AI Playbook for the UK Government

What it is

The Artificial Intelligence Playbook for the UK Government is guidance from the Government Digital Service (GDS) on using AI in government. It was published on 10 February 2025 as an expanded version of the Generative AI Framework for HMG from January 2024, retitled to cover a wider range of AI technologies than generative AI.

It explains what AI is, its capabilities, limits and risks, and how to select, buy and deploy it. It is organised around ten principles, with sections on understanding AI, building AI solutions and using AI safely and responsibly, and an appendix of public sector case studies. Practical guidance and training on building AI solutions has been moved into separate AI insights articles and e-learning courses.

Who it applies to

The playbook is written for government and public sector organisations, and the ten principles are for civil servants to uphold when using AI.

• Central government departments and arm’s-length bodies. The playbook’s requirements bite hardest here. In-scope bodies must use the Algorithmic Transparency Recording Standard, and the Digital, Data and Technology Playbook is followed on a comply or explain basis.
• Other public sector organisations. The principles and guidance are offered as good practice, with the organisation’s own policies taking precedence.
• Suppliers. The playbook does not bind private companies, but its procurement guidance and principles shape what government buyers ask of AI vendors.

What it requires

The ten principles are the core of the playbook. Each one is phrased as something the user of AI should be able to say.

1. You know what AI is and what its limitations are. Understand the technology and its limits, past the claims made for it.
2. You use AI lawfully, ethically and responsibly. AI brings specific legal and ethical considerations, so seek legal and data protection advice.
3. You know how to use AI securely. AI services must be secure to use and resilient to cyber attacks, and must comply with the Secure by Design principles.
4. You have meaningful human control at the right stages. Monitor the AI’s behaviour and have plans in place to prevent harmful effects on users.
5. You understand how to manage the full AI life cycle. AI has a full product life cycle to manage. Services must use the Service Standard, and the Technology Code of Practice should be followed.
6. You use the right tool for the job. Select the most appropriate technology to meet the need.
7. You are open and collaborative. Share work across government and be open about AI use, including through the ATRS.
8. You work with commercial colleagues from the start. AI is a fast-moving market, so get specific commercial advice early.
9. You have the skills and expertise needed to implement and use AI solutions. Understand the technical and ethical requirements and have them in place within the team.
10. You use these principles alongside your organisation’s policies and have the right assurance in place. Apply the playbook’s consistent approach within your own organisation’s policies and assurance.

The guidance on using AI safely and responsibly covers ethics, data protection and privacy, security, governance structures for teams, AI quality assurance and managing risk. The overall expectation is that an AI use is understood, owned, assessed, secured, transparent and kept under review across its life.

Key dates

• January 2024. Generative AI Framework for HMG published.
• 10 February 2025. AI Playbook for the UK Government published as the updated, wider-scope edition of the generative AI framework.

How it relates to other frameworks

The playbook is the public sector’s operating guide to the UK’s wider pro-innovation approach to AI regulation. Its principles on lawful and responsible use, security, human control and openness track the five cross-sector principles that regulators apply across the economy.

It works with other UK instruments rather than replacing them. The Algorithmic Transparency Recording Standard is how in-scope bodies meet the openness principle. UK GDPR, including Articles 22A to 22D on significant automated decisions, and the ICO’s guidance on AI and data protection apply whenever personal data is involved.

Outside the UK, comparable public sector instruments include Canada’s Directive on Automated Decision-Making and Australia’s policy for the responsible use of AI in government. For the governance machinery behind principle 10, ISO/IEC 42001 provides a management system structure and the NIST AI RMF provides detailed risk practices.