The Assurance Desk
Part of the guide Does your UK business need an AI policy, and what goes in it?
Who needs to help write it?
Ask the proposed writer to speak to the people doing the work. Which tools do staff use? What do they put into them? Who uses the result? What slows them down or leaves them unsure?
Bring in technical and data protection expertise where needed. The ICO says senior management needs a team with varied skills and enough resources. The policy should fit the way responsibilities are divided.
Give the writer the people they need
- Business owner Explain the tasks, intended benefits and decisions to be made.
- People using AI Show the real workflow and the points where they need clear rules.
- Technical and risk specialists Check the proposed uses and safeguards in their areas.
- Policy owner Bring the rules together and arrange approval, training and review.
Should you use a consultant or a template?
Ask any consultant to explain how they will learn about your work before drafting. With a template, ask who will adapt and check it. Either way, make sure someone inside the organisation owns the result.
AI governance practitioner Oliver Patel makes a useful point about generative AI policies. The rules need to fit the organisation’s activities and the places where it works.
These will need to be tailored to your organisation's sector, activities, jurisdictional footprint, culture and values.
What should the finished policy make clear?
The ICO links policies with roles, training and risk management. Use that as a test: can a person doing the work tell what is allowed, who checks it and where to get help?
| Policy area | Plain question to settle |
|---|---|
| Approved tools and uses | Which tool and account can I use for this task? |
| Data | What information may I put into it? |
| Checking work | What must a person review before the result is used? |
| Approval | Who decides when a new use needs checking? |
| Problems | Who do I tell if something goes wrong? |
| Training and review | How will staff learn the rules, and who keeps them current? |
What happens after the document is written?
Ask staff to try the rules against real tasks before rollout. Can they find the answer without asking the writer? If a rule is unclear, fix the wording or the decision behind it.
Agree how the policy will be taught and reviewed. Data protection by design is ongoing work, and the ICO expects training and policies to stay aligned with the organisation’s approach to AI.
Keep the policy separate from a DPIA, a review of risks to people’s data rights. Assess whether one is needed for the actual use. A policy alone does not record that case-specific assessment.
What to do
- Name the internal owner before commissioning the policy.
- Give the writer examples of real tasks and ask them to consult the people doing them.
- Ask specialists to check the parts within their expertise.
- Test whether staff can use the draft to answer everyday questions.
- Agree training and ongoing review alongside the document.
Common questions
Can we copy another company’s AI policy?
Use it to form questions, then have the rules adapted and checked for your own work. Oliver Patel’s point is that a policy needs to fit the organisation’s activities, context and values.
Does an external writer take over responsibility?
Your organisation remains responsible for data protection compliance as controller. A writer can help with the work, but you still need an owner and suitable oversight.
Does the policy replace a DPIA?
No. The ICO says the need for a DPIA is assessed for the particular use of AI. Record that assessment separately from the general rules for staff.
Where next
Sources
- ICO, What are the accountability and governance implications of AI?, checked 7 October 2026
- Oliver Patel on LinkedIn, Are your company's generative AI policies fit for purpose?, Oliver Patel, AIGP, CIPP/E, MSc, checked 7 October 2026
This is an independent editorial guide, not legal advice.