ChatGPT policy for employees: what to include

Say which tools and accounts staff may use

Start by naming the tools staff may use for work, and which kind of account. The difference between accounts matters: OpenAI says that, by default, it doesn't use data from its business offerings, such as ChatGPT Business, ChatGPT Enterprise and its API, to train or improve its models. Personal accounts have their own settings, which each person controls.

Regulators take the same approach with their own staff. The UK's data protection regulator, the ICO, publishes its internal AI use policy, which says staff should only use AI tools the ICO has approved for internal use.

A policy usually covers:

• the approved tools, and whether staff must use a work account rather than a personal one;
• who approves a new tool, and how staff ask for one;
• what to do about tools that aren't on the list (usually: don't use them for work until they're approved).

Set out what information may go in

This is the part of the policy that prevents the most harm, and privacy regulators agree on the direction. Australia's privacy regulator, the OAIC, recommends as best practice that organisations don't enter personal information, and particularly sensitive information, into publicly available generative AI tools, and says privacy obligations apply to any personal information put into an AI system. The ICO's internal policy requires permission through its own governance process before staff use AI with personal, sensitive or confidential information. Data protection laws such as the GDPR and UK GDPR apply to personal data put into these tools in the same way they apply anywhere else.

A practical way to write this is three short lists:

• Never: customers' or staff members' personal information, health or financial details, passwords and access keys, and confidential client documents.
• Only after removing names and other identifying details: for example, a customer complaint you want help replying to.
• Fine: public information, general questions, and your own drafts that contain none of the above.

Adjust the lists to the account type. An approved business account may be allowed to receive more than a personal one, if your organisation has checked its terms and settings.

Require people to check the output

Generative AI can give confident answers that are wrong. The OAIC's guidance notes that AI systems are known to produce inaccurate or false results, and the ICO's internal policy says all AI outputs should be reviewed by a person, who checks that the output is accurate, unless agreed otherwise. The policy should say that the person using the tool is responsible for what they do with its output, and scale the checking to the risk:

• internal drafts and brainstorming: a normal read-through;
• anything sent to customers or published: checked by the person sending it, with facts and figures verified;
• anything that affects decisions about people, or legal, financial or health matters: reviewed by someone with the right expertise before it's used.

Decide when to tell people AI was used

Most internal drafting doesn't need a label. The ICO's internal policy, for example, marks content that's substantially or wholly AI-generated, but not drafts or summaries a person has substantially edited or thoroughly reviewed. Customer-facing use is different. The OAIC says public-facing AI tools such as chatbots should be clearly identified as AI, and in the EU, people must be told when they interact with an AI system such as a chatbot (see the EU transparency entry in our AI regulations tracker). For the rules where you are, see the AI regulations tracker.

Write down the cases where your organisation will say AI was used, for example chatbots, and AI-generated images that could be mistaken for real ones.

Cover training and how to report problems

A policy only works if people know it. A short induction before staff first use the tools, and a refresher when the tools or rules change, is usually enough for general use. Our guide to AI training for staff covers what to include and how to keep a record.

Say how to report a mistake, such as personal information pasted into the wrong tool, and who to report it to. People report problems sooner when the policy makes clear that reporting is expected.

A simple outline

1. Purpose and who the policy applies to
2. Approved tools and accounts
3. What information may go in
4. Checking AI output
5. Telling people when AI was used
6. Training
7. Reporting problems
8. Who owns the policy, and when it's reviewed

Keep it short enough that people will read it, and review it when you add a tool or the rules change. If you'd like a starting point, the free AI policy generator writes a short policy along these lines from a few answers.

Sources

• OAIC: Guidance on privacy and the use of commercially available AI products (updated 17 January 2025)
• ICO (UK): Internal AI use policy, version 1.3 (applies from August 2025)
• OpenAI: Business data privacy, security, and compliance

This article is general information, last checked against these sources on 30 October 2026. It isn't legal advice. For advice on your situation, speak to a qualified adviser.