Writing a one-page AI use policy
Half of charities have no AI policy. Here is what one has to cover to satisfy CQC and the ICO, why one page beats twenty, and how to write it in an afternoon.
Most small care organisations are in one of two positions. Either staff are already using AI and there is no policy, or someone has been asked to write one and is staring at a blank page.
Both are normal. The Charity Digital Skills Report 2026 found that 51% of charities have no AI policy, rising to 62% among small charities, while 79% use AI in some form. Use has run ahead of governance across the whole sector.
The good news is that the policy does not need to be long. It needs to be read.
Why one page
A twenty-page policy has one reader: the person who wrote it. A one-page policy pinned by the office computer has as many readers as you have staff.
This matters more than it sounds, because the failure mode is not “we had the wrong policy”. It is a care worker at half past eight on a Friday, behind on notes, making a judgement alone with nothing to refer to. The only policy that helps in that moment is one short enough to have been remembered.
So: one page. Longer supporting detail can live elsewhere if you need it.
What it has to cover
CQC’s principles for good use of AI name “effective governance — there are effective mechanisms such as risk assessments to ensure AI contributes to high-quality, equitable care, and established systems to recognise, report and investigate when something goes wrong”. It also names “accountability — there are clear mechanisms for addressing issues or harm caused by AI”.
Translated into a page, that is six sections.
1. Which tools are approved, and which accounts
This is the section most policies get wrong, because they name the product and not the plan.
“ChatGPT is approved” is not a policy. “ChatGPT Business, signed in with your work email” is. The distinction is the whole thing: on ChatGPT’s own comparison table, no individual plan carries SOC 2, ISO certification, UK data residency or a data processing agreement. A member of staff on a personal Plus account is outside your governance entirely, and the screen looks identical.
Name the tool, the plan, and the account. And say plainly that anything not on the list is not approved.
2. What must never be entered
Names, addresses, dates of birth, NHS numbers, photos, and anything that identifies someone in combination — a rare condition in a small village, “the gentleman on the Tuesday round”.
Our “never paste this” poster is this section, in a form you can print.
3. Who checks the output, and how often
CQC summarises Regulation 17 on its AI page as “adhering to regulation, effective risk management systems, and monitoring outputs”, and its principles say outputs are “continuously monitored and evaluated”.
Name a person. Say what they check and at what rate. Say that checking does not stop when the pilot does — that is the commitment services most often quietly drop.
4. What AI must never be used to decide
Care decisions, risk levels, eligibility, and whether to raise a safeguarding concern. CQC’s first principle is “AI to support, not to replace”.
Write the line down, because it is the one that will be tested by someone reasonable trying to save time.
5. What to do when it goes wrong
CQC asks for “established systems to recognise, report and investigate when something goes wrong so that lessons are learned and solutions implemented”.
One sentence: who to tell, and what happens next. If staff do not know how to report an AI error, you will not hear about the small ones, and the small ones are the warning.
6. Who owns the policy and when it is reviewed
A name and a date. Supplier terms change without telling you — two of the four assistants we checked had renamed or restructured within the year. A policy naming a company that no longer exists under that name is not reassuring.
What not to put in it
A definition of artificial intelligence. Nobody needs it, and it dates fast.
A position on whether AI is good. The policy governs use; it is not a manifesto.
Aspirations. “We will use AI ethically and responsibly” commits you to nothing and tells a member of staff nothing. Every line should be something a person could follow or breach.
Anything you will not actually do. A policy promising monthly audits that never happen is worse than one promising quarterly audits that do. It is evidence against you rather than for you.
Getting it signed off
For a charity, take it to the board. Trustees carry responsibility for how the organisation handles the data of people it supports, and the Charity Digital Skills Report found 57% want training for leaders and trustees — the appetite is usually there.
Our board and trustee briefing is a one-page set of questions for that meeting. Expect to be asked what happens if the tool gets something wrong about a person’s care, and have section 5 ready.
Do it in an afternoon
If you would rather answer questions than fill in blanks, our free AI policy builder asks about your organisation and gives you a full policy, a one-page staff summary and an action plan as a Word document. It takes about fifteen minutes. It uses fixed wording based on CQC, ICO and DHSC guidance, and marks anything you are not sure about as a gap rather than guessing. You still read it, fill the gaps and take it for sign-off.
To write it yourself:
- Open the one-page AI use policy template.
- Fill in the approved tools and accounts. If you have not decided, that decision is the work — do it first, using the tool directory.
- Name who checks output and how often.
- Name who to tell when it goes wrong.
- Put a review date on it, no more than a year out.
- Print the poster and put it where people work.
A policy does not make AI safe. It makes it possible to show how you decided, which is what CQC and the ICO will both ask. And it is the cheapest gap in the sector to close: an afternoon puts you ahead of half of it.