Home / AI training for business / AI policy template
A workplace AI use policy you can adapt
AI policy template
This AI policy template sets out the sections a workplace AI use policy needs and the decisions each one records. It is a structure to adapt, not legal advice: the right wording depends on your tools, sector and data. Each section below names the decision, gives example wording to edit and points to the public guidance worth reading before you finalise it.
Draft a one-page policy that names approved tools, information rules, review standards, incident steps and an owner, ready for your specialist to check.
BBC reporting describes the UK rollout of workplace AI courses. BBC: workplace AI training ↗
GDS sets out ten principles for safe and responsible AI use in government, including meaningful human control. GOV.UK: AI Playbook for the UK Government ↗
New to the topic? Read the background on artificial intelligence.
A workplace AI use policy you can adapt
What should the policy's purpose and scope cover?
Say who the policy applies to, which activities it covers and what it does not decide.
Open with one paragraph: the policy covers staff, contractors and anyone acting for the organisation when they use AI tools for work, including tools built into software the organisation already licenses. Say plainly that it governs use of AI tools, not the development of AI products, if that is your position. Example wording to edit: "This policy sets out which AI tools you may use for work, what information you may put into them and how their output is checked."
Government's AI Playbook for civil servants is written for the public sector, but its principles are a useful checklist for any organisation: lawful and responsible use, security, meaningful human control and use alongside the organisation's own policies. Borrow the questions, not the public-sector obligations. AI governance training helps the people who will apply the policy practise these decisions.
Teams using Copilot can turn this policy into a rules sheet using our Copilot training resources.
Who it applies to
Which activities it covers
What it does not decide
Date and version
A workplace AI use policy you can adapt
How should the policy list approved tools?
Keep a short, named list with the purpose each tool is approved for, and a route to request another.
A list of approved tools is clearer than a list of banned ones, which goes out of date immediately. For each tool, record the account type staff must use (a company account rather than a personal one), the approved purposes and anything excluded. Example: "Approved: our licensed assistant for drafting and summarising internal documents. Not approved: entering client personal data into any tool not on this list." Use AI governance consulting to connect the policy to actual system owners, approvals, tests and review records. The template can structure the discussion, but publishing a policy alone does not establish that the controls have been implemented.
Add a request route: who staff ask, what information they provide and how long a decision normally takes. If a tool is built into existing software, such as an assistant in your office suite, note whether it is switched on and for whom. Microsoft Copilot training shows how licence and permissions change what one such tool can see. An AI readiness assessment helps when the list itself is the open question.
A workplace AI use policy you can adapt
What information rules does a policy need?
Classify what may and may not go into AI tools, using the categories your organisation already has.
Reuse your existing information classes rather than inventing new ones. State which classes may be used with which tools: for example, public and internal material in approved tools, personal or client-confidential material only in tools approved for it, and certain categories never. Tell staff what to do when unsure, which is usually to ask before pasting. An AI governance framework connects the policy to system owners and decision evidence. An AI risk assessment records task-specific failures and controls; the policy itself should not be treated as proof that those controls have been tested.
The ICO's guidance on AI and data protection covers accountability, transparency and fairness where personal data is involved; it is currently under review, so check the current version. The NCSC guidelines for secure AI system development are aimed at systems you build, and are worth reading if the policy also covers internal AI projects.
| Check | What to establish |
|---|---|
| 1 | Reuse existing data classes |
| 2 | Map classes to tools |
| 3 | Name the never-enter items |
| 4 | Ask before pasting |
A workplace AI use policy you can adapt
How should output be reviewed and owned?
Make a person responsible for anything AI helped produce, and set review rules by risk.
The key sentence: "You are responsible for any work you produce with AI assistance, as you would be for any other work." Then set review levels. Internal drafts may need only the author's check; anything sent to a customer, published or used in a decision about a person needs a named second reviewer or a defined check against the source. Say whether staff should disclose AI assistance, and to whom.
The NIST AI Risk Management Framework is voluntary guidance whose Govern, Map, Measure and Manage functions can help structure the risk discussion behind these rules. Keep the policy itself short; put worked examples in training. AI training for employees teaches the everyday checking routine the policy depends on.
A workplace AI use policy you can adapt
What happens when something goes wrong, and who maintains the policy?
Give a simple incident route and a named owner who reviews the policy on a set date.
Incident wording: "If AI output was wrong and has been sent, published or relied on, or if restricted information was entered into a tool, tell [role] the same day." Say what will be recorded and that honest reporting will be treated as such. Link to your existing data-breach procedure rather than duplicating it.
Name the policy owner, a review date and the triggers for an earlier review, such as a new tool, a new type of information or a change in guidance. Train people on the policy rather than only circulating it. AI literacy training and AI governance training turn the document into practised decisions, and UK government AI training offers a free foundations course that staff can take first.
Same-day incident route
Link to breach procedure
Named owner and review date
Train, do not just circulate
Make the decision concrete
What does the current task cost in time?
Choose a task connected to ai policy template and enter its current workload. This gives you a baseline to discuss before buying training or commissioning a build.
A baseline is useful even if you decide to keep the process manual. Measure the work that matters, then compare quality and review effort as well as time.
Assess the workflow before changing it, or plan business AI training if the gap is how people use existing tools.
Your current workload
Estimate how much time the existing task takes before discussing ai policy template.
16 hours per week
People × minutes × weekly tasks ÷ 60. A workload baseline from your inputs, not a prediction of AI time savings. Include review and support time when comparing a proposed workflow.
A useful AI investment leaves your team able to do the work and judge the result.
Continue with the right question
Where should you go next?
Use the overview for context, then follow the pages that match your delivery decision.
See our ai training service or read the ai training for business overview.
FAQ
Questions, answered
Evidence and further reading
Which sources support the guidance?
Source links support the specific background described here. The practical checklists and illustrative examples are predeploy’s guidance.
BBC reporting describes the UK rollout of workplace AI courses. BBC: workplace AI training ↗
GDS sets out ten principles for safe and responsible AI use in government, including meaningful human control. GOV.UK: AI Playbook for the UK Government ↗
ICO guidance covers AI accountability, transparency and fairness; the guidance is currently under review. ICO: AI and data protection guidance ↗
NCSC guidance covers design, development, deployment and operation. NCSC: secure AI system development ↗
NIST describes its AI risk framework as voluntary guidance for design, use and evaluation. NIST: AI Risk Management Framework ↗
Background reading on the broader field of artificial intelligence. Wikipedia: artificial intelligence ↗
Choose your next step
Explore ai training for business
Start with a topic overview, or go directly to the question your team needs to answer.
AI training for business
Plan the right programme for your company, people and tools.
Start with the decision
More questions in this topic
- AI training for business
- Corporate AI training
- AI training for small businesses
- Enterprise AI training
- In-company AI training
- AI workforce training
- AI training programs for employees
- AI training services
- AI training and consultancy
- AI training courses UK
- AI prompt training
- Agentic AI training
- AI leadership training
- AI literacy training
- Generative AI training
- AI adoption workshop
- Bespoke AI training
- AI governance training
- Microsoft Copilot training
- UK government AI training
- AI training for employees
- ChatGPT training
- Gemini training
- Claude AI training
- AI training plan for employees
- AI training cost for business teams
- AI training company
- AI training for companies
- AI training UK
- AI courses UK
- AI leadership course
- Microsoft 365 Copilot training
- Copilot courses
- Copilot training resources
- Claude Enterprise training
- AI upskilling
