Staff AI Acceptable Use Policy

Because data protection policies were written before AI deployment was a daily reality. They cover lawful basis, retention and breach response, but they do not address what categories of data can be entered into which AI tools, how outputs must be verified, or how staff escalate an AI-specific incident. A standalone AI acceptable use policy sits alongside your data protection policy and references it. Without the AI-specific document, you are relying on individual staff judgement across your whole workforce, which is exactly how incidents happen.

Around four to six weeks for a typical UK organisation. Allow five working days for HR, Legal and DPO review, then a week or two to brief staff and run a 30-minute Q&A, then a fortnight to collect signed acknowledgements and integrate the policy into onboarding. Training the team on what good AI use actually looks like is a parallel workstream - staff-level, champion-level and board briefings can run concurrently. The bottleneck is almost always the legal review cycle, not the policy itself.

Anything that could identify a living individual, directly or indirectly. Names, addresses, email addresses, phone numbers, national insurance numbers, dates of birth and medical information are obvious. Less obvious examples include staff performance notes, customer complaint details and the contents of internal HR cases. The rule the policy enforces is simple: unless the AI tool has been specifically approved for that data type and a DPIA has been completed, the data does not go in. It is easier to remember a hard line than a sliding scale.

HR, Legal and the Data Protection Officer at minimum. The policy intersects with employment law, data protection obligations and IT security controls, so all three need to review and approve. In a council or regulated business, add the relevant compliance officer. Allow five working days for the review cycle. Do not skip this step - without documented sign-off the policy carries less weight if you ever have to defend it to the ICO or in a tribunal.

At least every twelve months, and immediately after any AI-related incident or material change to the tools you use. AI capabilities evolve faster than annual policy cycles can track, so a six-month informal review is sensible too. Update the version number and the redistribution date each time. Records of review and reissue are part of what an ICO investigator or external auditor will look for if anything ever goes wrong.

The policy itself sets out that breach may result in disciplinary action, handled through your normal HR process. The more important question is whether the breach is also a UK GDPR data incident - entering client personal data into an unapproved AI tool almost certainly is. In that case the staff member reports immediately to their manager and the DPO, the incident is logged, and you assess within 72 hours whether ICO notification is required. Disciplinary action does not transfer the regulatory liability away from the organisation.