AI policy template for UK organisations

An AI policy sets the rules for how people in your organisation use AI tools: which tools, for what, with which information, and who checks the results. Here's what it should cover in the UK, and how AI is regulated there.

How AI is regulated in the UK

The UK has no AI Act, and no AI bill was before Parliament as of mid-2026. AI use is governed by existing law, such as UK GDPR and the Data Protection Act 2018, and by sector regulators.

The Data (Use and Access) Act 2025 changed the rules on automated decision-making from 5 February 2026. Significant automated decisions using personal data need safeguards, such as telling people and letting them contest the decision.

A general summary, checked on 27 October 2026 against the sources in the regulations tracker. It isn't legal advice.

What to focus on in the UK

Personal data

Which AI tools may process personal data, under which account, and what must never be entered.

Automated decisions

Which significant decisions involve AI, how people are told, and how they can ask for human review.

Approved tools

A list of approved tools with an owner each, and how staff ask for a new one.

Staff training

A short induction before first use, and a record that staff have read the policy.

What a complete AI policy covers

Purpose and scope

Why the policy exists and who it applies to: staff, contractors, any device used for work.

Approved tools

Which AI tools are approved, what each may be used for, and who owns each one.

Data rules

What information may go into each tool, what never may, and what must be removed first.

What isn't allowed

Uses that are off limits, with examples from your own work.

Checking AI output

Who checks AI output before it's used, and how much, scaled to the risk.

Transparency

When customers, staff or others are told that AI was used.

Incidents

How to report a mistake or misuse, to whom, and how quickly.

Training and review

Training before first use, a signed acknowledgement, and when the policy is reviewed.

Start with a free AI policy

Answer a few questions and get a short AI use policy for your organisation, free to copy or download as a Word document. No account needed.

Need more than a policy?

The AI Policy & Risk Pack is written from your answers about how your organisation uses AI, for the UK. Preview every section free before you pay. It's a starting point to review and adopt, not legal advice.

AI Acceptable Use Policy
AI Risk Checklist
AI Risk Register
Transparency & Disclosure Notices
Rollout Plan and Adoption Guide
AI Tool Inventory
Staff Acknowledgement Form
Management Summary

£75£149per project, one-time

Launch price for the first 20 packs sold: 13 of 20 left. Then £149.

Prices in pounds sterling. For businesses: a VAT number is needed at checkout.

AI rules to know in the UK

All entries

In forceIn force since 5 February 2026

Data (Use and Access) Act 2025: new rules on automated decision-making

The UK GDPR's rules on automated decisions changed. The general prohibition now applies only to significant decisions based entirely or partly on special category data. For other significant automated decisions using personal data, safeguards apply, such as telling people and letting them contest the decision. Organisations must also be able to handle data protection complaints directly, from 19 June 2026.

Questions

Is an AI policy required by law in the UK?

No general law requires a document called an AI policy. But UK GDPR applies whenever staff put personal data into AI tools, and a written policy is a common way to set the rules for doing so.

Does the UK have an AI Act?

No. As of mid-2026 the UK has not passed an AI Act and no AI bill was before Parliament. AI is regulated through existing law and by sector regulators.

Does the pack use UK spelling and prices in pounds?

Yes. Packs for UK organisations use UK spelling and date formats, and prices are shown in pounds sterling. UK checkout is for businesses, with a VAT number.