Does your UK business need an AI policy, and what goes in it?

Is an AI policy a legal requirement in the UK?

No UK law cited in this guide requires a document called an AI policy. But UK GDPR covers AI that uses personal data, and the ICO, the UK's data protection regulator, says a business needs to align its policies, roles and training with its AI governance and risk management strategy.

The ICO became the Information Commission on 30 September 2026, and is still known as the ICO.

The ICO's AI guidance, last updated on 15 March 2023, is under review because of the UK's Data (Use and Access) Act 2025. It says that in the vast majority of cases, AI that uses personal data is likely to result in a high risk to people's rights and freedoms, so that use needs a data protection impact assessment, or DPIA.

Since 5 February 2026, new UK GDPR rules have replaced the old rules on decisions made by computer with no meaningful human involvement. If such a decision significantly affects a person, you must tell them about it and let them comment, ask for a human to step in and challenge it.

What is the smallest AI policy that works?

The smallest AI policy that works fits on one page. It names the AI tools staff may use, the data they must never put in, one owner, and how to ask for a new tool. Give all staff a copy, and review it when you add a tool and at least once a year.

Next to the policy, list each AI tool in use, what it does and who uses it. Keep customer personal data, staff records and anything under a confidentiality agreement out of public AI tools.

The owner keeps the tool list current, approves new tools and decides when a new use needs a DPIA. For decisions about people, such as hiring or credit, write down where a person checks the result.

How do you find out which AI tools staff use?

To find out which AI tools staff use, ask them without blame, then check expense claims and the software you already pay for. Look for AI subscriptions on company cards, and check which of your software has AI switched on.

The aim is to know where your data goes. In March 2023, the UK's National Cyber Security Centre (NCSC) wrote about public AI chatbots, such as ChatGPT. It said the company running the chatbot can see and store what you type, and would almost certainly use it to develop the service at some point. It advised against typing in sensitive information.

How many UK businesses that use AI have a policy?

Fewer than one in five UK businesses that use AI have a policy or guidelines for it: 17% do, and 5% have a formal written policy. Among large businesses that use AI, 56% have a formal written policy, against 8% of micro businesses and 3% of sole traders.

The UK government surveyed 4,450 UK businesses. In 2025 to 2026, 41% of UK businesses that handled data in digital form said they used AI.

Which AI dates matter in the UK and the EU?

Two UK AI dates have passed: 5 February 2026, for new UK GDPR rules on decisions made by computer, and 12 May 2026, for the ICO's duty to write an AI code of practice. EU AI Act high-risk rules apply from 2 December 2027 and 2 August 2028.

Do you need ISO/IEC 42001 certification?

Get ISO/IEC 42001 certification if a customer or a tender asks for it. No law cited in this guide requires it. Start with the policy, the tool list and the owner. If you do go ahead, ask the certification body to show its UKAS accreditation for ISO/IEC 42001. our guide to ISO/IEC 42001 certification lists the UK bodies accredited for it.

UKAS, the UK's national accreditation body, says ISO/IEC 42001 gives organisations a set structure to manage how they build and use AI responsibly. In January 2026, UKAS announced that BSI was the first body it accredited to certify businesses to the standard. UKAS says accreditation shows a certification body is competent and impartial.

When should you get outside help with AI?

Consider getting outside help when AI makes significant decisions about people with no meaningful human involvement, which UK GDPR rules on decisions made by computer cover. Also consider it when the output of an AI system you use is used in the EU, which the EU AI Act as first passed can cover.

If you use an adviser, ask how the firm uses AI in its own work, because your data may pass through its tools. 32 of the 140 UK and US providers The Assurance Desk checked between July and October 2026 say how they use AI themselves. See whether the EU AI Act applies to you and what to check before a first appointment.

What to do

1. List every AI tool your staff use, including AI features in software you already pay for.
2. Write a one-page AI policy covering allowed tools, forbidden data, the owner and how to ask for a new tool.
3. Name one person to own the policy and the tool list.
4. Check whether each new use of AI with personal data needs a DPIA.
5. If what your AI tools produce is used in the EU, check which EU AI Act rules apply.

Common questions

Does the EU AI Act apply to a UK business?

Sometimes. As first passed, it covers a UK business that puts AI systems on the EU market or into service there, or makes or uses AI whose output is used in the EU. The EU AI Omnibus, in force since 27 July 2026, amended Article 2, and the linked text is not yet updated for it.

Should AI inside your existing software go on the tool list?

Yes. Put each AI feature inside email, office or customer software on the tool list. Check who can switch the feature on, and read what the supplier's terms say about your data.

Do you need a DPIA for every AI tool?

No. A DPIA under UK GDPR is about the risk from using personal data, so a tool that never touches personal data needs none. For AI that does, expect one. The ICO says AI use is likely to be high risk in the vast majority of cases.

Where next

• First DPO or AI policy
• Exposed to the EU AI Act
• Do you need AI governance software, or is an adviser enough?
• What does the EU AI Act ask of a UK business?
• How do I choose a data protection or AI governance adviser?
• ISO 42001 in the UK: who certifies you, and what does it cost?
• What is AI governance, in plain words?
• Who can write your AI policy?
• Can staff paste client data into ChatGPT or Copilot?
• A DPIA for an AI tool: when and how

This is an independent editorial guide, not legal advice.