Sample AI Policy & Risk Pack: United Kingdom
Excerpts from all 8 documents of a real pack, generated for a fictional recruitment agency in the UK with 35 staff that uses ChatGPT Team, the AI CV-screening feature in its applicant tracking system, Grammarly and a website chatbot.
The excerpts are copied word for word from the generated pack. We've left parts out for length, but haven't reworded anything. Your pack is written from your own answers, so it will differ.
Generated on 30 October 2026. A starting point for your organisation to review and adopt, not legal advice.
1. AI Acceptable Use Policy
Which tools staff may use, for what, and with which data.
Approved AI tools and how they may be used
The following tools are approved. No other AI tool may be used for organisation work.
AI CV-screening feature in the [INSERT ATS PRODUCT NAME] applicant tracking system
- May be used for: ranking and screening candidate CVs to produce shortlists for Recruiter review.
- MUST NOT be used for: making final decisions about candidates, drafting or sending candidate correspondence, or scoring candidates on interview notes.
- May receive: CVs, contact details and vacancy criteria taken from client hiring requirements.
- MUST NOT receive right-to-work documents, diversity monitoring data or interview notes as scoring inputs.
Grammarly
- May be used for: proofreading and tone checks on non-confidential job advert text and template emails.
- MUST NOT be used for: checking anything that contains a named candidate or a confidential client brief.
- May receive: non-confidential job advert text and template emails.
- MUST NOT receive: CVs, contact details, right-to-work documents, diversity monitoring data, interview notes or confidential client hiring requirements.
Prohibited uses
- Using AI output as the final decision on whether a candidate progresses, without a Recruiter's review of the shortlist. An AI ranking is a recommendation for review.
- Pasting a client's confidential hiring brief into ChatGPT Team to draft an advert. The Marketing Lead should instead use a job description with the client name removed.
- Uploading or exporting diversity monitoring data from the applicant tracking system into any AI tool, including a general-purpose tool used for analysis.
Excerpt. Other parts of this document are left out.
2. AI Risk Checklist
Yes/no questions across ten risk areas, each with the action to take if the answer is no.
Data privacy
- Are CVs, contact details, right-to-work documents, diversity monitoring data, interview notes and client hiring requirements kept out of ChatGPT Team? If no: stop using ChatGPT Team for that task, report the input to the Operations Manager within 1 business day, and remove any copied material. Responsible: Operations Manager.
- Are diversity monitoring exports from the applicant tracking system kept out of ChatGPT Team, Grammarly and the website chatbot? If no: remove the exported file from the tool, confirm the deletion in writing, and tell the HR and Compliance Coordinator. Responsible: Operations Manager.
- Has the quarterly access review of all ChatGPT Team and applicant tracking system accounts been completed, with leavers removed? If no: complete the review now and disable any account that is no longer needed. Responsible: Operations Manager.
Excerpt. Other parts of this document are left out.
3. AI Risk Register
15 risks in this pack, drawn from the organisation's own AI use. Three are shown. Also downloadable as an Excel file.
| Risk description | Context / Relevance | Potential impact | Likelihood (Low / Medium / High) | Existing or recommended controls | Owner |
|---|---|---|---|---|---|
| R2: A recruiter pastes a client's confidential hiring brief into ChatGPT Team to draft a job advert. | ChatGPT Team is used for job advert drafting. Client hiring requirements are on the never-enter list for ChatGPT Team. | Breach of client confidentiality. Loss of client trust and contract damage. Exposure of client data outside approved tools. | Medium | ChatGPT Team receives only blank templates and job descriptions with client names removed. Marketing Lead checks every advert against client requirements before publication. | Marketing Lead |
| R4: The website chatbot gives a candidate incorrect information about right-to-work checks. | The chatbot answers candidate questions in real time without review. Visitors may type personal details into it. | Candidates act on wrong eligibility advice. Placements are delayed and complaints follow. Chatbot may request or store personal data it should not handle. | Medium | Marketing Lead reviews 10 chatbot transcripts monthly. Right-to-work answers are confirmed by HR and Compliance Coordinator. Chatbot must never request CVs, contact details or right-to-work documents. | Marketing Lead |
| R5: An AI-drafted job advert uses age-coded or gendered wording for a client vacancy. | ChatGPT Team drafts adverts and Grammarly checks tone. Adverts for client vacancies are published under the company's name. | Applicants are discouraged from applying. Discrimination complaints. Client and company reputational damage. | Medium | Marketing Lead checks 100% of AI-drafted adverts against client requirements and bias wording before publication. Marketing Lead samples 5 Grammarly-checked documents quarterly. | Marketing Lead |
Excerpt. Other parts of this document are left out.
4. Transparency & Disclosure Notices
When to tell customers, staff and suppliers about AI use, with wording to adapt.
Ready-to-use notice wording
Website chatbot notice:
You are chatting with an AI assistant. It can answer general questions about our current vacancies and recruitment process. It cannot see your CV or personal details, and it cannot confirm your right-to-work status. For anything about your application or eligibility, please contact a member of our team at [INSERT RECRUITMENT CONTACT EMAIL].
Candidate application notice:
Our applicant tracking system includes an AI feature that ranks applications against the vacancy criteria agreed with the client. A Recruiter reviews every shortlist before any candidate is contacted. Applications that are not shortlisted are sampled regularly for quality checks. If you have questions about how your application was assessed, please contact us at [INSERT RECRUITMENT CONTACT EMAIL].
Excerpt. Other parts of this document are left out.
5. Rollout Plan and Adoption Guide
Why the pack exists, who owns it, and what to do in the first 30 days, within 90 days and ongoing.
Purpose of this pack
This pack makes those uses visible, sets the limits on them, and names who checks what and how often. Its practical value is that when a candidate, client or manager asks why a shortlist looked the way it did, the organisation can show which tool was used, what data went into it, who reviewed the output, and what was done when something went wrong.
The pack is written for a firm of 11-50 people where most decisions sit with a small number of people. It does not create committees or add reporting layers. Each control is sized so that one busy manager can carry it out within an hour a month.
First 30 days
- Confirm the Managing Director as owner of this pack and of the AI Risk Register, and approve the list of AI tools in use (Owner: Managing Director)
- Create and maintain an inventory of all AI tools in use, covering ChatGPT Team, the CV-screening feature, Grammarly and the website chatbot (Owner: Operations Manager)
- Confirm that no CVs, contact details, right-to-work documents, diversity monitoring data, interview notes or client hiring requirements have been entered into ChatGPT Team or Grammarly, and remove any that have (Owner: Operations Manager)
- Restrict ChatGPT Team and applicant tracking system accounts to named staff, and enable multi-factor sign-in where each product supports it (Owner: Operations Manager)
- Deliver the 60-minute induction to all staff before they continue using AI tools (Owner: HR and Compliance Coordinator)
Excerpt. Other parts of this document are left out.
6. AI Tool Inventory
Each approved tool with its uses, owner, data rules and review frequency.
| Tool | Approved uses | Business owner | Data rules | Review |
|---|---|---|---|---|
| AI CV-screening feature in the [INSERT ATS PRODUCT NAME] applicant tracking system | Ranking and screening candidate CVs to produce shortlists, reviewed by a Recruiter before any candidate contact | Recruitment Manager | May: CVs, contact details and vacancy criteria taken from client hiring requirements; Never: right-to-work documents, diversity monitoring data or interview notes as scoring inputs. | Access quarterly (Operations Manager); bias and fairness review quarterly (HR and Compliance Coordinator); vendor review annually (Operations Manager) |
| Grammarly | Proofreading and tone checks on job adverts and written correspondence | Marketing Lead | May: non-confidential job advert text and template emails; Never: CVs, contact details, right-to-work documents, diversity monitoring data, interview notes or confidential client hiring requirements. | Sample of 5 documents quarterly (Marketing Lead); vendor review annually (Operations Manager) |
Excerpt. Other parts of this document are left out.
7. Staff Acknowledgement Form
Signed by each person before they first use an AI tool.
I confirm that I have read the AI Acceptable Use Policy and that:
- I will use only the AI tools listed in the AI Tool Inventory, and only for the uses shown against each tool.
- I will not enter CVs, contact details, right-to-work documents, diversity monitoring data or interview notes into ChatGPT Team, Grammarly or the website chatbot.
- I will not enter client hiring requirements into ChatGPT Team or the website chatbot, and I will not enter confidential client hiring requirements into Grammarly.
- I will use the AI CV-screening feature only with CVs, contact details and vacancy criteria taken from client hiring requirements, and never with right-to-work documents, diversity monitoring data or interview notes as scoring inputs.
Name: ____ Role: ____ Signature: ____ Date: ____
Excerpt. Other parts of this document are left out.
8. Management Summary
One page for leaders: the main risks, the decisions needed and the review dates.
This pack puts in place:
- Four approved tools: ChatGPT Team, the AI CV-screening feature in the [INSERT ATS PRODUCT NAME] applicant tracking system, Grammarly and the website chatbot ([INSERT CHATBOT VENDOR NAME]).
- Checks on every AI-drafted advert before publication (Marketing Lead), a quarterly 5-document Grammarly sample and a monthly 10-conversation chatbot transcript sample (Marketing Lead).
- Quarterly access reviews and annual vendor reviews (Operations Manager), and a quarterly aggregated bias and fairness review (HR and Compliance Coordinator).
- Incident reporting to the Operations Manager within 1 business day, with closure within 10 business days (Operations Manager).
Excerpt. Other parts of this document are left out.