A free AI Acceptable Use Policy template for UK businesses

This is a working policy template, not a marketing document. It includes:

• Approved tools and business-managed accounts - no personal AI subscriptions for work
• Clear data rules - what must never be entered (personal data, client-confidential, credentials, unpublished financials)
• Human review requirements - AI drafts, humans approve anything leaving the business
• Procurement controls - no individual AI purchases without approval
• Shadow AI amnesty - a safe route for staff to disclose existing personal tool use
• Training expectations and breach handling - what to do when something goes wrong
• Ownership, review cycle and sign-off block - ready to implement

UK businesses with 20-500 people where AI tools are already in use, formally or otherwise, and where leadership recognises the need for a written policy but has not yet drafted one. The template references UK GDPR and follows the governance pattern we see working in real SME deployments. It assumes pragmatism over perfection: your goal is to move from unmanaged to managed, not to ban productivity.

The template includes [square bracket] placeholders for your company name, policy owner, approved tools and other specifics. Fill these in, have your senior leadership and legal or compliance function review it, and publish it as a controlled document. The policy is most effective when paired with a Shadow AI amnesty announcement, giving staff a safe window to disclose existing tool use before the rules take effect.

If you need help tailoring the policy to your business, conducting a Shadow AI audit, or training staff to use AI tools safely, that is what our Advisory service does.