As of 13 August 2026, AI can only partly write an AI use policy for your UK workplace.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open your current data protection, information security, equality, monitoring, conduct and disciplinary policies, then record their owners, approval routes and review dates.
   2. Gather an inventory of the AI tools and AI-enabled features staff currently use or want to use, including where they process personal, confidential or customer data.
   3. Ask HR, IT, information governance and senior management to list permitted uses, prohibited uses, required human checks, reporting routes and consequences for misuse.
   4. Paste those details into the prompt and ask the chatbot to produce the policy, unresolved decisions and launch checklist.
   5. Compare every operational instruction in the draft with your existing policies, approved tools, data flows, retention rules and incident process, correcting anything that does not match.
   6. Send the marked draft to your HR lead, data protection lead and, for serious or uncertain issues, an employment solicitor or data protection specialist for review.
   7. Record the approval decision, consult affected workers where required, publish the final policy with an owner and review date, and provide staff training on the approved uses and reporting route.

   Prompt

   Draft a UK workplace AI use policy for [organisation name], a [sector] organisation with approximately [number] workers in [locations]. Use the information below and invent nothing.
   
   Organisation details:
   - Main services and worker groups: [details]
   - AI tools currently used or under consideration: [list]
   - Business processes where AI may be used: [list]
   - Uses that management wants to permit: [list]
   - Uses that management wants to prohibit: [list]
   - Existing policies on data protection, information security, equality, conduct, monitoring and disciplinary action: [summaries or links]
   - Internal owner and approval route: [details]
   - Consultation requirements: [details]
   - Retention, access and incident-reporting processes: [details]
   
   Write a practical policy with these headings: purpose and scope; definitions; permitted uses; prohibited uses; personal and confidential data; human review and decision-making; accuracy, bias and accessibility; intellectual property and confidentiality; approved tools and account controls; monitoring and records; training and reporting concerns; breaches and consequences; governance, review and approval.
   
   Make clear that AI must not be the sole basis for employment, performance, disciplinary, recruitment or other significant decisions. Do not create new legal duties, guarantees, tool approvals, retention periods or disciplinary sanctions. Where UK law or a specialist judgement is relevant, mark the point [CHECK WITH HR OR LEGAL ADVISER] and explain what must be checked. Distinguish legal requirements from optional organisational controls. Use plain British English, short sections and operational wording. End with a list of unresolved decisions and a launch checklist for the policy owner. This is a working draft, not professional advice.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.