Generative AI Usage Policy
Generative AI use in business is rapidly increasing, particularly for generating content of all kinds, but also in decision-making activities. While not yet regulated directly by law, the use of AI touches on many areas of regulation including intellectual property and data protection. It must be used with care and due diligence to balance the exciting new possibilities with legal compliance and risk-avoidance. The policy template in this sub-folder is designed to assist businesses in establishing rules and guidelines governing the use of this emerging technology.
Generative AI Usage Policy is part of Business . Just £38.50 + VAT provides unlimited downloads from Business for 1 year.
Frequently Asked Questions
My staff are already using AI tools like ChatGPT, do I need a policy?
Yes, a usage policy is sensible. Generative AI is not yet governed by a single dedicated UK law, but its use touches intellectual property, data protection, confidentiality and accuracy, and unmanaged use creates real risk. A policy sets clear rules on what tools staff may use, what they must not enter, how to check outputs and who is accountable. This template gives you that framework so you can enable AI use with guardrails rather than banning or ignoring it.
Who owns content my business creates using generative AI?
It is uncertain, which is why the policy matters. UK law has a provision for computer-generated works with no human author, treating the person who made the arrangements for creation as the author, with 50 years of protection and no moral rights. But protection is not guaranteed, because copyright normally needs human originality, and AI output may also reproduce third-party material. So do not assume you own or can freely use AI output. The policy sets rules on checking and recording AI use.
Can putting company or customer data into an AI tool cause a data protection problem?
Yes, easily. Entering personal data into a public AI tool can be an unlawful disclosure under the UK GDPR and Data Protection Act 2018, and entering confidential business information can breach confidentiality obligations. Once submitted, you may not control how the data is stored or reused. A generative AI policy should prohibit entering personal or confidential data into unapproved tools and set out what is safe to use. This template addresses exactly that risk.
Is generative AI regulated by a specific law in the UK?
Not by a single dedicated AI law. The UK has taken a principles based, sector led approach rather than one AI statute, so AI use is governed by existing law: intellectual property, data protection, confidentiality, equality and consumer law, with sector regulators layering rules on top. That means the risks are real even without an AI Act. A usage policy is how you apply those existing rules to day to day AI use. This template is built for that.