AI governance and UK GDPR policy for mid-sized businesses

Why a policy matters before an incident does

Staff are probably already using AI tools, approved or not. A short, clear policy gives people safe ways to benefit while protecting client confidentiality, personal data and your reputation. It does not need to be long. A few pages that people actually read beat a forty-page document that sits on the intranet.

This article is general information and not legal advice. Take advice from a qualified professional about your own circumstances, and check current guidance from the Information Commissioner’s Office (ICO), which publishes material on AI and data protection.

Acceptable use and approved tools

Say plainly what staff may and may not do with AI. Pair that with a list of approved tools, so there is a simple answer to the question of what is safe to use.

• Name each approved tool, its purpose and the account type to use, such as a business account rather than a personal one.
• State what is prohibited, for example pasting client files into unapproved services.
• Explain how someone requests a new tool to be reviewed.
• Make clear that staff remain responsible for work they produce with AI assistance.

Data classification

Decide what kinds of information can go into which tools. A simple three or four level scheme is enough: public, internal, confidential, and special or sensitive data such as health information or anything that identifies individuals.

Then map the levels to tools. For example, public and internal material might be fine in an approved general-purpose tool, while personal or client-confidential data is only permitted in systems you have assessed and have contracts for. Keep the rules short enough to remember.

Human review, logging and accountability

• Require a named person to review AI outputs before they reach customers, are used in decisions about people, or go into financial or legal documents.
• Keep records of which systems were used, for what, and who approved the outputs, proportionate to the risk.
• Set out how errors and near-misses are reported and learned from.
• Assign an owner for the policy, usually a director or senior manager, and review it regularly as tools change.

Personal data, DPIAs and supplier checks

If an AI use involves personal data, UK GDPR principles apply: you need a lawful basis, transparency with the people concerned, data minimisation and appropriate security. A data protection impact assessment is required for processing likely to result in a high risk to individuals, and is good practice for many AI projects. Check the ICO’s current guidance on when one is needed.

For suppliers, ask where data is processed, whether it is used to train models, what sub-processors are involved, what security measures exist, and whether a data processing agreement is in place. Record the answers.

Rolling it out

1. Find out what tools staff already use, without blame.
2. Draft the policy with input from operations, IT and whoever handles data protection.
3. Publish the approved tools list alongside it.
4. Run a short briefing with real examples from your business.
5. Review after a few months and adjust for what you learned.

Frequently asked questions