Writing an Acceptable Use Policy for Generative AI at Work

Generative AI (ChatGPT, Claude, Copilot, and similar systems) is already in use in most organisations. Many employees use these systems daily without awareness of data protection, IP, or bias risks. An organisation that allows generative AI without governance is accumulating hidden risk: personal data may be uploaded to third-party systems, confidential information may be processed by AI, and decisions made with AI assistance may later be challenged for bias or lack of human judgment.

The Governance Gap

Many HR teams do not know that their employees are using generative AI at work. Line managers use ChatGPT to draft performance review comments. Finance teams use it to analyse spreadsheets.

Recruitment teams use it to draft job descriptions. In each case, they may be uploading personal data, confidential business information, or data about candidates and employees to a third-party AI system with no encryption and no guarantee of privacy.

This creates multiple risks. A recruiter might paste candidate names and CVs into ChatGPT to get interview question suggestions, and those candidate details become training data for the AI system. A manager might paste an employee’s performance data into Copilot to draft a review, and that data is now in Microsoft’s systems.

A finance team member might upload salary data to analyse trends, and that data is now processed by an AI vendor.

None of this may be permitted under data protection law, employment law, or the organisation’s own policies. Yet it happens daily in organisations that have no generative AI policy.

Essential Policy Elements

An acceptable use policy for generative AI should address: what systems are approved for use, what categories of data can and cannot be processed, who is responsible for compliance, what the consequences of policy breach are, and what support is available.

Approved systems: The organisation should maintain a list of approved AI systems and versions. This might include corporate-licensed systems (like Copilot integrated into Microsoft tools) and personal use systems that have been assessed as low-risk. Systems not on the approved list should not be used for work purposes.

Data restrictions: The policy should clearly state that personal data, confidential business information, and trade secrets cannot be uploaded to external AI systems. The policy should give examples: candidate CVs and employee data cannot be pasted into public AI systems; customer lists cannot be analysed by AI vendors; salary information cannot be processed by generative AI; performance review data cannot be shared with AI systems.

Attribution and human judgment: The policy should require that any content generated by AI is reviewed by a human before use. A draft performance review generated by AI should be reviewed and modified by the manager; it should not be used verbatim. A job description drafted by AI should be checked for bias and accuracy before publication.

The policy should require that humans take responsibility for decisions. If a hiring manager uses AI to draft interview questions, the manager (not the AI) is responsible for the final questions and for whether they are fair and non-discriminatory.

Prohibited uses: The policy should explicitly prohibit certain uses. Using generative AI to make or significantly influence hiring, promotion, or redundancy decisions without human review is prohibited. Using AI to monitor employees without their knowledge is prohibited.

Using AI to make decisions about candidates or employees without transparency to those individuals is prohibited.

Implementation and Training

A policy without training and enforcement is useless. The organisation should provide training to all employees on: what the policy is, why it matters, what systems are approved, what data cannot be uploaded, and what the consequences of policy breach are.

The training should include practical scenarios. A recruiter might be told: “You are reviewing applications for a customer service role. You want to draft interview questions.

You can use the approved corporate AI tool that is integrated into your HR system. You cannot paste candidate names or CVs into the tool. If you need to refer to specific candidates, anonymise the data first (remove names and identifying information).”

The policy should be enforced through technical controls where possible. If the organisation uses a corporate AI platform, the platform should prevent uploading of personal data or should apply encryption to ensure the data is not used for training. Unapproved AI systems might be blocked on the corporate network.

Regular Review and Updates

AI technology and regulation are changing rapidly. A generative AI policy written in 2023 may be out of date by 2024. The organisation should commit to reviewing the policy at least annually and updating it as new systems emerge, new risks are identified, or new regulations take effect.