AI acceptable use policy template for UK organisations

How to use this template

Copy the headings and wording below into your own document format and adapt them. A few tips:

• Keep it short. Two or three pages that people read beat ten that nobody does. Put the detail (approved tools, data rules per tool) in an appendix you can update without reissuing the whole policy.
• Name real tools. "Approved AI tools" means nothing until you list them. If you do not yet know what is in use, start with shadow AI discovery.
• Match the policy to your controls. Only promise monitoring, redaction or blocking that you actually have in place. The table further down maps each clause to a control.
• Involve the right people. IT, HR, legal and your data protection lead should all review it. If you employ staff in more than one country, local law may change some clauses.

Words in brackets are placeholders: replace them with your own details. This template is general information, not legal advice. For the background to each section, see our guide to the AI acceptable use policy.

Template part 1: purpose, scope, tools and data

1. Purpose "This policy sets out how (organisation name) staff may use artificial intelligence (AI) tools for work. It aims to let us benefit from AI while protecting our clients, our people, our data and our reputation, and meeting our obligations under UK data protection law."

2. Scope "This policy applies to all employees, contractors, temporary staff and anyone else using (organisation name) devices, accounts or data. It covers any tool that generates or analyses text, images, audio, video or code using AI, including AI features built into software we already use, browser extensions, desktop apps, coding assistants and AI agents."

3. Approved AI tools "You may use only the AI tools listed in Appendix A for work. Each entry shows what the tool is approved for and which types of data may be used with it. Sign in with your work account. To request a new tool, contact (role or team); do not start using it until it has been assessed."

4. Personal and free accounts "Do not use personal, free or trial AI accounts for work, on any device. We have no agreement with those providers about how your data is stored, retained or used."

5. Data you must not enter "Unless Appendix A says a tool is approved for it, do not type, paste, upload or connect any of the following to an AI tool: - personal data about customers, clients, colleagues or job applicants - special category data, such as health information - client documents or information covered by a confidentiality agreement - passwords, API keys, tokens or other credentials - source code, configuration files or system details - unpublished financial, commercial or strategic information"

6. Uploads, recordings and meeting assistants "The rules in section 5 apply to files, images, screenshots and recordings as well as typed text. Do not use AI note-taking or transcription tools in meetings unless they are approved in Appendix A and participants have been told."

Template part 2: outputs, agents, incidents and review

7. Checking AI output "You are responsible for any work you produce with AI. Check facts, figures, names, references and legal or technical statements before you use, send or publish them. Do not use AI output as the sole basis for a decision about a person."

8. Agents, extensions and connectors "Do not install AI browser extensions or desktop AI apps, and do not connect an AI agent, plug-in or Model Context Protocol (MCP) server to company email, files, calendars, systems or code repositories, unless it is approved in Appendix A. Approved agents must use the minimum access they need."

9. Coding assistants "Developers may use the coding assistants listed in Appendix A on approved repositories only. Do not include secrets, credentials or production data in prompts, and review AI-generated code as you would any other contribution."

10. Reporting mistakes and incidents "If you think you have entered data into an AI tool that you should not have, or an AI tool has behaved unexpectedly, report it to (role or team) as soon as possible. Prompt reporting helps us reduce any harm and meet any legal duty to report a personal data breach."

11. Monitoring "To protect our data and our clients, (organisation name) monitors the use of AI tools on its devices, networks and accounts. Security controls may show you a warning, remove sensitive data from a prompt or upload, or block an action that breaks this policy. Monitoring is carried out in line with our privacy notice for staff."

12. Training, breaches of policy and review "All staff must complete the AI training provided. Breaches of this policy may be handled under our disciplinary procedure. (Role) owns this policy and reviews it at least (frequency) and after any significant incident or change in the tools we use."

Appendix A: approved AI tools A simple table: tool name, account type, approved uses, data allowed, data not allowed, owner. Keep it current; it changes far more often than the policy.

Map each clause to a control

A policy is only as strong as its enforcement. This table shows how each clause can be backed by a technical control, using capabilities Check Point documents for Workforce AI Security. Desktop apps, coding assistants and agents need the Enterprise tier; Essentials covers AI used through web applications.

In the product, these rules are written as Access policies (whether an AI app is allowed, needs the user to confirm, or is blocked), Chats policies (data loss prevention on prompt content) and Agent policies (MCP servers and tools). Check Point's administration guide lists the policy actions as Allow, Ask, Block, Detect and Prevent, which map neatly onto "approved", "approved with a warning" and "not allowed" in your policy.

Check Point's tier descriptions are short, and features change as the product develops, so we confirm detailed entitlements when we quote. See Essentials vs Enterprise for the comparison.

UK GDPR and ICO points to check

Before you publish, check these points with your data protection lead or legal adviser:

• Lawful basis and transparency. If staff will use approved AI tools with personal data, your privacy notices may need updating to say so.
• Processor terms. Approved tools need suitable contract terms with the provider, including on retention and use of your data for training.
• International transfers. Where an AI provider stores data outside the UK, the transfer rules apply. Our AI and UK GDPR guide covers this.
• DPIA. High-risk processing needs a data protection impact assessment before it starts. See AI DPIA.
• Monitoring staff. Monitoring AI use is monitoring workers. Be open about it, keep it proportionate and check the regulator's current guidance on monitoring workers. Our ICO AI guidance page summarises the ICO's AI work.

The Data (Use and Access) Act 2025 changed parts of UK data protection law, and on 30 September 2026 the ICO's functions passed to the new Information Commission, so check the regulator's current guidance at ico.org.uk rather than relying on older templates. Staff training on data protection is covered by our sister site's GDPR training for staff.

From template to working policy

The template gives you the words. The harder part is deciding what goes in Appendix A and making the rules hold. That is where we help:

• A discovery pilot with Workforce AI Security shows which AI tools, extensions and agents are already in use, so your approved list is realistic.
• We help you set Workforce AI Security policies that match each clause: allow, warn, redact, restrict copy and paste, or block.
• We can help you write the companion AI security policy for your IT and security team.

Ask us for a quote for Workforce AI Security; pricing depends on users, tier and term. To turn this template into a policy you can enforce, contact us.