Aipedia: Data protection consultants

Drafting AI acceptable use policies for clients

Aipedia, by the Apex broking team · Last reviewed 2026-10-27

Consultants who draft a client's AI acceptable use policy are shaping how staff handle personal data with AI tools. If the policy leaves gaps and a breach follows, the client may argue that the policy, and the adviser, failed it.

Part of: AI in Data protection consultants

In short

Clients ask data protection consultants for staff AI policies and governance frameworks: which tools are approved, what data can go into them, who signs off new uses and how incidents are reported. The UK GDPR points underneath are the security principle, processor terms under Article 28 and international transfers. A policy that is vague about public tools, personal data or approval routes leaves staff to guess. If a breach follows, the client may claim the consultant's drafting was negligent. PI usually responds to such claims, subject to the wording, but causation may be contested.

What clients ask for

Requests range from a two-page acceptable use policy for staff to a full AI governance framework with a register of uses, risk tiers, approval steps and training. Some clients may want it quickly because staff may already be using generative AI chatbots on their own accounts. Consultants may start from a template, and some use AI to adapt it, which can carry over clauses that do not fit the client's tools, sector or contracts.

A policy is only one part of governance. Larger clients may also want an AI register, a risk assessment step for each new use and a named owner for AI decisions, and the ICO's AI guidance hub includes an AI and data protection risk toolkit that can structure that work. Be clear which of these you are delivering, because a policy alone does not give the oversight a client may assume it has bought.

The duties behind the policy

Security: personal data must be protected by appropriate measures. Pasting customer or employee data into a public AI tool with no contract may fall short.
Article 28: an AI provider processing personal data for the client needs a compliant processor contract.
Transfers: data sent to a provider outside the UK needs a valid transfer mechanism.
Breach reporting: staff must know to report an AI-related incident quickly, so the client can meet the Article 33 timetable.
Article 39: a DPO's tasks include monitoring compliance with the client's policies, including training staff.

The ICO's AI and biometrics strategy signals scrutiny of how organisations govern AI.

Gaps that cause problems

Saying "do not enter confidential data" without defining personal data or giving examples.
Listing approved tools without explaining that personal accounts on the same tools are not approved.
No route to approve new uses, so staff work around the policy.
No link to the incident reporting procedure.
Ignoring AI features built into software the client already uses.
No training or monitoring, so the policy exists only on paper.

What can go wrong

Illustrative scenario: a consultant drafts an AI policy for a professional services client. It approves an enterprise AI assistant but does not say that personal accounts on public tools are prohibited. A staff member pastes a client's employee grievance file into a free chatbot to summarise it. The client treats this as a reportable breach and incurs costs responding. It then argues the policy was inadequate and that the consultant should have identified the gap.

How PI usually responds

A claim that a policy was negligently drafted is usually within PI cover, subject to the terms. The consultant's defence will often focus on causation: whether a better policy would have stopped a staff member who chose to ignore it, and whether the client implemented and trained on the policy. Where the consultant gave contractual assurances that the framework was "compliant", check how the policy treats contractual liability. For the breach side, see GDPR and data breach cover within PI.

Practical controls

Tailor the policy to the client's actual tools and contracts.
Give concrete examples of what must not go into AI tools.
Link the policy to vendor due diligence and the DPIA process.
Recommend training and periodic checks, and record whether the client accepted.
Make clear in the engagement that implementation is the client's responsibility.
Follow your own policy; see using AI on client files.

How Apex helps

Apex arranges PI for data protection consultants. A broker can review how your policy treats governance frameworks and template documents; see the data protection consultants' AI hub.

Sources

Frequently asked

What should a staff AI policy cover?

At minimum: approved tools, what data may and may not be used, how to get a new use approved, how to report an incident, training, and who owns the policy. It should reflect security, processor contract and transfer requirements under the UK GDPR.

Am I liable if staff ignore the policy I drafted?

Not automatically. A claim would need to show the drafting fell below a reasonable standard and that this caused the loss. Deliberate breaches by staff, and a client's failure to implement or train, are strong points on causation.

How often should an AI policy be reviewed?

There is no fixed rule. Review it when the client adopts a new tool, when a vendor changes its terms, after any AI-related incident and when significant ICO guidance is published, such as the planned statutory code on AI and automated decision-making.

Can I use a template AI policy for clients?

Templates are a reasonable starting point, but the finished policy must fit the client's tools, data and contracts. Unadapted clauses can be a source of gaps, particularly where AI has been used to adapt them.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.