Question 1

Do I need an AI policy?

Accepted Answer

No single UK law requires you to have one, but the risk of operating without one is real and growing. If your team uses AI tools, you already have AI governance decisions being made, just informally and inconsistently. An AI acceptable use policy documents those decisions, sets clear boundaries, and gives you something to point to when a client, insurer or regulator asks what your approach is. Most UK businesses that experience AI-related problems - a data breach involving an AI tool, a client dispute over AI-generated work, or an employee using an unapproved tool on a sensitive project - do not have policies in place before the problem happens.

Question 2

What happens if my staff use ChatGPT without permission?

Accepted Answer

If an employee enters client data, commercially sensitive information or personal data into a public AI tool without your knowledge, you may have breached your obligations under UK GDPR. The ICO does not accept 'we did not know' as a defence. You could also be in breach of client confidentiality clauses, even if those contracts do not mention AI specifically. An AI acceptable use policy, combined with clear guidance to your team, is the practical way to close that exposure.

Question 3

What is shadow AI?

Accepted Answer

Shadow AI refers to the use of AI tools by employees without their employer's knowledge or approval. Research from Microsoft and Censuswide in 2025 found that 71% of UK employees have used unapproved AI tools at work, with 51% doing so weekly. The risk for businesses is that unapproved tools may not meet your data handling standards, may process client data in ways you have not assessed, and create liability you are unaware of. An acceptable use policy defines which tools are approved and what rules apply.

Question 4

Is AI governance required by law in the UK?

Accepted Answer

There is no single UK AI law. The UK operates a principles-based approach where existing sector regulators apply their own frameworks: the ICO on data protection, the FCA on financial services, the CMA on competition. However, UK GDPR already creates obligations that apply directly to AI use, including rules on automated decision-making, data minimisation and lawful basis for processing. The EU AI Act applies to UK businesses that place AI systems on the EU market or whose AI outputs are used in the EU. The Data (Use and Access) Act 2025 introduced new requirements for significant automated decisions. While no single law mandates a policy document, several laws create obligations that a policy helps you meet.

Question 5

What documents do I need for AI governance?

Accepted Answer

The answer depends on how your business uses AI. Most UK businesses using AI tools need at minimum an AI Acceptable Use Policy covering which tools are approved, what data can be entered and what human oversight is required. If you use AI on client work you also need a Client and Customer AI Disclosure Policy. If you process personal data through AI tools, a Data Handling Policy and potentially a DPIA are required. If you produce AI-assisted creative work, an IP Ownership Policy clarifies who owns what. Groundwork generates the specific documents your business needs based on how you actually use AI, rather than producing a generic pack.

Question 6

What is an AI acceptable use policy?

Accepted Answer

An AI acceptable use policy defines which AI tools your team is allowed to use, what types of data can be entered into them, what AI cannot be used for, and what oversight is required before AI-generated work is used or shared. It is the foundational governance document for any business using AI. Without one, your team makes individual judgements on all of those questions every day, with no consistency and no audit trail.

Question 7

What is a DPIA and do I need one for AI?

Accepted Answer

A DPIA (Data Protection Impact Assessment) is a formal assessment required under UK GDPR when processing personal data is likely to result in a high risk to individuals. AI tools that make automated decisions about people, process special category data or involve large-scale profiling are likely to trigger the requirement. The ICO expects businesses to conduct a DPIA before deploying such systems, not after. Groundwork generates a DPIA template for businesses whose AI use meets the threshold, pre-structured for the ICO's requirements.

Question 8

What does an AI policy need to include?

Accepted Answer

A complete AI acceptable use policy should cover the purpose and scope of the policy, a list of approved tools and any prohibited tools, rules on what data can and cannot be entered into AI systems, requirements for human review of AI outputs before use, guidance on transparency with clients and customers, and a review schedule. Sector-specific clauses may be needed for businesses in regulated industries including financial services, healthcare and legal. Groundwork generates a policy personalised to your sector and AI use, rather than a generic template you need to adapt yourself.

Question 9

Do I need to tell clients I am using AI?

Accepted Answer

UK law does not currently require blanket disclosure of AI use to clients. However, your existing contracts may contain clauses about the use of subcontractors, tools or third-party services that could be interpreted to require disclosure. Many agency and professional services contracts now include explicit AI clauses following the ISBA and IPA updated Creative Services Framework in 2025. If a client asks directly whether you use AI and you say no when you do, that creates a misrepresentation risk. The practical approach is a clear policy on when and how you disclose AI use, which is what the Client and Customer AI Disclosure Policy covers.

Question 10

Could I be breaching a client contract by using AI without realising it?

Accepted Answer

Yes. If your client contracts contain confidentiality clauses, restrictions on subcontracting, or requirements that work is original and created by named individuals, using AI tools without disclosure could put you in breach. This is a common concern for creative agencies, PR firms and professional services businesses. The risk is not theoretical: agencies have faced client challenges over AI-generated work that was delivered without disclosure. A Client Disclosure Policy sets out when you tell clients about AI use and how, which protects both parties.

Question 11

Who owns copyright in AI-generated work in the UK?

Accepted Answer

This is genuinely unsettled territory. Under the Copyright, Designs and Patents Act 1988, computer-generated works can attract copyright protection where there is no human author, with the copyright owned by the person who made the arrangements for the work to be created. For AI-assisted work where a human has made significant creative decisions, standard copyright may apply. For work where AI has done the heavy lifting with minimal human input, the position is less clear. The UK government's consultation on AI and copyright was ongoing as of March 2026. An IP ownership policy documents your position clearly, which is particularly important when delivering AI-assisted work to clients who will rely on owning the copyright in what you produce for them.

Question 12

Does the EU AI Act apply to UK businesses?

Accepted Answer

Yes, in many cases. Brexit did not exempt UK businesses from the EU AI Act if they place AI systems on the EU market, if their AI systems produce outputs used in the EU, or if they monitor the behaviour of people in the EU. The main high-risk AI system requirements come into full force in August 2026. If you have EU clients, deploy AI tools that EU-based individuals interact with, or supply AI-powered products to EU organisations, you need to understand your obligations. Groundwork's documents include EU jurisdiction addendums for businesses with EU exposure.

Question 13

What does the EU AI Act mean for small businesses?

Accepted Answer

For most UK SMEs the EU AI Act creates two main obligations. First, if you use AI systems that interact with people, Article 50 requires transparency: people must be told they are interacting with an AI. Second, if you deploy AI in high-risk contexts including recruitment, credit assessment, education or critical infrastructure, more substantial requirements apply including conformity assessments and human oversight mechanisms. For creative agencies and professional services firms using AI for writing, image generation and analysis, the obligations are relatively light but disclosure requirements still apply for client-facing AI outputs.

Question 14

What documents does Groundwork generate?

Accepted Answer

Groundwork generates up to six documents based on your answers: an AI Acceptable Use Policy (always included), a Client and Customer AI Disclosure Policy (if you use AI on client work), an AI Data Handling Policy (if you process personal data through AI tools), an AI Output and IP Ownership Policy (if you use generative AI for creative outputs), a Supplier and Vendor AI Policy (if you use multiple AI tools or manage vendors), and a DPIA Template (if your AI use involves high-risk data processing). You only receive the documents relevant to your situation.

Question 15

Are the documents legally valid?

Accepted Answer

The documents are practical governance tools based on current UK and EU regulatory guidance as of the date of generation. They are not legal advice and should be reviewed by a qualified solicitor before being relied on for regulatory or compliance purposes in complex situations. For most UK SMEs using standard AI tools in their work, the documents provide a solid, well-researched starting point that covers the main areas of risk. Groundwork holds Cyber Essentials certification and the documents are cross-referenced against current ICO guidance, UK GDPR, the EU AI Act and relevant sector standards.

Question 16

How long does it take?

Accepted Answer

About five minutes. You answer 22 questions about your business and how you use AI. Your documents are generated and delivered by email, usually within ten minutes of completing your session.

Question 17

What happens when regulations change?

Accepted Answer

The documents include a regulatory reference appendix showing exactly what guidance they have been checked against and when. If you add Groundwork Maintain for £59 per year, we monitor UK and EU regulatory developments and update your documents automatically when a material change occurs. You receive updated documents by email with a plain-English explanation of what changed and why. Updates are event-driven, not on a fixed schedule: in periods of regulatory stability you may receive no updates; in active periods you may receive several.

Frequently asked questions

Do I need this?

What do I actually need?

AI and client work

The EU AI Act and UK businesses

About Groundwork