One-page AI use policy
The clauses a one-page policy needs to cover, with a filled example beside each blank. Half the sector has no policy at all — this closes the gap in an afternoon.
The Charity Digital Skills Report 2026 found that 51% of charities have no AI policy, rising to 62% among small charities. This is the cheapest governance gap in the sector to close.
Keep it to one page. A long policy has one reader — the person who wrote it. See writing a one-page AI use policy for why each section is here.
Prefer to answer questions instead? The free AI policy builder produces a policy, a one-page staff summary and an action plan you can download as a Word document. It asks about your organisation, never about people, and stores nothing you type. Check the result the same way you would check this template.
Everything in [SQUARE BRACKETS] is yours to replace. The italic lines are a worked example from a fictional domiciliary service, to show the level of detail that is useful.
AI use policy
[YOUR ORGANISATION]
Version: [1.0] Date: [DATE] Review date: [DATE — no more than 12 months]
Owner: [NAME AND ROLE]
1. What this covers
This policy applies to everyone working for [YOUR ORGANISATION], including bank, agency and volunteer staff, whenever they use an AI tool for work.
2. Approved tools and accounts
Only these tools may be used for work, on these plans, signed in with these accounts:
| Tool | Plan | Account | What for |
|---|---|---|---|
| [TOOL] | [PLAN] | [WHICH LOGIN] | [WHICH TASKS] |
| [TOOL] | [PLAN] | [WHICH LOGIN] | [WHICH TASKS] |
Example: ChatGPT Business, signed in with your @[organisation] email, for job adverts, letters and policy drafting. Not for anything about a person we support.
Anything not on this list is not approved. Personal accounts are never approved for work, including paid personal accounts. The plan matters as much as the tool: personal plans do not carry a data processing agreement.
3. What must never be entered
Never enter into any AI tool:
- Names, addresses, dates of birth, NHS numbers or photographs of people we support
- Anything that identifies someone in combination, such as a rare condition in a small village
- Care records, incident records or safeguarding information
- Staff personal or HR information
- Anything about a person we support, in any unapproved tool, ever
Example: “the gentleman on the Tuesday round with the new hoist” identifies someone just as surely as his name does.
4. What AI must never be used to decide
AI must not be used to decide:
- Anyone’s care or support
- Anyone’s risk level
- Whether someone is eligible for a service, or how urgently they are seen
- Whether to raise a safeguarding concern
AI drafts and organises. People decide.
5. Checking
Every AI-produced draft is read and corrected by a person before it is used or saved.
Who checks routine output: [ROLE]
Who samples output, and how often: [NAME AND RATE]
Example: the care coordinator checks ten visit records a week against the original voice notes, and records corrections in the AI log. This continues indefinitely, not only during the trial.
Checking does not stop when a trial ends.
6. When something goes wrong
If an AI tool produces something wrong, or information is entered into a tool that should not have received it:
Tell: [NAME AND ROLE] How: [EMAIL / FORM / IN PERSON]
Reporting a mistake will not get you into trouble. Not reporting one might.
If personal data went into an unapproved tool, [NAME] will treat it as a potential data breach and follow our breach procedure.
7. Telling people
We tell the people we support, and their families where appropriate, that we use AI and what for, before we start. Our privacy notice says which tools we use and where data is held.
Anyone who does not want AI involved in their records can say so, and we will [WHAT YOU WILL ACTUALLY DO].
8. Before any new tool
Before a new AI tool is used with any real information about a person, we will:
- Ask the supplier our standard questions and keep the answers
- Get a data processing agreement in writing
- Complete a data protection impact assessment
- Tell the people affected
- Update this policy
Who approves new tools: [NAME AND ROLE]
9. Review
This policy is owned by [NAME] and reviewed by [DATE], or sooner if a supplier changes its terms.
Signed: [NAME] Role: [ROLE] Date: [DATE]
Before you file it
- Print the “never paste this” poster and put it where people work. The policy is the record; the poster is what people actually see.
- Take the board and trustee briefing to your next board meeting.
- Put the review date in a calendar, not just on the document.