As of 13 August 2026, AI can only partly create an acceptable use policy for your UK staff.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 30 minutes until you can act on the result.

   How to actually do it

   1. Open your current IT, information security, disciplinary, privacy, social media and home-working policies, and copy the relevant rules into a working document.
   2. Gather a complete list of the devices, accounts, software, messaging services, cloud systems and generative AI tools that staff may use.
   3. Ask the IT, information security and data protection owners to provide the actual monitoring, logging, access, retention and incident-reporting practices, without filling gaps from memory.
   4. Paste the gathered material and organisation details into the prompt, then ask the chatbot to produce the draft and mark every missing decision as [DECISION NEEDED].
   5. Compare every rule in the draft against the existing policies and current workplace practice, deleting any invented system, sanction, monitoring activity or legal claim.
   6. Send the clauses flagged for review, especially monitoring, personal data, disciplinary action, equality and trade union matters, to a UK employment solicitor or data protection specialist.
   7. Ask the accountable policy owner to resolve each [DECISION NEEDED] item, record the version and approval details, consult any required staff representatives, and publish the approved policy through the normal staff handbook or policy process.

   Prompt

   Create a draft acceptable use policy for a UK workplace using the information below.
   
   Organisation: [organisation name and sector]
   Staff covered: [employees, contractors, agency workers, volunteers or other groups]
   Systems and devices covered: [list]
   Permitted uses: [list]
   Prohibited uses: [list]
   Rules for email, internet and social media: [details]
   Rules for generative AI and other external tools: [details]
   Confidential, personal and commercially sensitive information: [details]
   Monitoring and logging: [what is monitored, why, who can access it and how long records are kept]
   Security requirements: [passwords, access, software, reporting lost devices or suspected breaches]
   Reporting route: [who staff contact and how]
   Consequences of breach: [existing disciplinary wording or process]
   Related policies: [list]
   Approval owner and review process: [details]
   
   Write in plain UK English. Use headings, short paragraphs and bullet points. Separate rules from explanations. Do not invent systems, legal duties, monitoring practices, sanctions or consultation steps. Mark missing information as [DECISION NEEDED]. Do not state that the policy is legally compliant. Flag any clause involving employee monitoring, personal data, disciplinary action, equality, whistleblowing, health and safety or trade union rights for review by a UK employment solicitor or data protection specialist. Include a version, owner, approval date placeholder and review date placeholder. End with a short staff acknowledgement section. This is a draft for human review, not professional advice.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.