Bring your own AI: why your organisation needs an AI policy, and what to put in it

An AI policy sets out which artificial intelligence tools employees can use, what information they can enter into them and when a human must check the results. It also explains how new tools, mistakes and training are handled. Its purpose is to help people use AI safely and productively, not to prevent them from using it. So what should your business be putting in yours?

The need for clear rules around AI use at work is becoming more pressing. Employees are already bringing their own AI tools to work, often without their employer knowing. It is known colloquially as bring your own AI, or BYOAI. Your challenge, should you choose to accept it: to make sure that your employees’ enthusiasm for AI does not come at the expense of your data security, privacy or accountability.

With that in mind, a practical AI policy gives your staff the confidence to use approved tools while making the boundaries clear. Here is what you will need to consider.

Bring your own AI is already happening

In reality, your employees are probably not waiting for you to introduce an approved AI platform before diving straight in. Many have already discovered tools that help them write, summarise information, analyse data and complete everyday tasks more quickly.

Microsoft and LinkedIn gave this behaviour a name in their 2024 Work Trend Index. Based on a survey of 31,000 people across 31 countries, they found that 78% of employees who use AI at work bring their own tools. They named the trend ‘BYOAI’.

More recent UK research from KnowBe4 suggests that the issue is still widespread. Its 2026 research, covering organisations with 250 or more employees, found that 55% of UK employees admitted to using unapproved AI tools. One in ten said they had knowingly entered sensitive information into them.

These figures point to a gap between how people are using AI and the guidance available to them. The risk is that they may be using personal accounts or free versions of AI services without understanding how their information is handled. Depending on the provider, product, settings and terms, prompts and uploaded material may be retained or used to improve AI models.

That could mean an employee entering customer information, internal documents, financial details or commercially sensitive material into a service that you have not approved. When AI tools are being used without the knowledge or approval of your IT team, this is known as ‘shadow AI’. It is the AI equivalent of shadow IT, where employees introduce their own applications and services outside the organisation’s normal controls.

Why banning AI does not work

It can be tempting to respond to these risks with a blanket ban. However, telling employees not to use AI will not necessarily stop them. It may simply encourage them to use personal accounts, devices and applications that are even harder for your organisation to monitor.

There are also practical business implications. AI can help your employees save time, improve the quality of their routine work and enable them to explore new ways of solving problems. Preventing all AI use could mean you miss out on opportunities to improve productivity and efficiency.

The more sensible approach lies somewhere in the middle. Decide which tools are appropriate, establish clear rules about the information employees can share with them, and provide enough training for them to understand how to use them responsibly.

Our North-South AI divide research highlights the importance of this. Depending on the region, between 62% and 78% of UK employees surveyed said their employer had provided no AI training or guidance. This leaves them having to make their own decisions about what is acceptable, often without understanding the potential consequences.

An effective AI policy should make your organisation’s position clear, but it should also reflect the level of control that is appropriate for your circumstances. There are three broad approaches:

• Enable: encourage AI adoption while setting clear expectations and safeguards.
• Balanced: allow appropriate uses while applying controls to higher-risk tools, activities and information.
• Restrictive: limit AI use more tightly where your organisation’s risks or obligations require it.

The right approach will depend on your organisation, the information it handles and the work your employees need to do.

Find the AI already in use

Before introducing a policy, it helps to understand how employees are already using AI. A constructive conversation is more likely to reveal where you need better tools, clearer guidance or more training. So, start by simply asking people. Invite your teams to explain which tools they use and what they use them for.

Tip: an ‘AI amnesty’ can encourage more honest answers. So can making it clear that the aim is to understand current usage and provide safe alternatives, not to punish employees for experimenting. Employees may be reluctant to disclose their use of personal AI accounts if they think doing so will automatically lead to disciplinary action.

There are also technical ways to build a picture of what is happening. Microsoft has introduced a Shadow AI view in the Microsoft 365 admin centre, designed to help IT administrators detect desktop AI apps such as ChatGPT and Claude. (At the time of writing, this feature remains in public preview and requires Microsoft 365 E5.)

A managed IT provider can help you understand your existing AI environment, review security controls and identify potential gaps. Our cyber security services support this wider approach, giving you greater visibility and helping you put the right safeguards in place.

What to put in an AI policy

A company AI policy does not need to be complicated, but it does need to answer the questions your employees are likely to have. Here is a useful starting point.

1. Scope. Explain who the policy applies to, including employees, contractors and other relevant third parties. Make clear whether it covers personal devices as well as company equipment.
2. Approved tools. List the AI tools and identify whether each one is approved, approved conditionally, not approved or still under review. Explain who can use each tool and for what purpose.
3. What information can go into AI tools. Set out which types of information can be entered into approved tools, which can only be used with a company account or version, and which must never be shared. Consider personal data, customer records, confidential documents, financial information, passwords, intellectual property and commercially sensitive material.
4. Human review. Explain when an employee must check AI-generated content before using it. Work intended for clients, customers, suppliers or the public should be reviewed by an appropriate person. Employees should also understand that AI can produce inaccurate, misleading or fabricated information.
5. Permitted and prohibited uses. Identify uses that are prohibited or require additional approval, such as entering confidential information into an unapproved tool or relying on AI alone for significant decisions.
6. New tools. Explain how employees can request approval for a new AI service. Give them a clear route to suggest tools that could improve their work, rather than leaving them to sign up independently.
7. Incidents and mistakes. Tell employees what to do if they share information in error, receive an inappropriate output or identify a possible security or privacy issue. Make clear who they should contact and how quickly they should report it.
8. Training and acknowledgement. Explain what training employees will receive and require them to confirm that they have read and understood the policy.
9. Ownership and review. Name the person or team responsible for the policy. Set a review date, ideally every six or twelve months, and make sure the policy is revisited when the organisation introduces new tools or its use of AI changes.

Together, these points provide the foundations of an AI governance policy. Some organisations may refer to it as an AI acceptable use policy or an AI policy template, but the essential purpose is the same: to establish clear, workable rules that employees can follow.

Give people a safe, approved option

A policy that just tells employees what they cannot do, without offering a practical alternative, is unlikely to succeed. If someone is already using AI to save time drafting reports or preparing meeting notes, they will probably continue looking for a way to do so. And if you do not provide an approved option, they may return to the personal tools they were using before.

Consider providing access to company versions of established services, such as Microsoft 365 Copilot, ChatGPT Business or Claude Team, signed in with a work account. Company accounts can offer different administrative, privacy and data protection arrangements from consumer versions, but it is still worth checking the specific terms and configuration rather than assuming that every business product offers identical safeguards.

It is also important to give employees guidance on how to use your approved tools. They will need to understand what information they can share, how to check results and when AI is not an appropriate substitute for human judgement.

An AI policy for charities and regulated organisations

Some organisations need to consider extra requirements when developing an AI policy. Charities, for example, may handle sensitive beneficiary information, donor records and details about vulnerable people. They also have responsibilities to trustees and other stakeholders to demonstrate that they are handling information appropriately. An AI policy should therefore reflect the types of data the charity holds and the potential consequences of sharing it with an AI service.

Regulated organisations, including those in financial services and legal sectors, may have further obligations around confidentiality, record keeping, accountability and the use of technology in professional services. The same basic principles apply, but the rules need to reflect the organisation’s sector and responsibilities.

Good to know: our AI Policy Generator, linked below, takes this into account. A few quick questions about your organisation fill in the rules that the law and your regulators require, so the resulting policy includes the considerations that apply to you.

Build your AI policy in about ten minutes

The free AI Policy Generator from Managed247 takes you through four short steps to create a policy tailored to your organisation. The process takes about ten minutes, and the finished documents include a branded PDF, a one-page staff quick reference, a sign-off form and an editable Word document.

The generator is designed to give you a practical starting point that you can adapt to your own circumstances. It is a template, not legal advice, so you should review the result and seek specialist guidance where necessary.

Once your policy is in place, the next step is to communicate it clearly. Share it with employees, explain the reasoning behind the rules and provide appropriate security awareness training. Make sure people know where to find the approved tools and who to contact if they have a question.

AI is already changing how people work, but you do not need to choose between embracing that change and protecting your information. With the right tools, clear guidance and appropriate oversight, you can do both.

Build your organisation’s AI policy today with the free Managed247 AI Policy Generator.

Frequently asked questions

• What is an AI policy?

  An AI policy is a set of rules explaining how employees can use artificial intelligence tools at work. It covers approved applications, the information that can be shared, human oversight, training and how mistakes or incidents should be reported. Its purpose is to support safe and responsible AI use.

• Does my organisation need an AI policy?

  An AI policy helps your organisation manage the risks and opportunities associated with employees using AI at work. It provides clarity about which tools are permitted and how information should be handled. While there is no general requirement for every UK organisation to have a standalone AI policy at the time of writing, existing legal and regulatory obligations may apply to the use of AI.

• What is BYOAI?

  BYOAI stands for ‘bring your own AI’. It describes employees using their own AI tools or personal accounts for work, rather than relying solely on services provided or approved by their employer. When this happens without the organisation’s knowledge or approval, it may also be described as shadow AI.

• What should an AI policy include?

  An AI policy should cover its scope, approved tools, information handling rules, permitted uses, human review, new tool approvals, incident reporting, training and policy ownership. It should also explain how employees can ask questions or request approval for a new application.

• Can employees use ChatGPT at work?

  Yes, if their organisation permits it and they follow its AI policy. You should specify which version or account employees can use and what information can be entered. A company-approved business account may offer different data protection and administrative controls from a personal account, so employees should follow your guidance.

• Is there a free AI policy template for UK organisations?

  Yes. The free Managed247 AI Policy Generator helps UK organisations create an AI policy in about ten minutes. It produces a branded PDF, an editable Word document, a staff quick reference and a sign-off form. You should review the template and adapt it to reflect your own requirements.

• Do charities need an AI policy?

  An AI policy can help charities manage how employees and volunteers use AI, particularly where they handle beneficiary, donor or other sensitive information. It should reflect the charity’s responsibilities, the information it holds and its governance arrangements. A sector-specific policy can help trustees and staff understand the rules.