AI use policy for a board of directors

Directors use AI tools to read board packs, draft resolutions and prepare for meetings, usually on personal devices with the company's most confidential information, and the board is also the body responsible for deciding what the company does about AI across the business; both engage the directors' duties under the Companies Act. The policy sets the rules for directors' own use of tools on board material, keeps the judgement the director's, gives the board the oversight framework for management's AI use, and provides the governance statement investors and buyers now ask for. The AI use policy and the contract provisions that go with it are drafted for the business for a fixed £995 and delivery in five working days.

Who this is for

Boards of private companies, subsidiaries, charities and other organisations in England and Wales, and company secretaries and chairs who have been asked what the board's position on AI is.

What matters in a board's AI use policy

Directors' duties and the decision to adopt or ignore AI

A director must act in the way they consider most likely to promote the success of the company under section 172 of the Companies Act 2006, must exercise reasonable care, skill and diligence under section 174 (judged against what a reasonably diligent person with the knowledge and experience of a director in that role would do, and the director's own greater knowledge), and must exercise independent judgement under section 173, and a board that has not considered what AI means for the company, or has adopted it without understanding, has a question to answer under both sections; the policy begins with the board's decision, minuted, on the company's approach (where AI is used, the risks identified, the responsibility assigned, the review cycle), because the minute is the evidence of the board having applied its mind.

Board papers, confidential information and the tool a director uses at home

confidential information, trade secrets and clients' data must not be entered into tools whose terms permit the provider to use inputs for training or to retain them, which the Trade Secrets (Enforcement, etc.) Regulations 2018 and the business's own confidentiality obligations make a question of reasonable steps, and a board pack (the management accounts, the strategy, the acquisition under consideration, the litigation, the personnel matter, the price-sensitive information of a listed group) is the most confidential document a company produces; the policy prohibits board materials entering consumer tools on personal accounts, provides the tools a director may use (the board portal's own features; a business account the company provides with training excluded) and the uses, and requires non-executive directors with several boards to keep each company's material separate.

Minutes, decisions and the judgement the law requires to be the director's

Section 173 requires each director to exercise independent judgement, and section 174 requires the care and skill of the director personally, so that a board decision taken on a tool's recommendation without the directors understanding it is a decision the directors have not taken; the policy permits tools to summarise, analyse and draft, requires each director to have read the material the decision rests on and to be able to explain the decision in their own terms, prohibits tools from attending meetings or voting (a tool that transcribes a board meeting is a recording the board must agree to, with the minutes remaining the record under section 248), and requires generated minutes, resolutions and reports to be reviewed and owned by the person signing them, because the minute is the company's record and a generated error in it is the company's error.

Oversight, the management policy and the questions the board asks

The board does not write the operational AI policy for staff (management does) but it approves it, oversees it and asks the questions: which tools the company uses and on what data, what the risks are (confidentiality, data protection, intellectual property, accuracy, discrimination, regulatory), who is responsible, what the incidents have been, what the suppliers' terms permit, what the company tells customers, and whether the impact assessments under Article 35 of the UK GDPR exist; the policy sets the reporting the board receives (a standing item or an annual report, with incidents reported as they arise), the director responsible, and the questions the board puts to management.

Disclosure, investors and the governance a buyer will ask about

Investors, insurers, customers and acquirers now ask what the company's AI governance looks like, and a company whose answer is that it has none has a point against it in a sale, a funding round or a tender; the policy provides the governance statement the board can give (the board's responsibility, the operational policy, the data protection position, the supplier terms, the intellectual property position, the review cycle), aligns it with the company's other governance statements, and addresses the disclosure obligations that may arise for a listed or regulated company; the board should also know whether any of the company's tools take decisions about people that Article 22 of the UK GDPR as amended by the Data (Use and Access) Act 2025 restricts.

The contract provisions that go with the policy

The contract provisions drafted with the policy go into the directors' service agreements and letters of appointment (the policy incorporated, confidentiality of board material, the tools permitted, the obligations surviving departure), the company secretary's and the board portal provider's terms (the portal's AI features, training excluded, retention, the data processing agreement), the company's governance documents (the schedule of matters reserved to the board, the risk register, the committee terms of reference), and the operational policy's terms for staff and suppliers; personal data put into an AI tool is processed under the UK GDPR like any other, requiring a lawful basis, a notice to the people concerned, a data processing agreement with the provider under Article 28 and an impact assessment under Article 35 where individuals are affected, which the board oversees rather than performs; the policy is reviewed annually and when the company's use of AI changes materially.

What it costs

AI use policy, £995. Internal policy plus the accompanying contract provisions. Five working days.

AI provisions in a contract, £595. Review or draft AI-specific terms in a supply or customer agreement. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• An internal AI use policy your staff will follow, rather than a document that bans everything and is quietly ignored
• Contract provisions covering output ownership, training data, confidentiality and liability
• A defensible position to give customers who ask what your AI governance looks like
• Review of your AI suppliers' terms, including what they reserve the right to change
• Practical guidance on what to permit, what to restrict and what to prohibit outright
• One round of amendments

What is not included

• Technical AI assurance, model testing or bias auditing
• Sector-specific regulatory approval
• Advice on non-UK regulatory regimes beyond flagging where they apply
• Ongoing regulatory monitoring

Questions I am often asked

Can directors use AI tools to read board packs?

On the tools the company provides (the board portal's features, a business account with training excluded), not on consumer tools on personal accounts. A board pack is the company's most confidential document and the director's duty of confidence applies to it.

Is it a problem if the board relies on an AI analysis for a decision?

If the directors have not read the material and cannot explain the decision in their own terms, yes: the duties of independent judgement and reasonable care are personal. Tools may summarise and draft; the directors decide, and the minute records it.

What should the board's AI governance statement say?

The board's responsibility, the operational policy, the data protection position, the supplier terms, the intellectual property position and the review cycle, aligned with the company's other governance statements. It is what investors, insurers and buyers ask for.

Related guidance and services

• AI contracts and AI use policies, £995, the service this page describes
• Data protection agreements and privacy terms, £795
• Employment contracts and handbooks, £595
• Director service agreement
• AI use policy for a small business

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.