Acceptable use: what staff may and must not do

Home › Acceptable use: what staff may and must not do

This is the part of the policy your staff will read most, so make the examples concrete and local, and keep the boundaries firm.

What staff may do

Set out the low-risk, genuinely helpful uses you want to encourage: drafting and adapting resources, summarising, planning, routine administrative writing. Always through approved tools and organisation accounts, and always with a person checking the output before it’s used.

What staff must not do

• Use AI tools that haven’t been approved, or try to get around filtering or monitoring to reach a blocked service.
• Enter personal or special-category data, meaning information about real, identifiable people, into an AI tool, unless it’s been approved for that specific purpose.
• Let AI make a decision about a person. In sensitive areas, even assistive use is prohibited unless it’s been expressly authorised, with a named person making and owning the decision.
• Pass off AI-generated material as their own unaided work where that would mislead, or break the JCQ rules on AI in assessments (which also rule out relying on AI as the sole marker of a student’s work).
• Upload third-party copyrighted or licensed material, such as published schemes of work, textbooks or exam papers, without the rights to do so.

Why it’s important

In my experience, by far the most common way personal data ends up in an AI tool isn’t a technical breach. It’s a well-meaning colleague pasting a name, a report or a case note into a chatbot to save a bit of time. That’s why the rule on what goes in is the one boundary you shouldn’t soften locally. The high-risk prohibitions are there because these are the decisions where an automated shortcut does the most damage.