ChatGPT and AI Tools at Work: Employer's Policy Guide

Your employees are almost certainly already using ChatGPT, Gemini, Copilot, and other AI tools at work. The question is not whether to permit it, but how to ensure they use it in a way that protects your business, your clients, and your legal obligations.

Why You Need an AI Use Policy Now

An AI use policy is no longer optional for UK employers. The risks of unmanaged AI use in the workplace are real and documented:

• Employees entering client data, financial information, or personal data into consumer AI tools, creating data protection breaches
• Employees submitting AI-generated work without checking it, including factual errors or hallucinated legal references
• Copyright infringement from AI-generated content trained on third-party material
• Client confidentiality breaches where commercial information is shared with AI tools
• Regulatory risk in sectors where advice, assessments, or outputs must be human-verified

Without a policy, you have no contractual basis to take disciplinary action when employees misuse AI tools, and no defence if a client or regulator asks what controls you had in place.

Understanding the Data Risk

Consumer AI tools (free or standard tiers): When employees use consumer versions of ChatGPT, Gemini, or Claude, the terms of service typically permit the provider to use inputs to improve the model. An employee who pastes a client contract, financial accounts, or employee personal data into a consumer AI tool has potentially shared that data with a third party whose data retention and processing practices are not under your control.

Enterprise AI tools: Enterprise versions of these tools (ChatGPT Enterprise, Microsoft Copilot for Microsoft 365, Google Gemini for Workspace) offer data processing agreements under which your data is not used for model training. These require specific commercial agreements and typically cost significantly more.

UK GDPR implications: If an employee inputs personal data (employee information, customer records, medical data) into a consumer AI tool, this may constitute a data transfer to an international third party without adequate safeguards, a breach of your data protection obligations, and potentially a reportable breach depending on the volume and sensitivity of the data.

Copyright and Intellectual Property Considerations

AI-generated content creates intellectual property uncertainty:

Input copyright: Feeding third-party copyrighted material into an AI tool to generate derivative work may infringe that copyright. Employees who use AI to summarise, adapt, or repurpose third-party content are creating infringement risk.

Output copyright: The intellectual property status of AI-generated output under UK law is evolving. The Intellectual Property Office has consulted on this area. Currently, the most defensible position is that AI-generated work created in the context of employment is work product owned by the employer, but the position is not entirely settled.

Your clients' concerns: Many commercial clients now include AI use clauses in contracts, requiring suppliers to disclose whether AI was used in generating deliverables, restricting use of specific tools, or requiring human review of AI output. Check your client contracts.

Accuracy and Professional Risk

AI tools hallucinate. They produce confident, well-structured text that may contain:

• Incorrect legal citations or case references that do not exist
• Outdated statutory figures or superseded regulations
• Inaccurate financial or technical information
• Plausible but factually wrong statements

In sectors where professional standards apply - law, accountancy, financial advice, healthcare - submitting or publishing AI-generated content without verification can constitute professional misconduct. Even outside regulated sectors, client complaints or contract disputes arising from AI-generated errors create commercial risk.

Your policy must require employees to verify AI output before using it, particularly for client-facing work.

What Your AI Use Policy Should Cover

A practical AI use policy for an SME should address:

1. Acceptable and prohibited uses

Acceptable uses (with appropriate verification):

• Drafting and editing internal documents and communications
• Research and summarisation (with source verification)
• Generating first drafts of policies, procedures, and templates
• Writing code or technical content (with review)
• Brainstorming and idea generation

Prohibited uses without specific authorisation:

• Inputting personal data about employees, customers, or third parties
• Inputting confidential client information or commercial data
• Generating client-facing advice, assessments, or recommendations without human review and sign-off
• Using AI output to fulfil a professional obligation without verification
• Misrepresenting AI-generated content as original human work where this is material

2. Data input rules

• No personal data (as defined by UK GDPR) into consumer AI tools
• No confidential business information into tools without enterprise data processing agreements
• No client data without the client's informed consent and confirmation of data processing arrangements

3. Approved tools List the specific AI tools that are approved for use, whether on enterprise or consumer tiers, and any restrictions that apply to each.

4. Verification requirements All AI-generated content used in deliverables, external communications, or professional outputs must be reviewed and approved by an accountable human before use. The accountable human takes responsibility for the accuracy and appropriateness of the content.

5. Disclosure Set out when employees must disclose that AI was used (to you, to clients, in regulated contexts).

6. Intellectual property Clarify that work product generated using AI tools in the course of employment is subject to your standard intellectual property provisions.

7. Consequences Specify that breach of the AI use policy is a disciplinary matter and may be treated as gross misconduct where client data or confidential information is involved.

Implementing Your Policy

A policy that employees have not read is ineffective. Implementation steps:

1. Draft the policy and have it reviewed by an employment solicitor (AI use policies are new enough that this is advisable)
2. Issue the policy as a formal update to your staff handbook with a requirement to read and acknowledge it
3. Train all employees on the key provisions, particularly the data input rules
4. Brief managers on the prohibited uses and the disciplinary process if the policy is breached
5. Review the policy every six months - AI tools and associated risks are evolving rapidly

Sector-Specific Considerations

Some sectors have additional considerations:

• Healthcare: Patient data is special category data under UK GDPR. Using consumer AI tools to process any patient information is a serious breach.
• Legal and financial services: Regulatory bodies including the FCA, SRA, and ICAEW have all published guidance on AI use. Check sector-specific requirements.
• Education: Use of AI by employees in assessment, marking, or student data contexts is subject to sector-specific guidance.

---

This is guidance, not legal advice. AI use policies intersect with data protection law, employment law, and potentially sector-specific regulation. Take legal advice before finalising your policy, particularly if your sector has specific professional standards that apply.