# Who can write your AI policy?

Choose a writer who can turn the way your team works into rules people can use.

The Assurance Desk. Published 7 October 2026. Last checked 7 October 2026.

Part of the guide [Does your UK business need an AI policy, and what goes in it?](https://theassurancedesk.com/guides/the-ai-governance-gap.md).

**The short answer.** Choose a writer who understands your organisation and can work with the people who use, manage and check AI. Keep a named owner inside the business. The ICO expects roles, training and policies to fit your use of AI, and data protection responsibility stays with the organisation ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 7 October 2026).

## Who needs to help write it?

Ask the proposed writer to speak to the people doing the work. Which tools do staff use? What do they put into them? Who uses the result? What slows them down or leaves them unsure?

Bring in technical and data protection expertise where needed. The ICO says senior management needs a team with varied skills and enough resources. The policy should fit the way responsibilities are divided ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 7 October 2026).

**Give the writer the people they need**

- **Business owner**: Explain the tasks, intended benefits and decisions to be made.
- **People using AI**: Show the real workflow and the points where they need clear rules.
- **Technical and risk specialists**: Check the proposed uses and safeguards in their areas.
- **Policy owner**: Bring the rules together and arrange approval, training and review.

A suggested way to share the work. These are responsibilities, not required job titles.

Source: ICO, What are the accountability and governance implications of AI?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/ (checked 7 October 2026)

## Should you use a consultant or a template?

Ask any consultant to explain how they will learn about your work before drafting. With a template, ask who will adapt and check it. Either way, make sure someone inside the organisation owns the result.

AI governance practitioner Oliver Patel makes a useful point about generative AI policies. The rules need to fit the organisation’s activities and the places where it works ([Oliver Patel on LinkedIn](https://www.linkedin.com/posts/oliver-patel_are-your-companys-generative-ai-policies-activity-7255575513308573697-_bpM), checked 7 October 2026).

> "These will need to be tailored to your organisation's sector, activities, jurisdictional footprint, culture and values."
> Oliver Patel, LinkedIn post excerpt
> Oliver Patel on LinkedIn, Are your company's generative AI policies fit for purpose?, Oliver Patel, AIGP, CIPP/E, MSc, https://www.linkedin.com/posts/oliver-patel_are-your-companys-generative-ai-policies-activity-7255575513308573697-_bpM (checked 7 October 2026)
> [View LinkedIn post](https://www.linkedin.com/posts/oliver-patel_are-your-companys-generative-ai-policies-activity-7255575513308573697-_bpM)

## What should the finished policy make clear?

The ICO links policies with roles, training and risk management. Use that as a test: can a person doing the work tell what is allowed, who checks it and where to get help ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 7 October 2026)?

**Questions for the writer to answer**

| Policy area | Plain question to settle |
| --- | --- |
| Approved tools and uses | Which tool and account can I use for this task? |
| Data | What information may I put into it? |
| Checking work | What must a person review before the result is used? |
| Approval | Who decides when a new use needs checking? |
| Problems | Who do I tell if something goes wrong? |
| Training and review | How will staff learn the rules, and who keeps them current? |

Source: ICO, What are the accountability and governance implications of AI?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/ (checked 7 October 2026)

## What happens after the document is written?

Ask staff to try the rules against real tasks before rollout. Can they find the answer without asking the writer? If a rule is unclear, fix the wording or the decision behind it.

Agree how the policy will be taught and reviewed. Data protection by design is ongoing work, and the ICO expects training and policies to stay aligned with the organisation’s approach to AI ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 7 October 2026).

Keep the policy separate from a DPIA, a review of risks to people’s data rights. Assess whether one is needed for the actual use. A policy alone does not record that case-specific assessment ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 7 October 2026).

## What to do

1. Name the internal owner before commissioning the policy.
2. Give the writer examples of real tasks and ask them to consult the people doing them.
3. Ask specialists to check the parts within their expertise.
4. Test whether staff can use the draft to answer everyday questions.
5. Agree training and ongoing review alongside the document ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 7 October 2026).

## Common questions

### Can we copy another company’s AI policy?

Use it to form questions, then have the rules adapted and checked for your own work. Oliver Patel’s point is that a policy needs to fit the organisation’s activities, context and values ([Oliver Patel on LinkedIn](https://www.linkedin.com/posts/oliver-patel_are-your-companys-generative-ai-policies-activity-7255575513308573697-_bpM), checked 7 October 2026).

### Does an external writer take over responsibility?

Your organisation remains responsible for data protection compliance as controller. A writer can help with the work, but you still need an owner and suitable oversight ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 7 October 2026).

### Does the policy replace a DPIA?

No. The ICO says the need for a DPIA is assessed for the particular use of AI. Record that assessment separately from the general rules for staff ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 7 October 2026).

## Where next

- [First DPO or AI policy](https://theassurancedesk.com/best/first-appointment.md)
- [Does your UK business need an AI policy, and what goes in it?](https://theassurancedesk.com/guides/the-ai-governance-gap.md)
- [Do you need AI governance software, or is an adviser enough?](https://theassurancedesk.com/guides/ai-governance-software-or-adviser.md)
- [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md)
- [What is AI governance, in plain words?](https://theassurancedesk.com/guides/what-is-ai-governance.md)
- [Can staff paste client data into ChatGPT or Copilot?](https://theassurancedesk.com/guides/staff-client-data-chatgpt-copilot.md)

## Sources

- ICO, What are the accountability and governance implications of AI?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/ (checked 7 October 2026)
- Oliver Patel on LinkedIn: https://www.linkedin.com/posts/oliver-patel_are-your-companys-generative-ai-policies-activity-7255575513308573697-_bpM (checked 7 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.