October 2026 update — the regulator has a new legal form, and your policy needs a named owner. On 30 September 2026 the ICO became the Information Commission under the Data (Use and Access) Act 2025. Its functions and enforcement powers carry over unchanged and it is still called the ICO, so your duties are the same. There is still no standalone AI Bill: UKSI 2026/425 (in force 12 May 2026) requires a binding statutory code of practice on AI and automated decision-making, expected in 2027, and final guidance is still due in winter 2026. Expect to need a named executive accountable for AI risk and a DPIA for most AI use of personal data. Microsoft has added Grok (SpaceXAI) to Copilot as an off-by-default model choice, and SpaceXAI now sits on Microsoft’s sub-processor list. It is a Frontier preview and is not available in the UK, EU or EFTA, so most UK tenants have nothing to switch off. But an approved tool gained a new sub-processor without anyone deciding anything. A named owner who reads that list catches it.
AI adoption is moving faster than policy. Right now, across most UK businesses, employees are using ChatGPT, Copilot, and other AI tools with minimal oversight. Some are sharing sensitive client data. Some are pasting entire contracts into consumer-grade AI. The fix isn't to ban AI — it's a pragmatic AI usage policy.
Recent changes in the AI landscape underline why this matters more than ever. With Microsoft Copilot Chat's April 2026 restrictions on free-tier access, organisations can no longer assume employees have unlimited access to consumer tools. That means policy and planning become essential — you need to decide explicitly which tools your teams will use, for what purposes, and under what constraints.
Data leakage through consumer-grade AI. If an employee uses free ChatGPT to process business data, that data is sent to third-party servers, potentially used for model training, and isn't covered by any data processing agreement. GDPR compliance just went out the window.
Inconsistent or unreliable outputs being delivered to clients. When there's no defined process for AI-assisted work, some teams review AI outputs carefully. Others don't.
Hidden IP and confidentiality problems. An employee pastes proprietary process documentation into an AI tool. An architect copies a contract template into a generative AI. Each creates risk.
Compliance and regulatory exposure. If you operate in a regulated industry and your people are using AI without governance, you've probably already violated your obligations.
Define categories: "Approved for brainstorming" (ChatGPT, Copilot). "Approved for data processing" (enterprise tools with DPAs). "Not approved" (any tool without clear data handling commitments).
Your policy should clearly state: "Client data cannot go into unapproved AI tools." Use your existing data classification and map it directly to what can be processed where.
This depends on risk. For marketing content, the review might be quick. For client-facing deliverables, the standard should be higher. For regulated work, much higher still.
"Client data must not be processed by any external AI tool without explicit written consent and a data processing agreement." It's not negotiable under GDPR.
If you want a section-by-section walkthrough with a copy-paste starter, follow our AI usage policy template how-to guide — it turns the principles below into a document you can adapt in an afternoon.
Start with a real conversation. Ask teams what they're actually doing with AI right now.
Make approval criteria, not restrictions. Instead of "you can't use X," say "you can use X for Y types of work, with these constraints."
Keep it operational. Your policy should be a checklist an employee can actually use.
Build in an exception process. Make it easy to ask for an exception rather than ignoring the policy.
Review it regularly. Schedule a review every quarter or six months, and give one named person the job of checking the sub-processor lists of your approved tools in between, because those change more often than your policy does.
A note on enforcement: A policy is only useful if people actually follow it. This means training, making the tools easy to use appropriately, and creating a culture where breaking the policy feels risky.
You don't need to choose between embracing AI and protecting your business. A simple, clear, operational AI policy does both. Without a policy, you have unmanaged AI adoption. With a pragmatic one, you have managed risk and ongoing productivity benefit.
We can help you design a pragmatic policy that sets clear boundaries while enabling your team to use AI effectively.
Get in Touch