headings and practical instructions. Cover: the purpose and scope; what concerns may be raised; who can raise them; the internal reporting routes; alternative routes if the usual contact is involved; how disclosures will be acknowledged, assessed and investigated; confidentiality and data handling; protection from retaliation or detriment; anonymous disclosures; support for the person raising the concern; outcomes and feedback; record keeping; false or malicious reports; review and ownership of the policy; and relevant external reporting routes. Do not invent reporting channels, legal duties, contacts, timescales or protections. Mark missing information as [TO CONFIRM]. Distinguish legal requirements from internal choices. Use only UK sources and flag every point that needs checking against current GOV.UK guidance or advice from an employment solicitor. Do not include personal data. After the policy, provide a short implementation checklist and a table of unresolved decisions.
   
   Business name: [BUSINESS NAME]
   Business type and sector: [TYPE AND SECTOR]
   Number of workers: [NUMBER OR RANGE]
   People covered by the policy: [EMPLOYEES, WORKERS, CONTRACTORS OR OTHER GROUPS]
   Internal reporting contact and role: [CONTACT AND ROLE]
   Alternative reporting contact: [CONTACT AND ROLE]
   Existing grievance, safeguarding or incident procedures: [SUMMARY OR NONE]
   Investigation and record-keeping arrangements: [SUMMARY OR NONE]
   Policy owner and review process: [ROLE AND PROCESS]
   Approved reporting channels: [EMAIL, FORM, PHONE, IN PERSON OR OTHER]
   Any relevant regulator or external reporting route for the business: [DETAILS OR TO CONFIRM]

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.