# Does your UK business need an AI policy, and what goes in it?

If staff use AI tools at work, a policy is how your business decides what goes into them.

The Assurance Desk. Published 29 September 2026. Last checked 13 October 2026.

**The short answer.** Probably, if your staff use AI. Put four things in the policy: the tools staff may use, the data that must never go in, one named owner, and how to ask for a new tool. UK GDPR already covers AI that uses personal data, and the UK's data protection regulator, the [Information Commission](/news/ico-becomes-the-information-commission) (the ICO), says a business needs to align its policies, roles and training with its AI governance and risk management strategy (the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), 15 March 2023, checked 29 September 2026).

## In this series

- [Can staff paste client data into ChatGPT or Copilot?](https://theassurancedesk.com/guides/staff-client-data-chatgpt-copilot.md)
- [Who can write your AI policy?](https://theassurancedesk.com/guides/who-can-write-your-ai-policy.md)
- [A DPIA for an AI tool: when and how](https://theassurancedesk.com/guides/dpia-for-an-ai-tool.md)

## Is an AI policy a legal requirement in the UK?

No UK law cited in this guide requires a document called an AI policy. But UK GDPR covers AI that uses personal data, and the ICO, the UK's data protection regulator, says a business needs to align its policies, roles and training with its AI governance and risk management strategy (the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), 15 March 2023, checked 29 September 2026).

The ICO became the Information Commission on 30 September 2026, and is still known as the ICO ([the ICO](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-welcomes-transition-to-new-information-commission-and-marks-new-chapter-with-manchester-head-office-opening/) and [legislation.gov.uk](https://www.legislation.gov.uk/uksi/2026/1015/made), checked 2 October 2026).

The ICO's AI guidance, last updated on 15 March 2023, is under review because of the UK's Data (Use and Access) Act 2025. It says that in the vast majority of cases, AI that uses personal data is likely to result in a high risk to people's rights and freedoms, so that use needs a data protection impact assessment, or DPIA (the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), 15 March 2023, checked 29 September 2026).

Since 5 February 2026, new UK GDPR rules have replaced the old rules on decisions made by computer with no meaningful human involvement. If such a decision significantly affects a person, you must tell them about it and let them comment, ask for a human to step in and challenge it (legislation.gov.uk, [SI 2026/82](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/made) and [section 80](https://www.legislation.gov.uk/ukpga/2025/18/section/80), checked 29 September 2026).

> "Whatever choices you make, you need to be accountable for them."
> ICO, AI accountability guidance
> The ICO, guidance on AI and data protection, 15 March 2023, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/ (checked 29 September 2026)

## What is the smallest AI policy that works?

The smallest AI policy that works fits on one page. It names the AI tools staff may use, the data they must never put in, one owner, and how to ask for a new tool. Give all staff a copy, and review it when you add a tool and at least once a year.

Next to the policy, list each AI tool in use, what it does and who uses it. Keep customer personal data, staff records and anything under a confidentiality agreement out of public AI tools.

The owner keeps the tool list current, approves new tools and decides when a new use needs a DPIA. For decisions about people, such as hiring or credit, write down where a person checks the result.

**A one-page AI policy**

- Which AI tools staff may use.
- What data must never go into them.
- Who owns the policy and the tool list.
- How staff ask for a new tool.

## How do you find out which AI tools staff use?

To find out which AI tools staff use, ask them without blame, then check expense claims and the software you already pay for. Look for AI subscriptions on company cards, and check which of your software has AI switched on.

The aim is to know where your data goes. In March 2023, the UK's National Cyber Security Centre (NCSC) wrote about public AI chatbots, such as ChatGPT. It said the company running the chatbot can see and store what you type, and would almost certainly use it to develop the service at some point. It advised against typing in sensitive information (the [NCSC](https://www.ncsc.gov.uk/blog-post/chatgpt-and-large-language-models-whats-the-risk), 14 March 2023, checked 29 September 2026).

**Find the AI already in your business**

1. Ask the team: Find out which tools people use, without blame.
2. Check the spending: Look at subscriptions, company cards and expense claims.
3. Check existing software: Find out where AI features are switched on.
4. Record the use: List each tool, what it does and who uses it.

A practical starting point for the tool list described above.

Source: NCSC, ChatGPT and large language models (14 March 2023), https://www.ncsc.gov.uk/blog-post/chatgpt-and-large-language-models-whats-the-risk (checked 29 September 2026)

## How many UK businesses that use AI have a policy?

Fewer than one in five UK businesses that use AI have a policy or guidelines for it: 17% do, and 5% have a formal written policy. Among large businesses that use AI, 56% have a formal written policy, against 8% of micro businesses and 3% of sole traders (the UK government's [business data survey](https://www.gov.uk/government/statistics/uk-business-data-survey-2026/uk-business-data-survey-2026#governance-of-artificial-intelligence-in-businesses), 18 June 2026, checked 29 September 2026).

The UK government surveyed 4,450 UK businesses. In 2025 to 2026, 41% of UK businesses that handled data in digital form said they used AI (the UK government's [business data survey](https://www.gov.uk/government/statistics/uk-business-data-survey-2026/uk-business-data-survey-2026#use-of-artificial-intelligence), 18 June 2026, checked 29 September 2026).

**Formal written AI policies, by business size**

- Large: 56%
- Medium: 22%
- Small: 17%
- Micro: 8%
- Sole traders: 3%

Share of UK businesses that use AI with a formal written AI policy, by size, 2025 to 2026.

Source: UK government, UK Business Data Survey 2026, published 18 June 2026, https://www.gov.uk/government/statistics/uk-business-data-survey-2026/uk-business-data-survey-2026#governance-of-artificial-intelligence-in-businesses (checked 29 September 2026)

## Which AI dates matter in the UK and the EU?

Two UK AI dates have passed: 5 February 2026, for new UK GDPR rules on decisions made by computer, and 12 May 2026, for the ICO's duty to write an AI code of practice. EU AI Act high-risk rules apply from 2 December 2027 and 2 August 2028 (legislation.gov.uk, [SI 2026/82](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/made), [section 80](https://www.legislation.gov.uk/ukpga/2025/18/section/80) and [SI 2026/425](https://www.legislation.gov.uk/uksi/2026/425/made), and the [European Commission](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai) and its [AI Omnibus notice](https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force), checked 29 September 2026).

**AI rule dates in the UK and the EU.**

| Date | Where | What starts |
| --- | --- | --- |
| 2 February 2025 | EU | EU AI Act bans on certain AI practices apply. |
| 5 February 2026 | UK | New UK GDPR rules replace the old rules on decisions made by computer with no meaningful human involvement. |
| 12 May 2026 | UK | The ICO must prepare a code of practice on AI, with no date set. |
| 27 July 2026 | EU | The EU AI Omnibus comes into force and moves the high-risk dates. |
| August 2026 | EU | EU AI Act transparency rules apply: people must be told they are dealing with an AI chatbot. |
| 2 December 2027 | EU | EU AI Act rules apply to high-risk AI in listed areas, such as employment, education and biometrics. |
| 2 August 2028 | EU | EU AI Act rules apply to high-risk AI built into products, such as machinery, toys and lifts. |

## Do you need ISO/IEC 42001 certification?

Get ISO/IEC 42001 certification if a customer or a tender asks for it. No law cited in this guide requires it. Start with the policy, the tool list and the owner. If you do go ahead, ask the certification body to show its UKAS accreditation for ISO/IEC 42001. [our guide to ISO/IEC 42001 certification](/guides/iso-42001-certification-and-who-can-certify-you) lists the UK bodies accredited for it.

UKAS, the UK's national accreditation body, says ISO/IEC 42001 gives organisations a set structure to manage how they build and use AI responsibly. In January 2026, UKAS announced that BSI was the first body it accredited to certify businesses to the standard. UKAS says accreditation shows a certification body is competent and impartial (UKAS, [news release](https://www.ukas.com/resources/latest-news/ukas-grants-first-aims-accreditation/), 15 January 2026, and [about page](https://www.ukas.com/about-us/), checked 29 September 2026).

## When should you get outside help with AI?

Consider getting outside help when AI makes significant decisions about people with no meaningful human involvement, which UK GDPR rules on decisions made by computer cover ([Data (Use and Access) Act 2025 (UK), section 80](https://www.legislation.gov.uk/ukpga/2025/18/section/80), checked 29 September 2026). Also consider it when the output of an AI system you use is used in the EU, which the EU AI Act as first passed can cover ([EU AI Act Article 2](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-2), not yet updated for the EU AI Omnibus, checked 29 September 2026).

If you use an adviser, ask how the firm uses AI in its own work, because your data may pass through its tools. 32 of the 140 UK and US providers The Assurance Desk checked between July and October 2026 say how they use AI themselves ([The Assurance Desk provider data](https://theassurancedesk.com/advisers), checked 13 October 2026). See [whether the EU AI Act applies to you](/best/eu-ai-act-exposed) and [what to check before a first appointment](/best/first-appointment).

## What to do

1. List every AI tool your staff use, including AI features in software you already pay for.
2. Write a one-page AI policy covering allowed tools, forbidden data, the owner and how to ask for a new tool.
3. Name one person to own the policy and the tool list.
4. Check whether each new use of AI with personal data needs a DPIA.
5. If what your AI tools produce is used in the EU, check which EU AI Act rules apply.

## Common questions

### Does the EU AI Act apply to a UK business?

Sometimes. As first passed, it covers a UK business that puts AI systems on the EU market or into service there, or makes or uses AI whose output is used in the EU. The EU AI Omnibus, in force since 27 July 2026, amended Article 2, and the linked text is not yet updated for it ([Article 2](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-2) and the [European Commission](https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force), checked 29 September 2026).

### Should AI inside your existing software go on the tool list?

Yes. Put each AI feature inside email, office or customer software on the tool list. Check who can switch the feature on, and read what the supplier's terms say about your data.

### Do you need a DPIA for every AI tool?

No. A DPIA under UK GDPR is about the risk from using personal data, so a tool that never touches personal data needs none. For AI that does, expect one. The ICO says AI use is likely to be high risk in the vast majority of cases (the ICO on [DPIAs](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/when-do-we-need-to-do-a-dpia/) and [AI, 15 March 2023](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 29 September 2026).

## Where next

- [First DPO or AI policy](https://theassurancedesk.com/best/first-appointment.md)
- [Exposed to the EU AI Act](https://theassurancedesk.com/best/eu-ai-act-exposed.md)
- [Do you need AI governance software, or is an adviser enough?](https://theassurancedesk.com/guides/ai-governance-software-or-adviser.md)
- [What does the EU AI Act ask of a UK business?](https://theassurancedesk.com/guides/eu-ai-act-uk-business.md)
- [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md)
- [ISO 42001 in the UK: who certifies you, and what does it cost?](https://theassurancedesk.com/guides/iso-42001-certification-and-who-can-certify-you.md)
- [What is AI governance, in plain words?](https://theassurancedesk.com/guides/what-is-ai-governance.md)
- [Who can write your AI policy?](https://theassurancedesk.com/guides/who-can-write-your-ai-policy.md)
- [Can staff paste client data into ChatGPT or Copilot?](https://theassurancedesk.com/guides/staff-client-data-chatgpt-copilot.md)
- [A DPIA for an AI tool: when and how](https://theassurancedesk.com/guides/dpia-for-an-ai-tool.md)

## Sources

- DSIT, UK Business Data Survey 2026 (18 June 2026), use of AI: https://www.gov.uk/government/statistics/uk-business-data-survey-2026/uk-business-data-survey-2026#use-of-artificial-intelligence (checked 29 September 2026)
- DSIT, UK Business Data Survey 2026 (18 June 2026), AI policies in businesses: https://www.gov.uk/government/statistics/uk-business-data-survey-2026/uk-business-data-survey-2026#governance-of-artificial-intelligence-in-businesses (checked 29 September 2026)
- ICO, AI guidance on accountability and governance (15 March 2023, under review): https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/ (checked 29 September 2026)
- ICO, when a DPIA is needed: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/when-do-we-need-to-do-a-dpia/ (checked 29 September 2026)
- UK, SI 2026/1015 (the ICO became the Information Commission): https://www.legislation.gov.uk/uksi/2026/1015/made (checked 2 October 2026)
- UK, SI 2026/82, regulation 2: https://www.legislation.gov.uk/uksi/2026/82/regulation/2/made (checked 29 September 2026)
- UK, Data (Use and Access) Act 2025, section 80: https://www.legislation.gov.uk/ukpga/2025/18/section/80 (checked 29 September 2026)
- UK, SI 2026/425 (ICO code of practice on AI): https://www.legislation.gov.uk/uksi/2026/425/made (checked 29 September 2026)
- European Commission, the EU AI Act: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai (checked 29 September 2026)
- European Commission, AI Omnibus enters into force: https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force (checked 29 September 2026)
- EU AI Act Service Desk, Article 2 (not yet updated for the AI Omnibus): https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-2 (checked 29 September 2026)
- NCSC, ChatGPT and large language models (14 March 2023): https://www.ncsc.gov.uk/blog-post/chatgpt-and-large-language-models-whats-the-risk (checked 29 September 2026)
- UKAS, first AI management system accreditation (15 January 2026): https://www.ukas.com/resources/latest-news/ukas-grants-first-aims-accreditation/ (checked 29 September 2026)
- UKAS, about us: https://www.ukas.com/about-us/ (checked 29 September 2026)
- The Assurance Desk provider data, read from each provider's own pages and public records between 16 July and 13 October 2026: https://theassurancedesk.com/advisers (checked 13 October 2026)
- The ICO: ICO welcomes transition to new Information Commission, 30 September 2026: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-welcomes-transition-to-new-information-commission-and-marks-new-chapter-with-manchester-head-office-opening/ (checked 2 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.