Do we need an AI policy, and what goes in it?
By Gary Dhanda · 3 November 2026 · 4 min read
Short answer
No UK rule tells a small firm to have a written AI policy, as far as we have found. You should still have one. Your staff are probably using AI already, and a short policy tells them what is allowed, what is not, and who to ask.
Why write one at all
Data protection law applies to AI tools in the same way as to any other system. The ICO says that people using generative AI with personal data should settle a lawful basis, assess risk before they start, and think about security. A written policy is how a small firm shows it has done that thinking.
Regulated professions go further. The Law Society publishes guidance for solicitors on generative AI. If you belong to a professional body, read its guidance first and write your policy to fit it.
What goes in a one-page policy
Approved tools. Name the tools and the plans your firm pays for. Say that personal accounts are not approved for work.
Data rules. List what may never be pasted in, and what may be used with care. Include client personal data, confidential material and credentials.
Checking. Say who reads AI output before it goes to a client, and what they check. AI tools can state wrong things with confidence, so a named person must take responsibility for the final version.
Records. Say where prompts and outputs for client work are kept, if they need to be kept at all.
Disclosure. Say what you tell clients about your use of AI. This differs by profession and by contract, so check yours.
When something goes wrong. Say who to tell and how fast. If personal data has been exposed, the ICO's rules on reporting a breach apply, and the clock can start when you become aware of it.
Review date. Put a date in the policy. Tools and plans change, and an unreviewed policy goes out of date quietly.
What not to copy
Long policies written for large organisations do not suit a team of ten. Nobody reads them, and they drift from what people actually do.
The government's AI Management Essentials tool is sometimes suggested as a template. In its response of December 2025, the Department for Science, Innovation and Technology said it would not publish it, so we do not recommend building on it.
How to roll it out
Write the first version in an afternoon. Share it with the team and ask what is missing. Run a 20-minute briefing with real examples, such as an email draft and a client summary. Set a review for three months out, then every six months.
Judge it by two things: whether people can say what is allowed without looking it up, and whether you have found any use of unapproved tools. Check both at the first review.
Where this leaves you
A policy does not remove the risk. It makes the rules clear and gives you something to improve. Start with the data rule: see is it safe to put client data into ChatGPT, Claude or Copilot.
This is a general guide, not legal advice. If you would like a draft policy shaped to your firm, get in touch through our Contact page.
Sources
ICO, 'Generative AI: eight questions that developers and users need to ask', Stephen Almond, 3 April 2023, ico.org.uk. Read 3 November 2026.
Department for Science, Innovation and Technology, 'AI Management Essentials tool: government response', gov.uk, December 2025. Read 3 November 2026.
Law Society of England and Wales, 'Generative AI: the essentials', lawsociety.org.uk, updated September 2025.