An AI policy for organisations is the written statement of how your people may and may not use artificial intelligence at work. Done well it protects the organisation without slowing it down. This guide from the Institute of AI sets out what to put in it, who owns each part, and how to make it a policy people actually keep to.
A plain answer first, because most leaders are researching this while staff are already pasting work into a chatbot.
An AI policy for organisations is a written document that tells everyone how the organisation expects them to use artificial intelligence. It states where AI is approved, where it is banned, what may and may not go into a tool, when a human must review the output, and who to ask when the answer is not obvious. Its job is simple: let people get the benefit of AI while keeping the organisation on the right side of its legal, ethical and commercial duties.
The reason to write one is that AI is already in the building whether you have a policy or not. Staff are drafting emails, summarising documents and generating code with public tools, often with the best intentions and no idea where the lines are. The risk is rarely malice. It is a well-meaning colleague pasting a client contract into a free chatbot because nobody ever told them not to. A clear policy replaces guesswork with a standard, and in the UK it sits alongside established obligations, particularly data protection under UK GDPR, rather than replacing them.
The hard part is not writing the policy. It is writing one people will actually follow. That means it has to be short enough to read, concrete enough to picture, and honest about the useful cases as well as the forbidden ones. It has to name a person to ask and a safe way to report a mistake. The Institute of AI, the UK's professional body for AI, exists to define that standard and help organisations meet it. The sections below break a good policy into its parts and set out who owns what.
A policy people follow is built from concrete, named parts. Leave one out and the gap tends to be exactly where the next awkward conversation starts.
A short opening that says why the policy exists, who it applies to, and which tools it covers. Name the ground clearly: staff, contractors and agencies, public generative tools and embedded AI features alike. A policy that only names one chatbot is out of date the week a new one launches.
A concrete list of what people may do, with examples from real work: drafting, summarising, code assistance, research. People follow rules they can picture. Give the green-light cases as plainly as the red-light ones so the default answer to "can I use this for X" is on the page, not in someone's inbox.
The bright lines that must not be crossed: pasting personal or client-confidential data into public tools, using AI to make a final decision about a person, or passing off generated work as original where that matters. Keep this list short, absolute and free of exceptions so no one has to interpret it under pressure.
Plain guidance on what may and may not go into a prompt, which tools are approved for sensitive work, and how outputs are stored. This is where the policy meets UK GDPR: minimise personal data, never treat a customer record as prompt fuel, and prefer enterprise tools that do not train on your inputs.
A stated expectation that a person checks AI output before it is relied on, sent to a client, or used in a decision. Set the level of review by the stakes: light for a first draft, firm for anything touching money, health, safety or someone's rights. Accountability stays with the human, always.
When AI use must be declared, to colleagues, clients or in published work, and what happens when the policy is breached. Pair it with a no-blame route to ask questions and report near-misses. A policy with no way to raise a hand is a policy people quietly route around.
A policy fails when responsibility is assumed rather than assigned. These are the roles that make it real, from the boardroom to the keyboard.
Approves the AI policy and puts its authority behind it. The board sets the risk appetite the rules express, signs off the bright lines, and answers for the policy to regulators, clients and staff. It does not draft the detail, but nothing ships without its endorsement, and it schedules the review that keeps the document from ageing.
The named owner of the document day to day. They commission it, fund the tooling and training that make it followable, and settle it when two teams read a clause differently. A policy without a sponsor is a PDF nobody maintains; a policy with one is a standard the organisation keeps to.
Drafts the workable detail under the board's appetite: the approved and prohibited lists, the review thresholds, and the evidence trail that shows the policy is lived rather than laminated. They test the wording against real cases so it survives contact with the work, and stay independent of the teams doing the building.
Owns every clause that touches personal data: lawful basis, impact assessments, and the individual rights a tool can affect. In the UK this role signs off the data-handling rules in the policy and keeps them aligned with established data protection duties.
Make the written rule the path of least resistance. They stand up the sanctioned tools, wire in access controls and logging, and block or flag the routes the policy forbids, so following the document is easier than working around it.
Reads the policy, works inside it, discloses AI use where it asks, and checks output before relying on it. A rule only holds if the person applying it understands why it is there. Clear examples and a named person to ask beat a document no one opens twice.
You do not have to draft an AI policy from a blank page. The Institute of AI offers three practical routes, from a free public commitment to hands-on advisory.
A public commitment to getting your organisation ready for AI, set out as five practical pledges covering AI literacy, responsible use, skills investment, open knowledge and inclusive access. Signing is free and you choose at least three; one of them asks for a published AI policy and a named owner, so it doubles as a backbone for yours.
Sign the CharterIndependent assessment of your AI practice against the Institute of AI's standard. Accreditation moves a written policy from a stated intention to an externally verified one, giving clients, regulators and partners assurance that the rules on the page are the rules in the building.
Explore accreditationPractical, vendor-neutral help to draft a policy that fits your size, sector and risk, and to roll it out so people actually follow it. Guidance from an independent professional body that resells no third-party software and takes no implementation kickbacks.
Talk to an adviserStart with a free, public commitment to getting your organisation ready for AI. Signing the UK AI Readiness Charter gives your policy a recognised standard to build on, and it takes minutes.
Five practical pledges on getting your organisation ready for AI. One asks for a published policy and a named owner, so it doubles as a backbone for yours.
Read the CharterIndependent assessment of your AI practice against the Institute of AI standard, so your policy is verified, not just stated.
Explore accreditationVendor-neutral help to draft an AI policy that fits your size, sector and risk, and to roll it out so it sticks.
Talk to an adviser
