If your business uses generative AI tools in its day to day operations, you need a written AI governance policy that assigns a named compliance owner, states approved tools, and defines human review before any AI output reaches a client, customer, prospective employee, supplier, or a decision. A UK business deploying AI in contracts, marketing, or client-facing work needs this policy regardless of sector. The UK government’s voluntary AI Cyber Security Code of Practice sets out thirteen principles for organisations developing or deploying AI, and one of them requires you to enable human responsibility for AI systems. This article contains a step by step guide for creating your own AI policy.

Summary

• You need a named AI Policy Owner who is accountable for the approved tool list and every update to it.
• Your policy should classify each AI tool by the risk it poses to personal data, client confidentiality, and decision-making before you approve it for use.
• You must build in human review before any AI-generated output reaches a client, a court, or a contract, because the Solicitors Regulation Authority expects supervision and accountability regardless of the technology used.
• Skipping a Data Protection Impact Assessment for a high-risk AI tool exposes you to a fine of up to £17.5 million or 4% of worldwide turnover, whichever is higher.
• Doing nothing leaves your business without a documented risk assessment to show a regulator or a court if an AI tool causes a data breach, a contractual failure, or a complaint.

On 21st July 2026, OpenAI disclosed that one of its own experimental models had broken out of a locked-down testing environment, reached the open internet, and used stolen credentials to access the production systems of Hugging Face, a company with no involvement in the test. OpenAI and Hugging Face described the episode jointly as an unprecedented cyber incident, and Hugging Face detected and contained the intrusion quick smart.

Hugging Face had governance in place strong enough to catch the intrusion quickly. Most businesses running far simpler AI tools, a chatbot drafting client correspondence, or a model screening job applications, have no equivalent to fall back on: no named owner for the decision to deploy the tool, no record of who classified its risk, and no fixed point at which a human checks its output.

To be frank, this is a disaster (or at least an expensive legal claim) waiting to happen.

A comprehensive AI governance policy ensures all of the above and more are accounted for and recorded. If your business uses AI tools, even the free to use public large language models, part of good corporate governance is having an AI governance policy in place.

How do you classify AI tools by risk?

When it comes to AI risk management, you must classify each AI tool by what it touches, personal data, client-facing decisions, or systems with wider access, then rank it from low to high risk before you approve its use within your organisation. A spreadsheet listing every tool, its purpose, its data access, and its risk tier is the minimum record you need.

The Information Commissioner’s Office treats AI as high-risk technology under the UK GDPR, so where an AI tool processes personal data, you must identify and assess the risks before deployment, not after a complaint. Article 35 of the UK GDPR requires a Data Protection Impact Assessment wherever processing is likely to result in a high risk to the rights and freedoms of natural persons. Automated decision-making with significant effects or the use of innovative technology such as generative AI is likely to fall under Article 35 requirements.

The following table sets out how to rank a typical AI tool by risk and what each tier requires before approval.

Is there a step by step guide for creating an AI policy?

We are glad you asked. Below is a simple to follow guide to help you create your business’s AI policy:

1. Audit current AI use

Ask staff which tools they already use, what data they type into them, and for what tasks, because informal use is usually wider than management expects.

2. Form a governance group

Bring together someone from legal, IT and operations to own the policy, or take this on yourself if you run a small firm.

3. Define purpose and scope

State in two or three sentences why the policy exists and which roles, tools and data types it covers.

4. Set principles and objectives

Write down the values you expect, such as fairness, transparency and accountability, alongside what you want AI adoption to achieve for the business.

5. Assess risk and legal compliance

Map where data flows through each AI tool, rank tools by risk, and check your obligations under UK GDPR and any sector rules that apply to you.

6. Draft usage rules

Set out what staff can do, what needs approval first, and what is off limits, including rules on entering client or personal data into public tools.

7. Assign accountability

Name one person as policy owner, name an approver for higher risk use cases, and set out how staff report a problem.

8. Build an approved tools register

Log each tool’s supplier, purpose, data classification and internal owner, and review the register every quarter.

9. Add training and communication plans

Explain the policy to staff directly, run a short training session, and store the document in your employee handbook.

10. Set a review cycle

Put a date in the diary to check the policy every six months, since AI tools and the law around them change quickly.

Once you have worked through the steps, the document needs five core sections to be usable day to day.

How often should you review the policy?

Review your AI governance policy at least annually and immediately after any material change: a new tool added, a regulatory update, or an incident involving an existing tool. A policy nobody has revisited since it was written will not reflect the tools you actually use or the law as it now stands.

Set a fixed review date in the policy itself, name the reviewer, and log every substantive change with the date and the reason for it. Produce this record to a regulator, an auditor, or a court if your AI use is ever challenged.

Frequently asked questions

Do we need a written AI governance policy if we only use one chatbot tool?

Yes, you need a written policy even for a single AI tool, because the ICO expects a documented risk assessment wherever personal data is involved, regardless of how many tools you run. A one-page policy naming an owner, the tool’s approved uses, and the human review point meets this requirement for a low-risk deployment.

Who is legally responsible if our AI tool causes a data breach?

You, as the controller of the personal data, hold primary responsibility for a data breach caused by an AI tool, even where a third-party supplier built the system. Your contract with the supplier can allocate cost and liability between you, but the ICO’s enforcement action targets the organisation that decided to deploy the tool.

Does the SRA require law firms to use a specific approved AI system?

No, the SRA does not tell firms which AI systems they can or cannot use. It expects firms to meet their existing regulatory obligations regardless of the technology, so appropriate governance, risk assessments, policies, training, and monitoring must exist whatever tool you choose.

Talk to 43Legal

If your business is deploying AI tools without a written governance policy, we can help you build one that assigns clear ownership, classifies your tools by risk, and sets out the human review points your SRA and data protection obligations require. Get in touch with our commercial legal services team to discuss your situation.

Last reviewed: August 2026

The content of this article is for general information only.  It is not, and should not be taken as, legal advice.  If you require any further information in relation to this article, please contact 43Legal.

Melissa Danks is the founder of 43Legal. She has over 20 years’ experience as a solicitor working within the legal sector dealing with issues relating to risk management, dispute resolution, and advising in-house counsel in SMEs and large companies. Melissa has extensive expertise in providing practical, valuable, modern legal advice on large commercial projects, joint ventures, data protection and GDPR compliance, franchises, and commercial contracts. She has worked with stakeholders in multiple market sectors, including IT, legal, manufacturing, retail, hospitality, logistics and construction. When not providing legal advice and growing her law firm, Melissa spends her time running, walking in the countryside, reading and enjoying downtime with close friends and family.