Do we need an AI acceptable use policy? What to include

Q: Do we need an AI acceptable use policy, and what should it say?

Last updated: 8 November 2026 The short answerYes. One page is enough. It should say which tools are approved, what data must never go in, who approves new tools, and what happens if the rules are broken. What to put in itApproved tools. Name them and the plan level.Forbidden data. Be specific: personal data, customer lists, contracts, credentials and anything under an NDA.Approval route. Who decides, and how long it takes.Checking output. Staff stay responsible for anything they send or publish.Incidents. Who to tell if something sensitive is pasted into a tool.Review date. Tools change quickly, so review twice a year. Keep it short and plainA policy nobody reads protects nobody. Use plain language, put it where staff will see it, and cover it in induction and awareness training. Link it to your other policiesIt should sit alongside your data protection, acceptable use and information security policies. If you hold or are working towards Cyber Essentials, list AI tools in your software inventory like any other service. Quick answersIs an AI policy a legal requirement?There is no single law that requires one. Your duties under UK GDPR and your contracts still apply to AI use, and a policy is how you show you are meeting them.Who should sign it off?A director. That also makes it clear the business, not the IT provider, owns the decision. We can give you a one-page AI policy template and tailor it to your business. Book a free 20-minute call.Talk to ABCOM Related answers and guidesCan our staff use ChatGPT, Claude or Copilot safely?Is it safe to connect AI tools to Microsoft 365?ABCOM AI guidance notice for clientsAll ABCOM FAQs Sources and further readingICO: Guidance on AI and data protection

Last updated: 8 November 2026

The short answer

Yes. One page is enough. It should say which tools are approved, what data must never go in, who approves new tools, and what happens if the rules are broken.

What to put in it

Approved tools. Name them and the plan level.
Forbidden data. Be specific: personal data, customer lists, contracts, credentials and anything under an NDA.
Approval route. Who decides, and how long it takes.
Checking output. Staff stay responsible for anything they send or publish.
Incidents. Who to tell if something sensitive is pasted into a tool.
Review date. Tools change quickly, so review twice a year.

Keep it short and plain

A policy nobody reads protects nobody. Use plain language, put it where staff will see it, and cover it in induction and awareness training.

Link it to your other policies

It should sit alongside your data protection, acceptable use and information security policies. If you hold or are working towards Cyber Essentials, list AI tools in your software inventory like any other service.

Quick answers

Is an AI policy a legal requirement?

There is no single law that requires one. Your duties under UK GDPR and your contracts still apply to AI use, and a policy is how you show you are meeting them.

Who should sign it off?

A director. That also makes it clear the business, not the IT provider, owns the decision.

We can give you a one-page AI policy template and tailor it to your business. Book a free 20-minute call.

Talk to ABCOM