Why not wait until the full policy is finished?
Staff rarely wait for a policy. The National AI Centre says it is likely some staff are already using AI at work, whether or not there is an approved policy, and its policy guidance warns that without clear rules teams may use AI inconsistently, which creates unnecessary risk. A full policy can take a long time when it needs sign-off from legal, IT and leadership. Holding training until then leaves people using AI with neither rules nor skills. Training without any rule has its own problem: the session teaches whatever the tool allows, and staff assume that is permitted.
What must the interim policy say?
The interim version can be one page. The National AI Centre's guidance on creating an AI policy lists what a policy should clearly set out before it is published, and the same list works for a first version. Write a sentence or two under each heading below, using the terms staff already use. Mark the page as interim with a date for the full version, so nobody treats it as final.
- What AI can and cannot be used for.
- Who approves higher-risk uses.
- What information staff can put into AI tools.
- When staff need to oversee or check AI use.
- How staff report issues or misuse.
- When the policy will be reviewed.
Who should own the AI policy?
The National AI Centre's foundations guidance starts with accountability: assign a senior leader as the overall AI governance owner, with enough authority and understanding of AI to oversee its use, and create a policy that gives staff advice on AI risks and how to manage them. That person signs the interim policy and owns the full one. In a small organisation it may be the owner or general manager. A training provider, IT or HR can help draft it, but the owner needs to be someone who can answer staff questions and approve exceptions.
How does the workshop improve the policy?
The National AI Centre suggests testing a draft policy with the people who will use, review or oversee it. A workshop does that in practice. When staff try real tasks under the interim rule, the gaps show quickly: a task the rule does not mention, a kind of information nobody had considered, an approval step too slow to use. Ask the facilitator to record every policy question raised in the room, without names, and send the list to the policy owner. That list gives the owner concrete cases to resolve in the full version.
What should the full policy add?
The full policy builds on the interim rule with the governance practices the National AI Centre describes. Not every organisation needs all of them at once, and the foundations guidance says to adapt each practice to your organisation's size, uses and risk profile. Common additions are listed below. If AI use will change jobs significantly, consultation obligations may also apply, which our guide to training staff who are worried about AI covers.
- An AI register recording the tools in use, what they are used for and who is accountable for each.
- A risk screening step for new uses, such as anything that affects decisions about people.
- Rules on telling customers and others when AI is used.
- Human oversight matched to the stakes of each use, with points where a person can pause or override.
How often should the policy be reviewed?
Set a review date in the policy, as the National AI Centre's guidance recommends, and add triggers that bring the review forward: a new tool, a significant change to an existing one, an incident or a new kind of use. Tools change, so a policy written around product features dates quickly. Write it around kinds of use and kinds of information, and keep the list of approved tools in a separate register that can be updated without reopening the whole policy.