AI policy for a newsroom

A practical guide, a starter policy and a tool-approval checklist for editors and publishers. It is a drafting aid, not legal advice and not a substitute for your own governance.

Guidance dated 30 October 2026 · Version 1.0 · Review by 30 April 2027 · UK English. Jurisdiction-dependent questions are marked where they arise.

How to use this guide

Policy development is an editorial process, not a menu of settings. Work through the five steps with the people who commission, report, produce and publish the work. Record the decisions and who made them.

1. Map current and intended use

   List every AI-assisted tool already in use, including free web tools and tools built into phones, cameras, editing software and office suites. Note the task, the material involved and who uses it. Ask freelancers and contributors too.

2. Decide what is permitted, what needs approval and what is prohibited

   Start from the work, not the vendor. A transcription tool used on a public press conference is a different decision from the same tool used on a confidential interview. Write the three lists and give examples.

3. Assign responsibility

   Name the person or role who approves tools and uses, who checks output, who handles incidents and who owns the policy. A policy without an owner is not operational.

4. Test the rules against realistic scenarios

   Use the fictional newsroom scenarios below, plus your own recent stories. Look for rules that cannot be followed on deadline, conflicts between desks and gaps around freelancers.

5. Approve, communicate and set a review date

   Record the approval, publish the policy where staff can find it, brief new starters and set a dated review. Reopen it when a tool, law or publication practice changes.

What the policy should cover

• Confidential sources and personal dataWhat must never be uploaded, pasted or described to an external service, and how local processing is configured.
• Accuracy and accountabilityWho verifies AI-assisted output, how it is checked against originals, and who signs off publication.
• DisclosureWhen audiences are told that AI was used, in what form, and who decides.
• Copyright, licences and consentRights in inputs and outputs, model terms, image and voice consent, and commercial restrictions.
• Generated and altered mediaRules for synthetic text, images, audio and video, including labels and prohibitions.
• Bias, language and harmKnown limitations, language coverage, testing, and foreseeable harm to people or groups.
• Tool approval and accessThe approved list, account settings, data controls, procurement and joining/leaving arrangements.
• Freelancers and third partiesContract terms, disclosure of AI use, personal accounts and material handling by contributors.
• Errors, breaches and exceptionsHow to report a mistake or data incident, who decides exceptions, and what happens next.
• Ownership, guidance and reviewThe policy owner, training, version control, review date and how staff ask questions.

Starter policy

Replace every bracketed placeholder. Keep the sections that apply, delete the rest and add local examples. The text is deliberately short enough to circulate for comment.

AI USE POLICY — [ORGANISATION]
DRAFT FOR APPROVAL · Version [0.1] · [DATE]
Owner: [ROLE OR NAME] · Approved by: [ROLE OR NAME] · Review by: [DATE]

How to read this template: text in [SQUARE BRACKETS] is an organisation decision. “Example:” marks an illustrative choice, not a requirement. Legal questions are identified in the guide and need local advice. This template is a starting point, not a compliance claim.

General principles: accuracy, transparency, accountability, lawful handling of material and minimising harm. The numbered sections turn these principles into local rules.

1. PURPOSE AND SCOPE
This policy sets minimum rules for using artificial-intelligence tools in [ORGANISATION]'s journalism. It covers editorial, production, design, audience and commercial staff, freelancers and contributors. It applies to text, images, audio, video, data and code, whether generated, edited or analysed with AI. It does not replace existing editorial, privacy, security or procurement rules.

2. PERMITTED, APPROVAL-REQUIRED AND PROHIBITED USES
Permitted without further approval: [e.g. transcription of public material with an approved tool; spellchecking; caption timing; public-data cleaning].
Requires written approval from [ROLE]: [e.g. transcription of interviews; translation of quotations; generating or altering images, audio or video; any tool handling unpublished, confidential or personal material].
Prohibited: [e.g. uploading confidential source material, personal data or embargoed documents to an unapproved service; generating quotes or fabricating evidence; publishing synthetic images, audio or video of real people or events as authentic; undisclosed alteration that changes the meaning of news media; using AI to make decisions about individuals without human review].
Example: a reporter may use an approved transcription tool on a recorded public press conference without extra sign-off, but must obtain approval before using any tool on an interview with a confidential source.

3. APPROVAL AND OWNERSHIP
The approved-tool list is maintained by [ROLE]. Approval is specific to a tool, version, account type and use. It records the intended use, data class, owner and review date. [ROLE] may suspend a tool immediately. Staff must not create work accounts for unapproved tools or connect them to newsroom systems.

4. CONFIDENTIAL MATERIAL, PERSONAL DATA AND RETENTION
Confidential source material, unpublished investigations, personal data and material under legal restriction must not be entered into a cloud, mixed or unknown-processing service unless [ROLE] has approved that use in writing. Local processing is not automatically safe: check device access, sync, storage, backups, plugins and shared folders, and make those arrangements suit the material.
Collect only the personal data needed. Record where material went and who could access it. Follow the approved retention plan: keep what the story, complaints process or legal hold requires; do not delete material subject to a legal hold, investigation or correction request. Provider-side deletion may not be possible or complete, so do not assume that deleting a file ends the provider’s copy.

5. ACCURACY AND EDITORIAL ACCOUNTABILITY
AI output is a lead, not evidence. A named journalist checks every quotation, name, number, date and factual claim against the original source. The person who publishes remains accountable. AI must not be used to invent quotes, sources, events or images, or to attribute statements nobody made. Where output cannot be verified, it is not published.

6. DISCLOSURE TO AUDIENCES
We disclose material AI assistance where it affects what the audience sees or hears, or where a reasonable reader would expect it. [ROLE] decides the wording and placement. Example: a translated quotation carries a note that the translation was machine-assisted and checked by a speaker of the language. Disclosure is not a substitute for verification.

7. COPYRIGHT, LICENCES, CONSENT AND OWNERSHIP
Use only material we have the right to use. Check provider terms for input and output rights, commercial restrictions and retention. Do not clone a person's voice or likeness without informed consent and editorial approval. Record licences and consents with the story file. Ownership of AI-assisted output may be uncertain; do not assume it is ours to license.

8. GENERATED OR ALTERED TEXT, IMAGES, AUDIO AND VIDEO
General principle: audiences must not be misled about what is real, and documentary material must not be presented as something it is not.
News and documentary media: do not publish synthetic images, audio or video of real people or events as authentic. Do not alter news photographs or footage beyond [e.g. cropping, exposure, colour balance and noise reduction]; any permitted change is recorded and follows the existing picture policy.
Illustrations: clearly labelled synthetic or AI-assisted illustrations may be used with [ROLE] approval, but must not be presented as documentary evidence or as a real person’s likeness without consent.
Generated text must not be presented as a direct quotation or as reporting by a person who did not write it. Voice and likeness: do not clone a person’s voice or appearance without informed consent and editorial approval. Manipulation that changes meaning is prohibited.

9. BIAS, LANGUAGE AND FORESEEABLE HARM
Test tools on the languages and accents we actually publish in, and record the limits. Do not present a tool as supporting a language unless that has been checked. A provider’s language list is not evidence of accuracy; use a fluent reviewer for consequential translation. Be alert to bias in search, classification, translation and generation, and to harm from inaccurate output about identifiable people. Escalate concerns to [ROLE].

10. THIRD PARTIES, FREELANCERS AND CONTRIBUTORS
Contributors must be told which tools are approved, must not put our material into personal accounts, and must disclose material AI use in commissioned work. Contracts should require compliance with this policy. [ROLE] decides whether a contributor's tool or output is acceptable.

11. ERRORS, BREACHES, EXCEPTIONS AND ESCALATION
Report errors, suspected data incidents and policy breaches immediately to [ROLE] and follow the existing corrections and incident processes. Do not hide, alter or delete evidence of a mistake or breach. Exceptions must be requested in writing, time-limited, recorded and reviewed by [ROLE]. A breach may lead to access being withdrawn and, where relevant, disciplinary or contractual action.

12. GUIDANCE, TRAINING AND REVIEW
This policy is published at [LOCATION]. New starters and freelancers receive a briefing. Questions go to [ROLE]. The policy is reviewed by [DATE] and after any significant change in law, tools or publication practice. This version: [DATE].

Tool approval checklist

Use one checklist per tool and use. Approval is not permanent: record the version, account type and review date. Copy it into your own document or ticketing system.

TOOL APPROVAL CHECKLIST — [ORGANISATION]
Tool and version: ................................................
Official URL: ...................................................
Intended journalism use: .......................................
Material and data class: public / internal / confidential / protected source / personal data
Owner (person accountable): ....................................
Approver and date: .............................................

1. INTENDED USE
   What task will it do? Which desk, role and story types? What is explicitly out of scope?

2. EVIDENCE OF SUITABILITY
   Provider documentation and independent evidence checked. Date and links recorded.
   Known accuracy limits:
   Documented languages, translation pairs and direction (source → target):
   Language evidence source and date:
   Hands-on test completed? Yes / No. What was tested, with what material?
   Review dates recorded separately for features, cost and privacy:

3. DATA HANDLING
   Local, browser, cloud, mixed or unknown processing:
   What is uploaded or transmitted?
   Retention, training, sharing and deletion terms:
   Is provider-side deletion possible or complete? What remains?
   Account, admin and access settings reviewed:
   Confidential or personal data permitted? Yes / No / With conditions:

4. RIGHTS AND TERMS
   Input and output ownership, licence and commercial restrictions:
   Consent needed for people, voices or likenesses:
   Provider terms and privacy policy links:

5. COST
   Free software / free tier / free trial / paid / unverified:
   Quota, currency and billing period:
   Cost evidence checked on:
   Who pays, and what happens when the free allowance ends?

6. CONFIGURATION
   Required install, device, browser, plugins or integrations:
   Logging, sync, autosave, training opt-out and sharing settings:
   Who administers the account and who can remove access?

7. RESPONSIBLE OWNER AND TRAINING
   Editor or product owner:
   Staff briefing completed:
   Support route and known failure modes:

8. APPROVAL STATUS
   Approved / Approved with conditions / Not approved:
   Conditions:
   Approved by: ...................... Date: ................
   Features checked: ................. Cost checked: .........
   Privacy checked: .................. Test status: ..........
   Review date: ..................... Next check due: ........

9. REVIEW AND WITHDRAWAL
   How will changes in cost, terms, features or law be detected?
   Who can suspend the tool, and how are staff told?
   Incident, correction and data-breach route:

Test your rules: fictional scenarios

These are invented examples, not guidance on the correct answer. Use them to find rules that are unclear or impossible to apply on deadline.

Jurisdiction and sources

Data-protection, copyright, disclosure and employment rules differ by country and change over time. The questions below are jurisdiction-dependent and need local advice:

• What counts as personal data, and on what basis may it be processed?
• When must an audience be told that AI was used, and in what terms?
• Who owns AI-assisted output, and what licence does the provider claim?
• What consent is needed for voice, likeness and biometric data?
• What sector rules apply to elections, health, children or financial reporting?

Checked references for further reading (checked 30 October 2026; external policies can change):

• BBC Editorial Guidelines — guidance on the use of artificial intelligence (newsroom practice on accuracy, disclosure and synthetic media).
• Reuters Institute — AI and the future of news (research and newsroom practice; orientation, not a rulebook).
• UK Information Commissioner's Office — AI guidance (UK data protection; jurisdiction-specific).
• South Africa Information Regulator (POPIA regulator homepage; orientation only, not a substitute for the Act or guidance).
• UNESCO — Recommendation on the Ethics of Artificial Intelligence (ethics framework, not a newsroom rulebook).
• Council of Europe — AI and freedom of expression (European human-rights context).

These links provide orientation, not legal advice. A regulator homepage does not substantiate every provision in this template. Legal and data-protection review is required for your jurisdiction. The tool cards in the finder carry their own caveats; this policy supplements them but does not replace them.