Free PDF · No signup · UK
Download the PDF. Print it. Bring it to your next leadership-team meeting.
What's inside
- Purpose, scope and effective date. Standard policy header — search-replace the placeholders, you have a policy.
- Approved tools and tiers. Pre-populated table of common AI tools by tier (Enterprise / Team / Plus / Free) with permitted-use guidance per tier.
- Data tier definitions. Four data tiers from Public to Restricted, with permitted AI tool use per tier. The conversation-stopper for staff who weren't sure where the line was.
- Prohibited use clauses. Specific, enforceable — pasting personal data into non-enterprise tiers, automated decisions about individuals without human review, external sharing without review.
- Operating procedures. Custom GPT / agent approval, output disclosure, human-in-the-loop requirements, incident response.
- Governance and sign-off. Ownership, breach process, training, audit cadence, staff acknowledgement form.
Who this is for
UK businesses where staff are already using AI tools (formally or informally) and a written policy needs to retro-fit governance onto that reality. Particularly relevant for regulated sectors and businesses with client-confidentiality obligations.
How to use this
Search-replace placeholders ([Company], [Policy owner], [Effective date]). Decide your tier strategy — provisioning enterprise tooling for everyone, restricting tooling to specific cohorts, or banning consumer tiers entirely. Publish, require sign-off, train, review annually.
Frequently asked
Is this template legal advice?
No. It's starting-point policy language drafted from patterns Arx Certa sees in real UK engagements. Have it reviewed by qualified counsel before final adoption, particularly if you operate under sector regulation (FCA, SRA, ICAEW, etc.).
Should this be one policy or part of our wider IT policy?
Either works. Most UK businesses end up with a standalone AI usage policy because the rules are distinct enough (data tiers, vendor handling, human-in-the-loop) that bundling them dilutes both documents.
How does this template handle ChatGPT specifically?
The template covers ChatGPT and equivalent generative AI assistants in one go. If you want a ChatGPT-specific deep-dive, the dedicated ChatGPT Usage Policy Template (A7) goes further into tier-specific guidance and Custom GPT governance.
Do we need separate policies for Copilot?
Copilot warrants a section, not necessarily a separate policy. It has tenant-level considerations the general template doesn't drill into — the dedicated Copilot Readiness Checklist (A6) addresses those.
How often should we review this?
Annually as a minimum, plus on any material trigger — new tool added, vendor terms change, sub-processor disclosure changes, regulatory guidance updates.
Related Arx Certa services
If the gaps this resource surfaces for your business need outside help to close:
- AI services — implementation reviews, AI policy work, vendor due diligence, and pilot scoping.
- Cybersecurity — security overlay for AI use, UK GDPR / NCSC alignment, vendor risk assessment.
- Database — data foundations work AI projects depend on.
- Infrastructure — cloud, identity, network and integration foundations.
Score your AI readiness in 4 minutes
The Arx Certa AI Readiness Scorecard quantifies the foundations this resource describes — across governance, data, infrastructure, security and use case. Free, 12 questions, personalised report.
Get your AI readiness score →