Skip to content
Boxed OnlineGary Kellett · Architect · CTO · AI, home

Free tool, 3 minutes

An AI policy your staff will actually read

Your people are already using AI, whether or not you've said they can. Answer six questions and get a one-page acceptable-use policy: which tools are allowed, what must never go into them, who checks the output and who approves new tools.
Questions
6
Time
3 minutes
You get
One-page draft
Email needed
No

Policy builder

A starting template, not legal advice. It gives you a sensible first draft to adapt. Check it with your own HR, legal or data protection adviser before you adopt it, especially if you are regulated.

About your business

The policy updates as you answer.

Is your work regulated?

For example by the FCA, MHRA, CQC or a professional body.

Which AI tools do staff use, or want to?

Tick all that apply. These become the approved list.

What customer data do you handle?
Who approves new tools?

Draft: starting template, not legal advice

The Company AI acceptable-use policy

Sector: Professional services. Starting template, not legal advice: review it with your own advisers before adopting it. Items in square brackets need completing.

1. Purpose and scope

  • This policy sets out how everyone who works for or with the Company may use artificial intelligence (AI) tools, so we get the benefit safely.
  • It covers employees, contractors and temporary staff, on any device, whenever the work is for the Company.
  • AI tools include chat assistants, AI features built into other software, image and video generators, transcription tools and coding assistants.

2. Approved tools

Only the tools below may be used for the Company work:

  • ChatGPT: allowed on the Company business accounts only, with the setting that lets the supplier train on our data switched off.
  • Microsoft Copilot: allowed on the Company business accounts only, with the setting that lets the supplier train on our data switched off.

3. Good uses

  • Drafting and summarising emails, documents and reports, which a person then checks and edits.
  • Research and brainstorming, with facts checked against a reliable source.
  • Analysing information that contains no personal or confidential data.
  • Automating routine tasks inside approved systems, once a director has agreed the change.

4. Never put into an AI tool

  • Customer or staff personal data in any free or personal AI account.
  • Passwords, access keys or anything that would let someone into our systems.
  • Confidential commercial information: prices, margins, contracts, bids or plans that are not public.
  • Anything a client or supplier has given us in confidence, unless their agreement allows it.

5. Checking what AI produces

  • A named person is responsible for anything AI helped to produce. AI can be wrong while sounding certain.
  • Check facts, figures, names and references before anything is sent or published.
  • Do not use AI to make decisions about people (hiring, credit, pricing for an individual, performance) without a person reviewing every decision.
  • Check that AI-generated text, images or code do not copy someone else's work or breach a licence.

6. New tools

  • Before anyone starts using a new AI tool, or a new AI feature in an existing tool, a director must approve it.
  • Approval checks: where the data goes and is stored, whether the supplier trains on it, the contract and data processing terms, and who in the Company owns the tool.
  • Approved tools are added to section 2 of this policy.

7. Being open with customers

  • If a customer asks whether AI was used in work for them, tell them honestly.
  • Chatbots or automated replies must say they are automated and offer a way to reach a person.
  • Our privacy notice must explain any use of AI on personal data, as UK GDPR requires.

8. Mistakes and incidents

  • If personal or confidential data has gone into a tool it should not have, tell a director the same day. Nobody will be blamed for reporting it.
  • Personal data breaches may need reporting to the ICO within 72 hours, so speed matters.
  • Breaking this policy on purpose may lead to disciplinary action.

9. Owner and review

  • Owner: a director.
  • This policy is reviewed every six months, and whenever we approve a new tool or the law changes.
  • Version 1, dated [date]. Approved by [name, role].

Policy updated: 9 sections.

Optional

Email me a copy

I'll email you the policy as text you can paste into your own template, with a note on what to check before you adopt it.

The working

How the policy is built

Every policy covers the same ground: scope, approved tools, good uses, what never goes in, checking the output, new tools, openness with customers, incidents, and an owner with a review date.

Your answers change the detail. The tools you tick become the approved list. The customer data you handle sets the data rules, and sensitive data adds a rule that needs written approval and a data protection impact assessment.

Regulated, or not sure? A section on regulated work is added: normal change control applies, validated systems are not changed without assessment, and AI use is recorded.

Items in square brackets, such as the approval date, are for you to complete. Nothing you type leaves your browser unless you ask for an email copy.

Questions

Before you rely on it

Do we really need an AI policy?

If anyone in your business uses ChatGPT, Copilot or an AI feature in your software, yes. Without one, staff guess what is allowed, and the usual risk is customer or confidential data pasted into a free account.

Is this legal advice?

No. It is a practical starting template. Employment, data protection and sector rules differ between businesses, so have it checked by your own adviser before you adopt it.

Should we just ban AI tools?

Bans tend to push use onto personal accounts where you can't see it. Approving a small set of business accounts, with clear data rules, is usually safer and gets you the benefit.

What should we do after adopting it?

Tell everyone, set up the approved tools on business accounts with training on your data switched off, and review it in six months. If you want help choosing where AI belongs in your processes, that is what the AI Readiness Sprint is for.

Related reading and next steps

Read next

How to write a one-page AI use policy

The sections that matter, the ones to leave out, and how to get your team to actually follow it.

Read the article

When you're ready

AI Readiness Sprint

A short, fixed engagement: where AI genuinely helps your business, where it doesn't, and the guardrails to put in place first.

See the sprint

More free tools

Next step

Policy done. What next?

In 30 minutes we can work out where AI would actually pay back in your business, and where it wouldn't.

Book a 30-minute callProve a process free

I reply personally within 2 business days.