Does my company need an AI policy? The rules that decide it

Data protection

Accountability

A controller is responsible for, and must be able to demonstrate, compliance with the data protection principles, including when staff put personal data into an AI tool (Article 5(2)).

Source: UK GDPR Article 5: principles, including accountability

High-risk processing

Processing using new technologies that is likely to result in a high risk to people's rights needs a data protection impact assessment before it starts (Article 35).

Source: UK GDPR Article 35: data protection impact assessment

Automated decisions

The Data (Use and Access) Act 2025 allows significant decisions based solely on automated processing in wider circumstances, but only with safeguards: information, a way to challenge and human intervention.

Source: GOV.UK: Data (Use and Access) Act 2025, data protection changes

Discrimination

Decisions about people

Treating someone less favourably because of a protected characteristic is direct discrimination (section 13), whether or not a tool made the recommendation.

Source: Equality Act 2010, section 13: direct discrimination

Selling into the EU

AI literacy

Article 4 of the EU AI Act requires providers and deployers of AI systems to take measures for the AI literacy of their staff. It has applied since 2 February 2025, with national enforcement from 2 August 2026.

Source: European Commission: AI literacy, questions and answers (AI Act Article 4)

No set level

Since the Digital Omnibus amendments of mid-July 2026, no specific or sufficient level of AI literacy is mandated; the obligation itself remains.

Source: European Commission: AI literacy, questions and answers (AI Act Article 4)

Voluntary

AI Cyber Security Code of Practice

The UK government's code, published 31 January 2025, sets out baseline cyber security measures for AI systems.

Source: GOV.UK: AI Cyber Security Code of Practice (31 January 2025)