Guides
What goes in a staff AI policy
Checked 9 November 2026 against the pages linked in the text. This is a reading of those public sources for a buyer. It is not legal advice, and it is not your regulator's rule unless the paragraph says so.
Name the tools people may use, the data they may not paste, who checks the output before it is relied on, and who to ask when a case is unclear. Those four decisions are how a firm makes UK GDPR Article 5 work on a Tuesday. They are not a form prescribed by statute. A policy that skips them leaves staff to guess.
Which tools are allowed, and who may add a new one?
The policy should list the tools the firm has actually looked at, and say that a new tool waits until someone named in the policy has accepted it. Article 5(2) requires the controller to be able to demonstrate compliance. A named owner is the simplest way to show that a choice was made. For a RICS-regulated firm the bar is higher and specific: section 3.2 of the RICS standard requires a written register of AI systems that have a material impact, and policies that set out roles and liabilities. That register is the right home for the approved list. Other firms can copy the habit without pretending the RICS duty applies to them.
What must staff not paste?
Anything that is personal data, unless the firm has already settled a lawful basis under Article 6, kept to the purpose and the minimum under Article 5, and, where a supplier processes the data for you, put an Article 28 contract in place. Security under Article 32 still applies. The client data guide walks through those articles. Write the examples staff will recognise: a client letter, a CV, a payroll row, a pupil's name, a patient's detail. "Use your judgement" is not an instruction.
Three sectors already have a tighter public rule, and the policy should point at the one that applies instead of inventing a blend.
- Solicitors: the SRA warning notice of 17 August 2026 says client information should only go into an AI system where contractual, technical and organisational safeguards are in place, and that the solicitor stays accountable for the output. See the law firms page.
- RICS members and RICS-regulated firms: section 3.1 says private and confidential data is not uploaded without express written consent in advance and a satisfactory risk check. See the RICS page.
- Schools and colleges in England: the DfE guidance updated 12 August 2025 recommends that personal data is not used in generative AI tools, and says staff remain responsible for the document. See the schools page.
- Accountancy practices: the accountancy page covers the practice pack. Personal data is covered by the UK GDPR articles above.
Who checks the output before it is used?
A named person, before the text is sent, filed or put in front of a client. The statute does not say the tool is the author. The SRA notice says the solicitor remains accountable. DfE says the professional and the organisation remain responsible for the final document. Section 4.2 of the RICS standard requires a written reliability decision for a material output, by or under a named surveyor, with dip samples where the volume is high. A staff policy can say, in one line, "nothing leaves the building until a person has read it", and then point regulated staff at the stricter rule for their profession.
What else is worth writing down?
How someone reports a mistake the same day, including a suspected personal data breach as defined in Article 4(12): a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Where the policy lives, and the date it will next be read. For RICS-regulated firms the standard already sets at least annual training and a quarterly risk-register review. Those intervals are not a general legal requirement for every other employer. Set a date anyway, because Article 5(2) is hard to demonstrate from a policy nobody has opened since it was drafted.
A hypothetical example. A four-person team wants to paste a named pipeline into a chatbot to tidy it. The paste rule answers that without a meeting: names and notes about living people stay out unless the basis, the purpose and any processor contract are already agreed. The draft the team is allowed to make comes from notes with the names removed, and a person reads it before it is stored. That illustrates the articles above.
A workshop can draft this document with the people who will have to follow it. The published half day is £950 and the full day is £1,450, on the AI training page. Bringing the draft into force is the firm's decision, not a result the session can promise.