As of 13 August 2026, AI can draft an AI use policy for your UK business.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open a document containing your current confidentiality, information-security, data-protection, records-retention and staff handbook rules.
   2. Gather the names of every AI tool staff use or want to use, the roles covered, and examples of permitted and prohibited work.
   3. List the kinds of personal, confidential, commercially sensitive and customer data the business handles, including anything that must never be pasted into an AI tool.
   4. Paste those materials and facts into the prompt, replacing each bracketed slot and keeping any source text that the policy must reflect.
   5. Ask the model to produce the policy, staff checklist, decision table and missing-decision list in one response.
   6. Compare every rule in the draft with your existing policies, approved-tool list and actual approval process, then remove any control the business does not operate.
   7. Check the draft's legal and data-protection points against current GOV.UK and ICO guidance, and send the final draft to a UK solicitor for review before adopting it for higher-risk uses.

   Prompt

   Draft an internal AI use policy for a UK business using only the information in this prompt and the attached source material. Do not invent laws, regulators, business facts, safeguards, approvals, suppliers or technical controls. Where information is missing, write [BUSINESS DECISION NEEDED] and list the question.
   
   Business details:
   - Business name and sector: [INSERT]
   - Business size and locations: [INSERT]
   - Staff, contractors and other users covered: [INSERT]
   - Customers, suppliers or other people affected: [INSERT]
   - AI tools currently approved or under consideration: [INSERT]
   - Business data that may be entered into AI tools: [INSERT]
   - Data that must never be entered: [INSERT]
   - Existing information-security, confidentiality, data-protection and records-retention rules: [INSERT]
   - Human approval required before using AI output: [INSERT]
   - Person or role responsible for policy questions and incidents: [INSERT]
   - Relevant business processes and higher-risk uses: [INSERT]
   
   Produce:
   1. A plain-English policy with sections for purpose, scope, permitted use, prohibited use, handling of personal and confidential data, checking AI output, intellectual property and confidentiality, human accountability, record keeping, incident reporting, training, monitoring, exceptions and review.
   2. A short staff checklist of actions and prohibited actions.
   3. A decision table showing when staff may use AI, when manager approval is needed and when a solicitor or other specialist should be consulted.
   4. A list of every assumption, missing decision and statement that needs confirmation.
   5. A source-checking list that identifies which points should be checked against current GOV.UK, ICO or other applicable official guidance. Do not claim that the policy is legally compliant or suitable without professional review.
   
   Use British English, a practical tone and headings that can be pasted into a staff handbook. Separate policy requirements from recommendations. Do not include invented penalties, legal citations or fixed review dates.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.