As of 13 August 2026, AI can only partly draft a whistleblowing policy for your UK business.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open GOV.UK guidance on whistleblowing and your current grievance, disciplinary, safeguarding and data protection policies.
   2. Gather the business name, UK entities, covered workers, reporting contacts, investigation roles, escalation routes and record-keeping arrangements, and mark anything undecided as unknown.
   3. Paste the gathered facts and the source text into a chatbot with the prompt above, keeping confidential personal information and live whistleblowing reports out of the chat.
   4. Ask the model to produce the full policy, the staff-facing version, the source-to-sentence table and the list of unresolved questions in one response.
   5. Compare every named contact, process, promise of confidentiality, reporting route and internal deadline in the draft with your approved procedures and current GOV.UK guidance.
   6. Send the draft, source table and unresolved-question list to a UK employment solicitor for review of legal scope, protected disclosures, detriment, confidentiality and investigation wording.
   7. Apply the solicitor's changes, obtain approval from the policy owner, publish the final version in the staff handbook or intranet, and give workers the agreed reporting contacts and process.

   Prompt

   Draft a whistleblowing policy for a UK business using only the information and source material I provide. Treat the draft as a working document, not legal advice. Do not invent legal duties, reporting channels, protected categories, deadlines, confidentiality promises, contacts or facts about the business. Where information is missing, write [TO CONFIRM] and list the question needed.
   
   Business details:
   - Business name: [BUSINESS NAME]
   - Sector and regulated activities, if any: [DETAILS]
   - Number and types of workers covered: [DETAILS]
   - UK locations: [DETAILS]
   - Named policy owner: [ROLE OR NAME]
   - Internal reporting contacts and alternatives: [DETAILS]
   - Investigation and record-keeping arrangements: [DETAILS]
   - Existing grievance, disciplinary, safeguarding, data protection and conflicts policies: [DETAILS]
   - Board or senior oversight: [DETAILS]
   
   Source material and current procedures:
   [PASTE GOV.UK GUIDANCE, EXISTING POLICIES AND APPROVED BUSINESS INFORMATION HERE]
   
   Write a clear policy with these sections: purpose; scope; what concerns can be raised; what is outside the policy; who can raise a concern; how to raise one internally; alternative reporting routes where supported by the sources; confidentiality and data handling; protection from detriment and retaliation; conflicts of interest; acknowledgement and investigation process; outcomes and feedback; record keeping; false or malicious reports; responsibilities; training; policy ownership and review. Distinguish protected disclosures from ordinary grievances without asserting that a particular report qualifies. Explain that confidentiality cannot be guaranteed where disclosure is required or necessary, only if supported by the sources. Include a short staff-facing version and a list of every statement that needs a solicitor or employment-law specialist to check. End with a source-to-sentence table showing which supplied source supports each legal or procedural claim.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.