Resources · 30 June 2026
Do I need an AI policy? A five-minute self-check for UK organisations
By the Operating Bench Team · Last reviewed 30 June 2026
The honest answer is: probably, but not the kind you are picturing. Most people hear “AI policy” and imagine a twenty-page document that takes a working group three months and then sits in a folder. You do not need that. You need a short, clear set of rules that a new starter could read in five minutes.
Here is a five-minute check to work out whether you need one, and how far it needs to go. Prefer it interactive? Our AI Policy Health Check gives you a scored result and a tailored next step in about two minutes.
The five-minute check
Answer these honestly. If you are not sure, treat that as a yes.
- Do your staff use AI tools for work? Even free ones, even occasionally. ChatGPT, Copilot, an AI notetaker, a summariser, a writing aid. If you think the answer is no, it is worth reading what shadow AI looks like first, because it is usually happening whether or not anyone has said so.
- Does any of that work touch personal, client or confidential data? Customer details, staff records, financial information, anything you would not want to see forwarded outside the organisation.
- Does anyone rely on AI output without a person checking it? A drafted email that goes straight out, a summary that informs a decision, numbers that get reused.
- Would a client, funder, auditor or regulator expect you to have rules? In some sectors this is already a question on tenders and due-diligence forms.
- If someone misused an AI tool tomorrow, is it written down who is responsible and what to do?
Scoring is simple. If you answered yes, or “not sure”, to any of these, you need something written down. Most UK organisations answer yes to the first three without thinking hard about it.
What “enough” looks like
For a lot of small organisations, a good AI policy is one page. It needs to answer five questions:
- Which tools are approved? A short list, so there is a “use this”, not just a “do not”.
- What must never go in? The data that stays out of any AI tool. This is the line that keeps you the right side of UK GDPR.
- Who checks the output? AI is confidently wrong sometimes. Someone owns the result.
- Who is accountable? A named person or role, not “the business”.
- What happens when it goes wrong? Who to tell, and what to do next.
If you can answer those five clearly, you have covered most of the risk. That is the whole point of starting small: get the basics written and used, then add depth where it matters.
When you need more than the minimum
Some organisations need to go further, and it is usually obvious which:
- You are in a regulated or data-heavy sector. Schools, charities, healthcare, recruitment and accountancy all carry extra duties, and the specifics differ. We have practical guides for schools, charities and healthcare, and deeper pieces on AI in hiring and accountants using ChatGPT with client data.
- AI is starting to make or shape decisions, not just draft text. That changes the accountability picture. See agentic AI.
- A client or certification body is asking how you manage AI. If the words ISO 42001 have come up, read that first before you commit to anything heavy.
None of this means a bigger document for its own sake. It means the same five questions, answered with your sector’s specifics in mind.
How to get there this week
You do not have to start from a blank page.
- Grab the free AI Starter Kit: a one-page set of ground rules and a quick guide to what data is safe to put into AI tools. No cost.
- If you want the complete set, look inside the pack before you decide. The AI Safe-Use Pack gives you the policy plus the risk register, an approved-tools matrix, a DPIA starter and ready-to-paste disclosure clauses, written around UK GDPR and the ICO. There are tailored editions for the sectors above.
Start with the one page. You can have the basics in place today, and that is worth far more than a perfect policy you never finish.
This article is general information, not legal advice. For advice on your specific circumstances, consult a suitably qualified professional.