AI Policy for Employees: What to Include and How to Train

An AI policy for employees tells staff which AI tools they may use for work, what information must never go into them, how to check what comes back and who to ask when they are unsure. No UK law requires one, but UK GDPR applies as soon as someone types personal data into an AI tool, and Acas advises employers to have clear AI policies and to consult staff when AI is introduced.

A policy only changes behaviour when people know what it says. This guide sets out what to include, with a section by section outline you can adapt, a look at the policy the UK’s data protection regulator wrote for its own staff, and how to train people so the policy is followed.

Do UK employers need an AI policy for employees?

There is no UK law that requires a written AI policy. In practice most organisations now need one, because staff are already using AI tools at work and several existing rules apply to that use.

• Data protection. UK GDPR applies whenever staff put personal data into an AI tool. The Information Commission (still known as the ICO) says data protection law does not stop you using AI tools, as long as you apply the data protection principles when you do. Our guide to GDPR training for employees covers what staff need to know.
• Security. The NCSC recommends not including sensitive information in queries to public LLMs, and not submitting queries that would cause problems if they were made public.
• Employment. Acas advises employers to develop clear policies on the use of AI at work and to consult workers and their representatives when it is introduced. It also points out that expecting certain roles to start using AI could mean a change to terms and conditions.
• The EU AI Act. If you place AI systems on the EU market, operate in the EU through a subsidiary or branch, or the output of your AI is used in the EU, Article 4 requires you to take measures to support the AI literacy of staff who use AI on your behalf. Our guide to AI literacy training for employees explains when that applies.
• Public bodies. The ICO says that when staff at a public authority use AI for work, the information generated and the prompts used are subject to the Freedom of Information Act, and conversation histories kept by the tool count as recorded information.

A short policy gives you one place to set these rules, and a record that you told people about them.

What should an AI policy for employees include?

Most good policies cover the same ground. Use the outline below as a starting point, keep each section short and write it in the words your staff use.

Section	What to write
1. Purpose and scope	Why the policy exists and who it covers: employees, temporary staff, contractors and anyone else using AI on your behalf.
2. What counts as AI	A plain definition with examples staff will recognise: chat assistants, AI features inside software you already use, transcription and image tools.
3. Approved tools	The AI tools staff may use for work, which accounts to use (company accounts, never personal ones) and how to ask for a new tool to be approved.
4. Information rules	What must never go into an AI tool, such as personal data about customers or colleagues, confidential client material, passwords and security classified information, and what may go into approved tools.
5. Checking outputs	Who checks accuracy, bias and tone before anything is used, sent or published. AI output is a draft until a person has checked it.
6. Decisions about people	AI may help, but a person makes the final call on hiring, pay, performance and discipline.
7. Being open about AI use	When staff should say they used AI, for example on customer-facing content or anything wholly AI-generated.
8. Copyright and contracts	Checking AI-generated content for other people’s intellectual property before publishing, and respecting client contracts that limit AI use.
9. Professional advice	AI can help prepare work, but legal, financial and similar advice must come from a qualified person who checks it.
10. Reporting problems	Who to tell about a mistake, a data leak or an unexpected result, and how quickly.
11. Training	What everyone completes before using AI tools, and extra training for specific roles or tools.
12. Ownership and review	Who owns the policy, when it is reviewed and what happens if it is not followed.

If you are writing a policy for the first time, sections 3, 4 and 5 matter most. They answer what staff actually ask: which tool can I use, what can I put into it and can I trust what comes out.

Two of the sections rest on law as well as good practice. For decisions about people, Article 22C of UK GDPR says that where a significant decision about someone is based solely on automated processing, they must be able to make representations, obtain human intervention and contest the decision. For information rules, if an approved tool will process personal data in a way that is likely to result in a high risk, you will need a data protection impact assessment before you start.

AI usage policy, acceptable use policy or generative AI policy?

These names are used for much the same document. An AI acceptable use policy usually focuses on the rules for staff: approved tools, information and checking. A generative AI policy covers tools that create text, images or code, such as Copilot, ChatGPT, Claude or Gemini. A broader AI governance policy also covers how the organisation buys, builds and monitors AI systems.

For most small and mid-sized organisations, one document for staff is enough. Keep the governance detail, such as risk assessments, supplier checks and a list of the AI tools in use, in a separate procedure for the people who approve tools.

What the ICO’s own AI policy for staff says

The UK’s data protection regulator published its internal AI use policy in August 2025. It is written for a public body, but it is a useful model because its rules for staff are short and specific. In summary, ICO staff should:

• use only AI tools the ICO has approved, on ICO-approved devices
• use each tool in line with the published guidance and training for it
• be open about AI use where it is appropriate, and mark content that is substantially or wholly AI-generated
• have a person review AI outputs, unless the approval board agrees a lower-impact use does not need it
• use AI with personal, sensitive or confidential information only where that has been approved, keeping to data minimisation
• get legal, accounting and similar advice from the licensed professional, although AI can help if the work is checked
• avoid solely automated decisions with legal or similarly significant effects on people
• check AI-generated content for third-party intellectual property before publishing
• raise concerns and incidents early with their manager or the system owner

On training, the policy says senior leaders should make sure all staff have access to general AI literacy training, and that everyone using a new AI system should be trained on it before it goes live, including its limits and how to report incidents.

Common mistakes with workplace AI policies

• Banning everything. A blanket ban is hard to enforce when AI is built into everyday software, and people may turn to personal accounts you cannot see. Approving a small set of tools with clear rules usually works better.
• Writing it for lawyers. If staff cannot quickly find the answer to “can I paste this into Copilot?”, they will guess. Add real examples from your own work.
• No named owner. AI tools change every few months. Without an owner and a review date, the approved tools list soon goes out of date.
• Publishing it without training. Emailing a PDF round does not show that anyone read it or understood it.
• Leaving people out. Contractors, agency staff and anyone else using AI on your behalf should be covered.

How to roll out an AI policy and train staff on it

1. Consult first. Acas advises consulting staff and their representatives when AI is introduced. Ask teams which tools they already use and what they use them for, so the approved list reflects real work.
2. Launch it with short training. Explain the rules with examples people recognise: a customer email, a meeting summary, a spreadsheet of personal data. A ten minute module does more than a long document.
3. Ask everyone to confirm they have read it. Keep a dated record of who has completed the training and accepted the policy. An LMS does this for you and shows managers who is outstanding.
4. Add training for specific roles. People using AI with customer data, in HR or in regulated work need more than the basics.
5. Update it when tools change. When you approve a new tool or change a rule, send a short update and record who has completed it.

If your approved tools include Copilot or ChatGPT, our guide to Copilot and ChatGPT training for staff covers what that training should include.

How Capytech helps

The Capytech AI Academy gives every employee practical, safe AI skills in lessons of five to ten minutes. Everyone starts with the AI Licence, which covers the essentials of using AI safely at work. The Academy works with whichever AI tools you approve, and dashboards show managers who has completed what.

If you want training on your own policy, we can turn your document into a short custom e-learning module with a knowledge check, so each person shows they understood the rules. On the Capytech LMS you get a dated record of who has completed it and accepted the policy.

Frequently asked questions