Committee Report Checklist

Please submit the completed checklists with your report. If final draft report does not include all the information/sign offs required, your item will be delayed until the next meeting cycle.

Stage 1

Report checklist – responsibility of report owner

ITEM	Yes / No	Date
Councillor engagement / input from Chair prior to briefing	N/A
Relevant Group Head review	Yes	12-05-26
MAT+ review (to have been circulated at least 5 working days before Stage 2)	Yes	13-05-26
This item is on the Forward Plan for the relevant committee	Yes
	Reviewed by
Finance comments (circulate to Finance)
Risk comments (circulate to Lee O’Neil)	LO	29.05.26
Legal comments (circulate to Legal team)	JC	01.06.26
HR comments (if applicable)

For reports with material financial or legal implications the author should engage with the respective teams at the outset and receive input to their reports prior to asking for MO or s151 comments.

Do not forward to stage 2 unless all the above have been completed.

Stage 2

Report checklist – responsibility of report owner

ITEM	Completed by	Date rec’d
Monitoring Officer commentary – at least 5 working days before MAT	DMO J.Clare	01.06.26
S151 Officer commentary – at least 5 working days before MAT	T.Collier	13/5/26
Commissioner engagement	J kingston	10/6/26
	Delete as applicable:	No issues
	Delete as applicable:
Confirm final report cleared by MAT

Corporate Policy and Resources Committee

13 July 2026

Title	AI Policy 2026 Revision
Purpose of the report	To make a decision
Report Author	Tim Snook, Sustainability and Resilience Lead
Ward(s) Affected	N/A
Exempt	No
Exemption Reason	N/A
Corporate Priority	N/A
Recommendations	Committee[CT1] is asked to: To approve the revised AI Policy 2026.
Reason for Recommendation	The AI Policy adopted in 2024 included a provision[CT2] [TS3] [CT4] to continually update the policy to ensure its continued relevance and integrity. The Projects team has updated the policy to reflect current use cases and knowledge around AI, specifically Microsoft Copilot.

1. Executive summary of the report

What is the situation	Why we want to do something
· The current policy does not adequately reflect the latest AI capabilities. · Councillors and officers are already using AI in ways that are not covered by the existing policy. · Without changes, the Council risks exposing itself to security breaches	• The Council needs to strengthen its governance of AI to reflect current technology, tighten controls, and provide clear accountability for how AI is used across Council business.
This is what we want to do about it	These are the next steps
• Adopt a strengthened AI policy which mandates that Microsoft copilot be the only acceptable Generative AI (Gen AI) for council use, due to it being under the umbrella of the Microsoft 365 environment. • Enable Officers to input council sensitive and personal data into Microsoft Copilot, as it sits within the Microsoft 365 environment and therefore has the same levels of security and protections as all other Microsoft applications.	• Adopt the AI policy 2026 and allow publication and communication to all staff of the new policy and procedures around using Copilot with personal data. • The major alternative Gen AI options will be blocked from council devices and the web browser. • Training will be delivered through Microsoft learn to all staff. This will be disseminated through to managers to be shared directly with each team.

2. Key issues

2.1 The Council’s current Artificial Intelligence (AI) policy is no longer sufficient to address the pace, capability and growing use of Generative AI (Gen AI). Microsoft Copilot is now embedded across Microsoft 365 applications used by officers in their day-to-day work, meaning AI functionality is increasingly present in routine Council activity. At the same time, officers and councillors are already using, or seeking to use, AI in ways that fall outside the scope of the existing policy. Without a stronger and clearer framework, the Council is exposed to increased risks, including inappropriate use of AI, weaker governance and the potential for security or data breaches. The policy must therefore be strengthened urgently to reflect current technology, provide clear controls and accountability, and enable safe, proportionate use of AI across the organisation.

2.2 Further to this, officers have expressed their interest to the projects team in utilising the new tools of Copilot for elements of their work that are currently outside of what is permitted under the existing policy wording. The policy therefore needs to be updated to prevent misuse while enabling productivity benefits these tools are likely to provide.

2.3 The general increase in AI usage across the Council has meant that there is a greater need for strengthened controls, rules and clearer accountability for AI produced work.

2.4 The updated AI policy has addressed these issues through making the following changes:

2.5 Microsoft Copilot is now the Council’s only designated AI platform for work and organisational information, only[JT5] [SM6] [TS7] to be used when logged into a work Microsoft account. Use of other Gen AIs should not be done, unless specific Data Protection Impact Assessments (DPIAs) are completed for each instance requiring AI other than Copilot and approved by MAT.

(a) It requires users of AI to declare responsible and ethical use of AI through agreeing to these conditions when they sign into their device.

(b) Users will be able to use council-sensitive data, including personal data within Microsoft copilot, providing they:

i) Minimise sensitive/personal/financial/medical data used in Copilot, process in line with data protection principles.

ii) For each personal-data AI use case: complete the “Data Protection by Design for AI use” document (purpose, retention, risks to data subjects, privacy notice check/amendment, manager sign-off).

iii) Provide the completed information to the Projects and Data Protection Teams.

3. Options appraisal and proposal

3.1 Option 1: Adopt the AI Policy 2026.

3.2 Pros:

(a) A new, clear rule: Copilot is the only AI for Council work. Reducing the risks of multiple Gen AI models remaining unchecked within the organisation.

(b) The new policy enables for the first time, personal data and council sensitive information to be approved for use with AI. Increasing team efficiency with specific tasks. It also ensures safer handling of Council/personal data (within Microsoft 365 protections) when used with AI.

(c) The policy encompasses stronger governance, ensuring human review, accountability and reporting route for AI outputs.

3.3 Cons:

(a) For personal data to be used within Copilot, there is more admin to be completed. The DPIA-by-design paperwork and sign off for each personal data use case.

(b) The policy reduces flexibility to use other AI tools (extra assessment/approvals needed if they are required).

(c) Practical enforceability is limited: given the wide and evolving range of AI engines and third-party apps that route through AI services, the Council has little ability to police compliance in day-to-day use, or to reliably trace the origin of any misuse or data breach. The policy therefore relies primarily on staff awareness and a trust-based commitment to comply, rather than a wholly enforceable technical control.

3.4 Option 2: Reject the updated AI Policy 2026 and retain the existing policy.

3.5 Pros:

(a) Minimal to no material change of operations

(b) Flexibility of freedom to use any Gen AI model

3.6 Cons:

(a) The current wording allows officers to use any and all gen AI services, meaning that there is no organisational control present on Gen AI models outside of Microsoft Copilot.

(b) Currently, no personal or sensitive data can be used in any Gen AI under any circumstances. This means that some helpful functions of Copilot cannot be utilised and may lead to decreased productivity.

(c) Some officers may already be using AI outside of the parameters covered in the original wording, and therefore their actions are not covered under the policy.

4. Risk implications

4.1 The key risks of implementing the AI Policy 2026, and the assurance that those risks are mitigated by the policy and existing controls, are summarised below (low to high assurance).

Assurance	Risk	Key mitigations / controls (Policy 2026)	Residual risk / notes
Low	Inconsistent take-up and awareness of the policy (staff apply it unevenly).	Publication and communication of the policy and procedures. User acknowledgement and ethical commitment at logon. Clear rule-setting (Copilot is the only designated AI platform for Council work involving organisational information).	Requires active comms, refreshers and manager reinforcement; non-compliance may persist in pockets.
Low	Use of AI outside the approved environment (public AI used for Council work), leading to loss of control over data.	Policy prohibition on public/non-approved GenAI for organisational or personal data. Direction to use Microsoft 365 Copilot for internal documents, confidential information and Council operations/personal information. Escalation route for exploring other AI via Projects Team.	Relies on behaviour, monitoring and enforcement; greatest risk where personal devices are used.
Low	Poor quality or inaccurate outputs (“hallucinations”) used in reports/decisions.	Mandatory human review of all Copilot outputs before use or sharing. Explicit ban on Copilot as an autonomous decision-maker, especially for resident/service/budget/staff decisions. Requirement to verify accuracy and use trusted sources; do not use output if doubt remains.	Residual risk remains for time-pressured work and where verification is not straightforward.
Medium	Personal data is used inappropriately (excessive data, wrong purpose, insufficient transparency), creating UK GDPR compliance risk.	Use personal data in Copilot only where appropriate under Council data-protection policies. Data minimisation (sensitive/personal/financial/medical data must be minimised and secured). Per-use-case documentation: purpose, retention, risks to data subjects, privacy notice review, manager sign-off; share with Projects and Data Protection Teams.	Assurance depends on completion quality and oversight; DPIAs/records need to be auditable.
Medium	Over-permissioned access: Copilot surfaces information that a user technically has access to but should not routinely use, causing internal confidentiality incidents.	Copilot operates within existing Microsoft 365 permissions and access controls. Reinforce least-privilege and “need to know” access management via existing IG/ICT controls. Report suspected policy breaches to Information Governance/senior management.	May require parallel work to improve access hygiene (SharePoint/Teams permissions, document labelling).
Medium	Bias or discriminatory content leads to unfair communications, decisions, or reputational damage.	Policy requirement to promote fairness and avoid bias, ethical use obligations. Human oversight and review prior to use; do not rely on AI for eligibility/outcome decisions. Escalation for advice where appropriateness is unclear.	Residual risk where outputs are used in high-sensitivity contexts; consider targeted training and QA.
Medium	Copyright / IP infringement through reuse of AI-generated content or embedded third-party material.	Policy requires compliance with copyright law and prohibits infringing use. Instruction to seek Legal advice if unsure. Human review and editing of outputs before publication.	Still requires staff judgement; risk is higher for external-facing content and creative assets.
High	Regulated processing risks are reduced because Copilot runs within the Council’s Microsoft 365 tenant and safeguards (contractual/ICO DPIA alignment).	Copilot processing remains within Microsoft 365 environment, using existing security/access controls. ICO DPIA position acknowledged (Copilot uses organisational data under existing protections). Clear prohibition on public AI tools for internal/sensitive work.	High assurance assumes correct tenant configuration and continued adherence to permissions and governance.
High	Failure to detect/respond to misuse or suspected breaches (slow reporting increases harm).	Clear reporting requirement to Information Governance Team/senior management. Compliance section links non-compliance to disciplinary action and existing HR procedures.	Assurance depends on staff confidence to report and timely incident response processes.
High	Use of non-Copilot GenAI for Council activity without proper assessment (security, sovereignty, legal).	Policy position: other GenAI should not be used for Council activities. If exception needed: Projects Team review; comprehensive risk assessment; DPIA/security assessment and formal approval. Consider data sovereignty and provider practices.	Assurance increases where exceptions are rare and centrally governed; keep exceptions register.
High	Environmental impact (increased energy use from GenAI) undermines climate commitments.	Policy explicitly recognises AI environmental impact and links to GHG/Scope reporting context. Promote proportionate use (use AI where it adds value; avoid unnecessary prompts/processing).	Quantification is limited; may require future metrics/reporting as Scope 3 maturity increases.

5. Financial implications

5.1 There are none associated with the policy adopting but there may be a cost associated with any upgraded Copilot/ Gen AI tools[JT8] .

6. Legal comments

6.1 Council officers using AI must ensure the use complies with all applicable laws, regulations and Council policies at all times.

6.2 The use of AI must comply with data protection and ethical AI guidelines. This includes ensuring all AI systems and processes adhere to the General Data Protection Regulations (GDPR) and other relevant data protection laws. Ethical AI principles are to be observed such as transparency, accountability and fairness to prevent any potential misuse or bias in AI decision making.

6.3 Information produced by AI should be reviewed by Council officers for accuracy prior to sharing or using the information.

Corporate implications

7. Commissioners’ comments

7.1 No issues.

8. S151 Officer comments

8.1 The S151 Officer notes that are no direct financial implications arising from this report.

9. Monitoring Officer comments

The Deputy Monitoring Officer confirms that the relevant legal implications have been taken into account.

10. Procurement comments

10.1 There are none

11. Equality and Diversity

11.1 The adoption of the Artificial Intelligence Policy 2026 is not expected to have a negative impact on equality or diversity. The policy applies consistently to all officers and focuses on the safe, ethical and proportionate use of AI tools in the workplace, rather than on service eligibility or outcomes for specific groups.

11.2 However, there is a recognised risk that AI-generated outputs could unintentionally reflect bias, stereotypes, or exclusionary language if relied upon without appropriate oversight. To mitigate this risk, the policy explicitly requires human review of all AI outputs before use and prohibits the use of AI as an autonomous decision-maker. Officers are responsible for ensuring outputs are fair, accurate and appropriate before use.

12. Sustainability/Climate Change Implications

12.1 The policy specifically references the environment and sustainability impact of AI use, regarding the energy and water usage associated with the service. The policy builds on this in detailing AI’s context within the Councils’ greenhouse gas reporting under scope 3. To mitigate the impacts of AI on this, the policy promotes proportionate use of AI to ensure that users do not use it for unnecessary purposes and consider the environmental impacts.

In future, as reporting requirements and data around AI strengthens, the Council will be able to quantify its impact through use of AI. Currently, the data is limited, and so guidance is the only mitigating measure that can be relied upon.

13. Other considerations

13.1 The data protection officer consulted other data protection officers across Surrey to determine the AI policy’s similarity to other Surrey authorities. It was found that others have weaker internal policies that do not address personal data usage to the same extent that the proposed 2026 policy does.

13.2 The current draft AI policy 2026 strengthens the Council’s data protection and AI usage, aligning the Council more closely with the Information Commissioner's Office guidance on AI use and personal data protection. Something that is not found in other Surrey authorities.

13.3 Whilst the use of Gen AI outside of Copilot will not be permitted for organisational/work use, they will not be blocked from the council network/system, as individuals are still permitted to use them with their personal accounts. The key difference is that any and all work-related information cannot be used in any Gen AI other than Microsoft Copilot.

13.4 The IT team have stated that there will be no way of monitoring the use of Gen AI under this policy. However, the Council will block the major alternative Gen AI platforms from the Council network and device app stores. Ultimately, compliance must be upheld on a trust basis with staff following of the policy.

13.5 Microsoft provide their own training courses on copilot, free of charge, for anyone to go through. These courses are found on the Microsoft Learn website and will be shared with all staff through the management structure once the policy is adopted.

14. Timetable for implementation

14.1 Upon MAT approval, comms will be instructed to circulate this policy to all staff, and a small announcement will be made at the next available staff meeting. Microsoft learn Copilot training will be shared with all staff following this announcement.

15. Contact

15.1 Tim Snook, Sustainability and Resilience Lead, t.snook@spelthorne.gov.uk

Please submit any material questions to the Committee Chair and Officer Contact by two days in advance of the meeting.

Background papers: There are none.

Appendices:

Appendix A: AI policy 2026