How to Build a Responsible AI Policy
Most organisations already have people using AI. Far fewer have agreed how. A responsible AI policy closes that gap: a short, plain document that says which tools your team can use, what they can use them for and who is accountable.
This guide walks through how to build one in seven steps. It is written for charities and purpose-led organisations, but it works for any small or mid-sized team.
What is a responsible AI policy?
A responsible AI policy sets out how your organisation uses AI safely, fairly and with its impact in mind. A good one runs to two or three pages, uses language everyone understands and answers the questions staff actually have:
- Can I use this tool?
- Can I put this information into it?
- Do I need to check the result?
- Do I need to tell anyone I used AI?
It is not a technical document. You do not need a specialist to draft it, although anything that touches personal data should be checked against your data protection obligations.
Why you need one now
- Your team is already using AI. Without guidance, each person makes their own call on tools and data.
- Sensitive information is at risk. It takes one person pasting personal or confidential details into a public tool.
- People are asking. Trustees, funders, supporters and service users increasingly want to know how you use AI.
- It saves money. Agreeing which tools you use means fewer overlapping subscriptions and less wasted use.
Step 1: Find out how AI is already being used
Before you write anything, ask. A short anonymous survey or an open team conversation will tell you which tools people use, what for and what worries them.
Make it clear that nobody is in trouble. You want an honest picture, and you will only get one if people feel safe describing what they actually do.
Step 2: Agree your principles
Principles come before rules. Four to six short statements are enough, for example:
- We use AI to support people, not to replace their judgement.
- We protect personal and confidential information.
- We check AI output before we rely on it.
- We are open about when we use AI.
- We consider the environmental impact of the tools we choose.
Involve people from across the organisation, including the sceptics. A policy shaped only by enthusiasts will be ignored by everyone else.
Step 3: Decide which tools are approved
List the tools your team may use and what each one is for. For every tool, find out how it handles what you type in: whether your input is used to train the model, and where it is stored.
Say what someone should do if they want to use a tool that is not on the list. A shorter list is easier to manage and usually cheaper.
Step 4: Set clear rules on data
This is the most important section. State plainly what must never go into an AI tool:
- personal data about service users, supporters or staff
- confidential or commercially sensitive information
- anything you would not be comfortable seeing made public
If you handle personal data in the UK, data protection law applies to AI in the same way as to any other use of that data. The Information Commissioner's Office publishes guidance on AI and data protection.
Step 5: Keep people in the loop
AI tools can be fluent and wrong. Decide where a person must review the output before it is used: anything you publish, anything sent to supporters or funders, and anything that informs a decision about an individual.
Be clear about accountability too. The person who uses the output is responsible for it, not the tool.
Step 6: Include environmental impact
This is the part most AI policies leave out. AI runs on data centres that use electricity and water, so how your team uses it has a footprint. A few practical commitments go a long way:
- Use AI where it adds real value, and a simpler tool where it does not.
- Choose smaller or more efficient tools for everyday tasks.
- Review automations regularly, so nothing runs constantly without a reason.
- Ask suppliers about their energy use and reporting.
The lower-impact choice is usually the lower-cost one as well. Our guide to Green AI covers this in more detail.
Step 7: Decide how you will tell people
Decide when you will disclose that AI was used, for example for AI-generated images or a chatbot on your website, and write a short public statement about your approach. You can see how we do this on our own transparency page.
Then train, publish and review
A policy nobody reads changes nothing. Walk your team through it, put it somewhere easy to find, name an owner and set a review date. Tools and rules are changing quickly, so review it at least once a year, or sooner if you adopt a major new tool.
What to include: a quick checklist
- Purpose and who the policy applies to
- Your principles
- Approved tools and how to request a new one
- Data rules
- Human review and accountability
- Environmental impact
- How you tell people about your AI use
- Training
- Owner and review date
Common mistakes
- Writing it alone. A policy handed down without discussion rarely sticks.
- Copying a template unchanged. A template is a starting point. Your tools, data and risks are your own.
- Banning everything. A blanket ban tends to push AI use out of sight, not stop it.
- Making it too long. If it does not fit on a few pages, people will not read it.
- Never reviewing it. An out-of-date policy is easy to ignore.
Getting started
The hardest part is usually the first conversation: getting people with very different views of AI into the same room and agreeing what matters. Once you have that, the policy is much easier to write.
For the wider picture, read our guide to Responsible AI.