A practical checklist for using AI tools at work in the UK: policies, data protection, confidentiality, checking output, transparency, and good tasks to start with.
AI tools can save time on drafting, summarising and analysis, but using them at work brings risks for confidentiality, data protection and accuracy. This checklist covers the main points for employees and small employers. It isn't legal advice; organisations handling significant personal data should take advice.
For employees: before you start
- Check the policy. Does your employer allow AI tools, and which ones? Many organisations approve specific tools with business contracts.
- Use approved accounts, not personal ones, for work tasks.
- Know what's confidential: customer data, personal information about colleagues, financial results, unpublished plans and anything covered by a non-disclosure agreement.
- Ask if unsure. Your manager, IT team or data protection officer can tell you what's allowed.
Protect data
- Don't paste personal data into unapproved tools. Under UK GDPR, organisations must have a lawful basis and appropriate safeguards for processing personal data, including through AI.
- Remove names and identifying details where you can.
- Be careful with uploads: documents often contain more than you realise, such as tracked changes, comments and metadata.
- Check connected apps. AI features linked to email or shared drives may be able to access more than you intend.
Check the output
- Check facts, figures, names and references before using AI output. AI tools can produce confident errors.
- Check for bias, particularly in anything affecting people, such as job adverts or performance notes.
- Read it through: does it sound like your organisation, and is it right for the audience?
- You remain responsible for the work you submit.
Be transparent
- Follow your organisation's rules on disclosing AI use.
- Don't present AI-generated analysis as your own expert judgement without checking it.
- Be careful with copyright: don't upload third-party material you don't have the right to use, and check the terms for generated content.
Good tasks to start with
- drafting emails and documents you then edit;
- summarising long documents you are allowed to share with the tool;
- creating outlines, agendas and checklists;
- explaining spreadsheet formulas or writing simple scripts;
- brainstorming ideas and alternative wording.
Tasks needing more care
- decisions about people, such as recruitment, performance or dismissal. The ICO has guidance on AI and fairness, and automated decisions with significant effects have specific legal rules;
- legal, financial or medical content;
- anything published under your organisation's name.
For small employers: a simple AI policy
- List which tools are approved and for what.
- Say what data must never be entered.
- Require output to be checked by a person.
- Set out who to ask, and how to report a mistake or data incident.
- Review the policy regularly as tools change.
If your use of AI involves personal data, consider a data protection impact assessment. The ICO's guidance on AI explains when one is needed.
Measuring whether it helps
Try AI on a few defined tasks for a month. Note the time saved and the errors you had to correct. Keep using it where the net benefit is clear, and stop where checking takes longer than doing the work yourself.
Security
Use two-step verification on AI accounts, watch for phishing emails pretending to be AI services, and be cautious about browser extensions claiming to add AI features, as some request broad access to your data.
Frequently asked questions
Do I need permission to use AI on my own work laptop?
If the device or data belongs to your employer, its policy applies. Ask before installing new AI apps or extensions.
Can my employer see what I type into AI tools?
On business accounts, administrators may be able to see usage and content. Assume work tools are monitored in line with your employer's policy.
What if I've already shared something I shouldn't?
Tell your manager or data protection lead promptly. Delete the chat if possible. Early reporting helps limit harm.
Sources and further reading
- ICO: Guidance on AI and data protection
- ICO: Data protection impact assessments
- NCSC: AI and cyber security, what you need to know
Facts checked on 20 October 2026. Spotted an error? Tell us and we will correct it.