As of 13 August 2026, AI can only partly draft an acceptable use policy for your UK business.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open a document and record the business name, sector, people covered, systems covered and the policy owner.
   2. Gather your current IT, information security, data protection, employee handbook and disciplinary documents, and note any rules that the acceptable use policy must match.
   3. Ask the people responsible for IT, HR and data protection to supply the permitted uses, prohibited uses, personal-use rules, monitoring practices, reporting route and enforcement process.
   4. Paste the collected information into the prompt, replacing every bracketed slot and leaving a slot marked unknown where the business has not decided the answer.
   5. Paste the generated policy into the document and compare each rule against your actual systems, contracts, staff handbook, monitoring notices and disciplinary process.
   6. Send the draft, its missing-information table and its professional-review flags to a UK solicitor, then apply their changes before issuing the policy.
   7. Give the approved version a policy owner, effective date, review process and distribution route, and keep evidence of which users received it.

   Prompt

   Draft an acceptable use policy for a UK business using the information below.
   
   Business name: [business name]
   Business type and sector: [description]
   People covered: [employees, contractors, agency workers, customers, suppliers or other users]
   Systems and equipment covered: [email, messaging, cloud services, devices, networks, software, AI tools and other systems]
   Permitted uses: [list]
   Prohibited uses: [list]
   Rules on personal use: [details]
   Rules on confidential information and personal data: [details]
   Rules on passwords, access, devices and software: [details]
   Rules on monitoring and logging: [details]
   Rules on generative AI: [details]
   Reporting route for suspected misuse: [details]
   How breaches are handled: [details]
   Related policies or contracts: [list]
   Policy owner and review process: [details]
   
   Write in clear UK English for the intended readers. Do not invent business facts, legal obligations, monitoring practices or penalties. Where information is missing, insert a clearly labelled question rather than guessing. Separate operational rules from legal commentary. Flag clauses that need a UK employment or commercial solicitor to review, especially monitoring, personal data, disciplinary action, intellectual property, confidentiality and use by customers or contractors. Include sections for purpose and scope, acceptable use, prohibited use, security, personal data and confidentiality, generative AI, monitoring, reporting concerns, breaches and enforcement, exceptions, related documents, ownership and review. After the policy, provide a table of missing information and a list of points requiring professional review.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.