[Business name]: how we use AI
This policy applies to everyone who works for [Business name], including contractors. It was agreed on [date] and will be reviewed by [name] on [review date].
The tools we’re allowed to use
- [The AI tools you approve, on business accounts only.]
Don’t use personal accounts of any AI tool for work, even for something quick. Personal accounts may keep what you type and use it to train their models. If you want to try a new tool, ask [name] first.
What AI is good for here
- First drafts of emails, letters and proposals.
- Summarising long documents and meeting notes.
- Pulling details out of documents into a spreadsheet or system.
- Tidying up rough notes into clear, readable documents.
What you must never put into an AI tool
- Passwords, access codes or bank login details.
- Commercially sensitive information, such as prices agreed with customers or suppliers.
- Anything a customer has asked us to keep confidential.
A person checks before it goes out
AI makes confident mistakes. Before anything AI helped with goes to a customer, supplier or regulator, the person sending it checks that it’s accurate and takes responsibility for it. Anything involving money, prices, contracts or legal matters is always checked by our [role].
Being open about it
If a customer asks whether AI was used, tell them.
Personal data and the law
We follow UK GDPR. Before we use AI on personal data in a new way, [name] checks whether we need to, what the tool does with the data, and where it’s stored. We keep a short list of the AI tools we use and what data each one touches.
If something goes wrong
If you think personal or confidential information has gone into the wrong tool, or AI has produced something harmful, tell [name] straight away. You won’t be in trouble for reporting it quickly. We may need to tell the Information Commissioner’s Office within 72 hours.
Agreed by [name], [role], on [date].