Your Staff Are Using AI at Work. Do You Have a Policy?

Andrew Weir • September 28, 2026

Right now, someone in your business is probably pasting client information into ChatGPT.

If that information includes anything personal or commercially sensitive, you could be looking at a UK GDPR breach. And the ICO will not accept that you did not know it was happening.

Most employees are already using AI tools regularly. ChatGPT, Copilot, Gemini, Grammarly, coding assistants. They use them because they are genuinely useful, and because nobody has told them not to. Or told them how.

That gap between everyone using it and nobody having any rules around it is where your risk sits.


The data protection problem

When an employee enters client information or personal details into a third party AI tool, that data may be stored externally.

Some tools use inputs to train their models, meaning confidential business information can end up embedded in a system you can't control or retrieve from.

Under UK GDPR, you are the data controller. You are responsible for how personal data is processed, even when it is your employee doing the processing, through a tool you never authorised.


The quality and reputation risk

AI is confident. It is also frequently wrong.

If someone on your team is using AI to draft client emails or reports without properly reviewing the output, those errors go out under your name.

The client does not know AI wrote it. They just know your business sent them something inaccurate.


The ownership question

If an employee uses AI to produce a piece of work, who owns it?

Your employment contracts almost certainly do not address this. That is fine right up until there is a dispute, at which point it is not fine at all.


The disciplinary gap

If an employee uses AI to write something and passes it off as entirely their own work, what is your position on that?

If you have no policy, you probably have no position. And without a position, taking disciplinary action that would hold up at a tribunal becomes very difficult.


What a proportionate AI policy looks like

You do not need a thirty page document. A clear one-page policy is enough to start with.

It should cover:

  • Which AI tools are permitted, and for what types of work
  • What data must never be entered into AI tools, including client data, personal data, financial information and anything commercially sensitive
  • How AI-generated output should be reviewed before it goes anywhere
  • When and how AI use should be disclosed, particularly in client-facing work
  • What happens if someone misuses AI or breaches the policy

It is also worth considering how your suppliers and vendors are using AI. Without asking, you could be exposed through your supply chain without ever knowing about it.


This is not about banning AI

A blanket ban is unenforceable. People will use these tools regardless, and pretending otherwise simply pushes the behaviour out of sight where you cannot manage it.

The point is proportionate boundaries. Your team should be able to use AI where it genuinely helps, without putting the business at risk.


How we can help

We can draft a proportionate AI use policy tailored to your business, covering your data protection obligations and giving your team clear, practical guidance on what is acceptable.

If you do not have one yet, now is the time.



Get in touch and we will help you put one in place quickly.

📞 0161 757 7576
📧 info@hrtoolbox.co.uk
🌐 www.hrtoolbox.co.uk

Get In Touch

What Your HR in 2027 Needs to Look Like

By Andrew Weir • November 9, 2026
Employment law is changing again in 2027. Here are five things to put on your HR plan now, from dismissal risk and contracts to managers and predictable work.
Manager listening and taking notes during an exit interview with a departing employee

How to Handle Negative Feedback During an Exit Interview

By Andrew Weir • November 2, 2026
Exit interviews are one of the few times an employee will tell you the truth. Here is how to handle tough feedback and turn it into changes that keep your people.

Could Your Small Business Be Ready for the UK's Salary Transparency Changes?

By Andrew Weir • October 26, 2026
Discover how the UK's proposed salary transparency changes could affect small businesses and how employers can prepare for potential reforms.
Small business owner reviewing employment law changes at a desk

The Real Cost of Managing Employment Law on Your Own

By Andrew Weir • October 19, 2026
Employment law has changed more in a year than in the last decade. Here is what it costs to manage it alone and what changes when you have an HR partner.

Menopause at Work: What Employers Actually Need to Do

By Andrew Weir • October 12, 2026
Menopause related tribunal claims have more than tripled in two years. Here is what the law expects, what reasonable adjustments look like and where employers get caught out.
Business owner reviewing employee records and documentation ahead of the new six-month tribunal time

What the New 6 Month Tribunal Time Limit Means for Your Business

By Andrew Weir • October 5, 2026
The tribunal time limit has doubled from three months to six. Here is what that means for your business, your records and the way your managers make decisions.
Business owner reviewing documentation for a some other substantial reason dismissal process

SOSR Dismissal: What It Is, When to Use It and How to Evidence It

By Andrew Weir • September 21, 2026
SOSR is not a catch-all for dismissals you cannot otherwise justify. Here is what it covers, what a tribunal expects to see and how to evidence it properly.

The cheapest way to avoid an employment tribunal

By Andrew Weir • September 7, 2026
Most tribunal claims start small. Here is how building a speak-up culture in your business reduces your exposure before problems ever become formal.

Could Your Business Be Breaching Workers' Rights?

By Andrew Weir • August 24, 2026
5.6 million UK workers have had their basic employment rights breached in the past two years. Most employers had no idea. Here is how to check whether yours are covered.

Facing a Tribunal Claim? Here's Why You Shouldn't Handle It Alone

By Andrew Weir • August 10, 2026
If a tribunal claim lands on your desk, you have 28 days to respond and what you do next really matters. Here is what to do and why professional support is worth it.
More Posts