An AI acceptable-use policy your team can put into practice

A useful AI policy helps a colleague answer a practical question: “Can I use this tool for this piece of work, and what do I need to check?” Start there and you can give people room to experiment with a clear route to responsible use.

For a business or charity, the policy can connect everyday tasks with the information, permissions and judgement they need. The aim is a shared way of working that colleagues can understand, apply and improve.

Start with the work your team wants to do

Bring a few realistic tasks into the discussion. A colleague may want help drafting a public event description, summarising approved guidance or organising ideas for a funding application. Another may want to process a service-user record. Those tasks need different decisions, even if the same tool could attempt them.

For each task, describe the purpose, the information involved, who will use the result and what happens next. Include volunteers, contractors and temporary staff where they use your systems. Ask people where the current rules leave them uncertain.

This gives your policy a useful structure: work people can do within agreed conditions, work that needs approval and work that is outside the permitted scope. Treat those as decisions for your organisation, with advice from the people responsible for information, security and the relevant service.

Make approval specific enough to follow

Keep a short, accessible list of approved tools and accounts. Record the uses each approval covers, the information allowed and who owns the decision. A tool name alone leaves too much unanswered: permission to draft public copy does not automatically cover uploading private documents or connecting a shared mailbox.

Explain how someone requests a new use. Ask for the intended outcome, information required and proposed checks, then give them a named contact or working approval route. Make it possible to suggest a useful idea without quietly adopting an unreviewed service.

Check the actual product, account settings and supplier terms before approving a use. Avoid broad assumptions such as “paid tools are private” or “removing names makes any record safe”. Your policy should point to the organisation's agreed information-handling rules and the review needed for exceptions.

Show what good use looks like

Consider this illustrative charity example. A volunteer wants help writing an invitation to an open event. Under a suitable local approval, they could use the agreed tool with the published event details, then check the date, accessibility information and booking link before sharing the text.

The same volunteer wants to make the invitation more personal by uploading a spreadsheet of service users and their circumstances. That is a different proposed use. The policy should direct them to the responsible person before transferring that information, and offer an approved way to complete the task.

Write examples around decisions your colleagues actually face. Pair each boundary with a route forward: use public information, use a synthetic example, ask the information owner or keep the task in an existing approved system. This helps the team apply the rule without having to interpret a long list of abstract risks.

Define the check and the person responsible

“Check the output” needs a little more detail. For public copy, name the person who verifies factual details and approves release. For a summary, ask the reviewer to compare it with the source and look for omissions. For work affecting someone's access to a service, agree the appropriate decision and review process before introducing AI.

The UK Government AI Playbook discusses meaningful human control and documented review and escalation arrangements. It is guidance for government organisations; businesses and charities can use it as a reference when designing their own arrangements, rather than treating it as a rulebook that automatically applies to them.

Give reviewers enough time, access to the source and authority to change or stop the result. Connect this to your AI oversight and review arrangements so responsibility continues after a tool is introduced.

Make questions and problems easy to raise

Explain what to do if someone enters information into the wrong tool, finds a misleading answer or notices an unexpected action. Point them to the existing incident process and a contact who can help. Ask for enough detail to investigate without encouraging people to copy sensitive material into another channel.

Give the policy an owner and a review date. Also identify changes that should prompt an earlier review, such as a new integration, changed supplier terms or a proposed use involving different information.

Australia's National AI Centre offers a useful policy guide covering permitted uses, approvals, information, oversight and reporting. Its advice to adapt and test a policy with the people who will use it is a practical starting point; its Australian context does not establish UK legal compliance.

Try the policy before you finalise it

Give colleagues three ordinary scenarios and ask them to find the next step using the draft policy. Note where they disagree, cannot find an answer or need someone who is not available. Improve those parts, then introduce the policy alongside a short demonstration and a clear place to ask questions.

Bring one useful task, your current tool list and the information rules you already follow. Use those to shape AI policies and acceptable use within your wider AI governance, with clear decisions your team can put into practice.