# AI Use Policy — template

Replace every square-bracket prompt. Keep it to two pages. Review annually or
after any incident.

**Organisation:** [name]  ·  **Policy owner:** [name and role]  ·  **Version:** [1.0]
**Approved by:** [trustee/board/sole trader]  ·  **Approval date:** [date]  ·  **Next review:** [date]

## 1. Purpose and scope
This policy covers all use of AI tools by [staff / volunteers / trustees /
contractors] on [organisation] business, including personal accounts used for
work tasks.

## 2. Permitted uses
[e.g. drafting internal text, summarising public documents, code assistance.]

## 3. Prohibited uses
- Entering personal data of beneficiaries, pupils or clients into a tool that
  has not been approved in writing.
- Entering special category data (health, ethnicity, beliefs) into any AI tool.
- Using AI output as a final decision about a person (funding, discipline,
  safeguarding, employment) without a named human decision-maker.
- Presenting AI-generated text or images as human-created where that matters.

## 4. Approved tools
| Tool | Purpose | Data allowed | Approved by | Date |
|---|---|---|---|---|
| [tool] | [purpose] | [none / public only / named categories] | [name] | [date] |

## 5. Human oversight
Every output used externally is checked by [role] before publication. The named
person accountable for AI use in this organisation is [name and role].

## 6. Transparency
We tell people when they are interacting with, or reading material produced
with, AI in the following circumstances: [list].

## 7. Data protection
Lawful basis for any personal data processed with AI: [basis]. Retention:
[period]. ICO registration reference (if applicable): [reference]. A DPIA is
required before any new use involving personal data.

## 8. Incidents
Anyone who suspects an AI-related error, leak or harm reports it to [name] the
same working day, and it is recorded in the AI incident log.

## 9. Training
All [staff/volunteers] complete AI awareness training before using approved
tools, refreshed [annually].

## 10. Breach of this policy
[Consequences and process.]