An AI Usage Policy Template for Finance Teams

As finance teams adopt AI, a clear policy on how it may be used — what is permitted, what is not, and the safeguards that apply — has become essential. Without one, people use AI in varied and uncontrolled ways, and the risks fall on a function that handles some of the most confidential information in the business. An AI usage policy sets out the permitted uses, the rules on sensitive data, the required safeguards and who is responsible, so AI is used in a controlled, consistent way.

This guide is written for Financial Controllers, Finance Managers and finance leaders establishing such a policy. It covers why a policy matters, the key elements, the sensitive-data rules, responsibilities and safeguards, implementation and the balance between control and useful adoption. It then sets out a ten-section template the team can adapt, with notes on UK GDPR, data protection impact assessments, the ICAEW Code of Ethics and, for FCA-regulated firms, the Senior Managers and Certification Regime. It is a framework rather than a fixed document: the right policy depends on the organisation’s circumstances and should sit within its wider IT, information security and data protection policies. Where the stakes are high, take legal and data protection advice. It should be read alongside our guides to AI data security in finance and how a Financial Controller uses AI.

Why an AI Usage Policy Matters

Without a policy, individuals make their own decisions about AI: some use it carelessly, some paste sensitive data into personal accounts, some rely on output without checking it. There are no consistent safeguards and no record of what was done. A policy addresses this by setting out how AI may be used, so the team works consistently and safely.

It matters particularly in finance because of the sensitivity of the data and the consequences of errors. Management accounts, payroll, customer data and deal information all need protecting, and an AI error that reaches a board pack or statutory accounts can be costly. A policy also gives the team clarity. Uncertainty tends either to inhibit beneficial use or to push it underground; clear rules enable confident use within known bounds. And increasingly, others will ask. Boards are asking about AI in finance, and auditors are asking about AI too. A written policy is the simplest evidence that the finance function has thought it through.

The Key Elements the Policy Should Cover

An AI usage policy for a finance team should cover the permitted and prohibited uses, so the team knows what is allowed; the rules on data, particularly sensitive and personal data; and the safeguards required, above all verification of output and human oversight. It should name the approved tools, since tools differ in how they handle data. It should set out responsibilities, including each individual’s responsibility for the work they produce with AI assistance, so accountability is clear.

It should also address compliance with data protection law and any regulatory requirements, record-keeping, training, how incidents are reported and how the policy itself is reviewed. The template below turns these elements into ten numbered sections.

An AI Usage Policy Template: Ten Sections

Adapt the wording to your organisation. Text in square brackets is for you to complete.

1. Purpose and scope

This policy governs the use of artificial intelligence tools, including generative AI chat assistants and AI features built into finance, spreadsheet and office software, by all members of [FINANCE FUNCTION], including contractors, interims and fractional staff. It applies to any work carried out for [ORGANISATION], on any device. It sits within [ORGANISATION]’s information security and data protection policies, which take precedence where they conflict.

2. Approved tools

Only the tools listed in the approved tools register, maintained by [ROLE], may be used for work. The register records each tool, its tier (consumer or enterprise), whether a data processing agreement is in place and the highest data classification it may be used with. Personal AI accounts must not be used for amber or red data. Requests to add a tool go to [ROLE] and IT. Our comparison of Claude, Copilot and ChatGPT for finance can inform that decision, but the provider’s own terms are the definitive source on data handling.

3. Data classification

All data must be classified before it is used with an AI tool:

• Green — public information, generic accounting concepts and standards, anonymised illustrative examples. May be used with any approved tool.
• Amber — management accounts, board papers, budgets and forecasts, operational financial data. Enterprise-tier tools with a data processing agreement only.
• Red — personal data such as salary records, individual expenses and customer financial data; M&A information under confidentiality obligations; regulatory submissions; privileged or contractually restricted material. Not to be used with AI tools without legal review and, where personal data is involved, a completed DPIA.

If in doubt, treat data as the higher classification.

4. Prohibited uses

Staff must not: enter amber or red data into consumer AI tools; use AI output in reporting, filings or communications without human review; rely on AI to perform calculations that feed reported figures without recomputing them in the source system or spreadsheet; use AI to make or materially inform decisions about individuals (pay, credit, eligibility) without [ROLE] approval; present AI-generated content to auditors, regulators or the board as independently verified when it has not been; or use AI to bypass any existing control or approval.

5. Human review

Every AI output used in work must be reviewed by a competent person before use. The depth of review should match the consequence: a draft internal email needs a read-through; variance commentary, board papers and anything feeding the accounts need figures traced to source and reasoning challenged. Our guide to human-in-the-loop AI controls sets out how to design this review.

6. Audit trail and record-keeping

For material outputs — anything used in management or board reporting, the year-end file or a regulatory return — the preparer records which tool was used, the prompt or a summary of it, the source data and who reviewed and approved the output. Records are kept with the working papers for [RETENTION PERIOD, in line with the organisation’s retention policy]. Using standard prompts from the team’s finance prompt library makes this easier.

7. Accountability

The person who uses AI remains responsible for their work, and AI assistance does not transfer or dilute that responsibility. [ROLE, e.g. the Financial Controller] owns this policy and the approved tools register for the finance function. [SENIOR ROLE] is accountable for AI use in finance overall. In FCA-regulated firms, this accountability is mapped to the relevant senior manager’s statement of responsibilities (see below).

8. Training

Everyone covered by the policy completes training on it before using AI for work and when it materially changes. Training covers the data classification, approved tools, how to review output and how to report an incident. Practical prompting skills are supported through the team’s prompt library and our guide to prompt engineering for finance.

9. Incident reporting

Anyone who enters data into the wrong tool, discovers an AI error in a document already issued, or suspects misuse must report it to [ROLE] immediately. Where personal data may be involved, the data protection lead is informed at once, because a personal data breach may need to be reported to the ICO within 72 hours of the organisation becoming aware of it. Prompt reporting is expected and will not in itself lead to disciplinary action.

10. Review cycle

[ROLE] reviews this policy at least [annually / every six months] and whenever a significant new tool is introduced, a material incident occurs or relevant law or regulation changes. The approved tools register is reviewed [quarterly]. Each review is recorded with its date and outcome.

How to Approach the Sensitive-Data Rules

The data rules are usually the most important part of a finance AI policy. They need to be clear and practical — usable rules about which data may go into which tools — rather than vague or unworkable prohibitions that people quietly ignore. The green, amber and red classification in section 3 does this, and it matches the framework in our AI data security guide.

The key distinction is between consumer and enterprise tiers. The underlying models are often the same; what differs is what happens to the data. Consumer plans may use conversations to improve models unless the user opts out, and do not include a processor contract with the organisation. Enterprise plans typically exclude customer data from training and include a data processing agreement. Confidentiality is a fundamental principle of the ICAEW Code of Ethics, with equivalent requirements in the ACCA and CIMA codes, so a chartered accountant who pastes client or employer data into a consumer tool may breach their professional obligations as well as company policy.

UK GDPR, the ICO and DPIAs

Where AI tools process personal data, the organisation is the data controller and must comply with the UK GDPR. The ICO’s guidance on AI and data protection makes clear that responsibility stays with the organisation even when the tool is provided by a third party. The provider acts as a processor, and Article 28 requires a written contract with it before processing begins — consumer tools do not provide one.

A data protection impact assessment is required where processing is likely to result in a high risk to individuals, and the ICO lists innovative technology, including AI, among the factors pointing towards one. In practice, a finance team planning to use AI with payroll, expenses or customer data should expect to complete a DPIA first, with the data protection lead. Where AI informs decisions with legal or similarly significant effects on individuals, the UK GDPR’s automated decision-making rules apply, as amended by the Data (Use and Access) Act 2025.

The Responsibilities and Safeguards to Set Out

On responsibilities, the policy should make clear that individuals using AI must do so within the permitted uses and rules, and that they are responsible for the output they use, including verifying it. The finance professional remains responsible for their work, including anything AI helped with, so AI use must not diffuse responsibility.

On safeguards, the policy should require verification of AI output, particularly anything factual or consequential; human oversight and judgement; care with sensitive data; and use of approved tools only. Calculations deserve a specific mention: language models can make arithmetic errors, so figures used in reporting should be computed and checked in the spreadsheet or finance system, not taken from AI output.

FCA-regulated firms: SMCR accountability

The FCA’s approach to AI in financial services applies its existing rules to AI rather than creating a separate regime — including the Senior Managers and Certification Regime, the Consumer Duty and systems and controls requirements. Regulated firms remain accountable for outcomes produced with AI assistance. In practice, AI use in the finance function should map onto an existing statement of responsibilities — typically the senior manager holding the finance function — rather than being left unallocated, and the policy’s accountability section should say so. Our explainer on SMCR for finance teams sets out how the regime works below board level.

How to Implement and Maintain the Policy

A policy must be implemented, not merely written. That means communicating it, making sure people understand it through training, and embedding it in how the team works — for example by building the data rules and review requirements into the team’s prompt library and month-end checklists. Ask staff to confirm they have read it, and make the approved tools register easy to find.

Maintaining it means keeping it current. AI tools change quickly and a policy written once will date. The review cycle in section 10 keeps it aligned with new tools, the team’s evolving use and changes in law and regulation. A policy that is implemented and maintained is a living framework; one that is written and filed gives little protection.

Balancing Control With Enabling Beneficial Use

An effective policy balances controlling risk with enabling the beneficial use of AI. A policy that is too restrictive — banning most use or hedging it with unworkable rules — may protect against risk but forgoes the value AI can bring, and often drives use onto personal devices where there is no control at all. A policy that is too permissive fails to protect the data and the accuracy of the accounts.

The right balance permits and encourages AI for tasks and data where it is safe and useful, such as drafting variance commentary in an approved tool, while restricting the uses and data that carry real risk. That requires a genuine understanding of where AI helps and where it is dangerous in finance, rather than blanket restriction or blanket permission.

Frequently Asked Questions

Does a small finance team need a written AI policy?

Yes, though it can be short. Even a two-person team handles confidential and personal data, and a one-page version of the ten sections above gives clarity and evidence for auditors.

Should finance write its own policy or follow the company one?

Follow the organisation-wide policy where one exists, and add a finance annex covering finance-specific data, review requirements and record-keeping. Where no company policy exists, the finance policy is often the first.

Do interim and fractional staff need to follow the policy?

Yes. Scope should cover contractors, interims and fractional staff, who must use the organisation’s approved tools rather than their own accounts for amber or red data.

Who should own the AI usage policy in finance?

Usually the Financial Controller or Head of Finance, working with IT and the data protection lead. In FCA-regulated firms, ultimate accountability should sit with the relevant senior manager.

If you need someone to write and run this policy, our Financial Controller recruitment team can help, including for FCA-regulated firms. SMF16 and SMF17 appointments are handled by our sister firm SMF Capital, and CFO searches by FD Capital.