Question 1

Does a UK company need an AI policy?

Accepted Answer

No UK law requires an organisation to have a standalone AI policy. Several laws make the absence of one costly: under UK GDPR you remain accountable for personal data staff paste into consumer AI tools, confidentiality duties to clients continue to apply, and employment and equality law still governs AI-assisted decisions. A short written policy setting out approved tools, prohibited data, human review and an approval route is the cheapest practical control most organisations can put in place.

Question 2

What should an AI acceptable use policy include?

Accepted Answer

At minimum: which AI tools are approved and on which account tiers (business, individual paid or free consumer); what data must never be entered into them; who checks AI-assisted work before it leaves the organisation; whether and how AI involvement is disclosed to clients; how someone requests a new tool instead of signing up quietly; what to do when something goes wrong, including the UK GDPR 72-hour breach route to the ICO; and who owns the policy and when it is reviewed. Intellectual property and staff training clauses are usually worth adding.

Question 3

Does the EU AI Act apply to a UK business?

Accepted Answer

Sometimes. The EU AI Act (Regulation (EU) 2024/1689) reaches providers and deployers established outside the EU where the AI system is placed on the EU market, used in the Union, or where the system's output is used in the Union. A UK organisation with EU customers, staff or operations may be in scope; a UK-only organisation with no EU nexus generally is not. This generator asks about EU nexus and includes the Article 4 AI-literacy clause only when the answer supports it, using ICO-framed training wording otherwise.

Question 4

Is it legal for employees to use ChatGPT at work in the UK?

Accepted Answer

Yes, subject to the same duties that govern any other tool. The practical constraints are data protection (customer and employee personal data entered into a consumer account is a disclosure the organisation is accountable for), confidentiality and contractual terms (some client contracts now restrict AI use outright), and accuracy (the person sending AI-assisted work remains responsible for it). Account tier matters: business and enterprise tiers generally exclude your content from model training, while free consumer tiers often do not.

Question 5

Are AI policy templates enough, or do you need a tailored policy?

Accepted Answer

A generic template fails at the points that matter: it does not name the tools your staff actually use, it does not state which account tiers are permitted, and it either ignores the EU AI Act or asserts obligations that do not apply to you. A tailored policy answers those questions specifically, which is also what makes it enforceable — staff can tell whether a given action breaches it.

Question 6

Is this AI policy generator free, and are the answers stored?

Accepted Answer

It is free and requires no account. The Word document is generated entirely in the visitor's browser, so the questionnaire answers are never transmitted to or stored by We Call Shotgun. Only the contact details entered at the download step (first name, email, organisation) are stored, so a copy of the policy can be emailed.