In the UK, Surrey County Council is moving to shut that door before someone accidentally feeds the wrong document into the public cloud. According to Local Democracy Reporting Service coverage by James Moules and Will Harris published by Greatest Hits Radio, Surrey Live, and The Guildford Dragon, elected members and council staff could soon be prohibited from using consumer-facing online AI tools such as OpenAI's ChatGPT and Google's Gemini for local authority business. In their place, the council's first formal draft AI policy mandates the use of Microsoft Copilot Chat, Copilot 365, or other council-authorized software that operates within existing organizational guardrails.
Before anyone assumes Surrey has declared war on artificial intelligence, it is worth reading the fine print. This is not an anti-AI crusade; it is a textbook example of enterprise IT standardization—and a significant win for Microsoft's commercial ecosystem in the public sector.
From Loose Guidance to Formal Policy
Until now, Surrey County Council had relied on informal guidance to steer how officers and elected members interacted with generative AI. The new draft represents the authority's first formal policy governing when and how artificial intelligence may be used for council business.
According to Surrey County Council's official webcast records, the draft policy—listed on the agenda as Item 6, alongside an "RSPC AI Policy Update" and the "SCC Artificial Intelligence (AI) Policy"—was reviewed by the council's Resources and Performance Select Committee on Thursday, October 8, 2026. The committee's review is a step ahead of final approval; the draft policy is expected to go before the council's Cabinet to be discussed and finalized.
The core rule in the draft is straightforward: anyone using AI for council business may only use approved tools and software. As reported by Greatest Hits Radio, the draft policy states directly:
The policy adds a crucial piece of context for why those specific platforms made the cut:
In short, the restriction targets tools accessed directly via the open internet for local authority work. It does not ban council staff or councillors from using ChatGPT or Gemini in their private lives, nor does it block AI wholesale inside the council. Instead, it draws a hard boundary between unvetted consumer web services and centrally managed enterprise software.
Why IT Admins Prefer the Microsoft Copilot Walled Garden
Why would a county council single out ChatGPT and Gemini while rolling out the red carpet for Microsoft Copilot Chat and Copilot 365? While the council's draft policy text as reported does not detail the specific underlying tenant configurations or technical enforcement mechanisms, the broader industry rationale is familiar to every Windows and Microsoft 365 administrator.
In a typical public-sector or enterprise IT environment, consumer AI web portals are a compliance black hole. When an employee logs into a personal or free consumer chatbot over the web, the organization's IT department has zero visibility into what prompts are being entered, whether personal identifiable information (PII) is being uploaded, or whether that data is being retained to train external models.
By contrast, based on general industry knowledge of Microsoft's enterprise stack, organizations that standardize on Microsoft 365 and Entra ID (formerly Azure Active Directory) already have identity governance, auditing, and data protection frameworks in place. Directing staff to Microsoft Copilot Chat and Copilot 365 allows an organization to keep AI interactions inside a risk-assessed boundary where IT teams can apply institutional oversight.
Surrey is hardly alone in tightening the reins on unmanaged chatbots. Public bodies across the UK and Europe have been scrambling to formalize similar boundaries. For instance, Deadline News reported in September 2026 that Scotland's Stirling Council was preparing a formal generative AI policy warning employees and elected members against sharing non-public council information with external systems including ChatGPT, Claude, Gemini, Grok, and DeepSeek. Similarly, Spain's Orihuela City Council restricted municipal staff from using public platforms like ChatGPT, Gemini, and Claude over data protection and procedural integrity risks, as reported by The Leader in July 2026.
What Surrey's Draft Rules Allow—and What They Ban
A good IT policy doesn't just say "no"; it tells users how to do their jobs safely. Surrey's draft framework splits AI usage into clearly defined green and red zones, provided staff stick to authorized tools.
| Policy Category | Specific Activities Covered in the Draft Policy | Conditions & Consequences |
|---|---|---|
| Approved Tools | Microsoft Copilot Chat, Copilot 365, and other SCC-authorized software. | Must be used for general business purposes; tools have undergone risk assessment and have SCC guardrails and oversight. |
| Prohibited Tools | Consumer AI tools accessed directly via the internet, explicitly including ChatGPT and Gemini. | Barred for local authority work due to data-security concerns. |
| Permitted Uses | Summarizing reports, scheduling meetings, summarizing public consultation responses, improving workflow efficiency, and generating meeting minutes. | Must stay within policy rules; any AI-generated meeting minutes must be clearly labelled as AI-assisted. |
| Inappropriate / Prohibited Uses | Making decisions affecting people without human oversight; generating false or misleading information; causing discrimination based on protected characteristics; breaching data protection; unlawfully accessing sensitive information. | Breaches are treated as misconduct, risking disciplinary action for employees or contractual consequences for agency workers and contractors. |
That requirement to label AI-assisted meeting minutes is a particularly smart piece of administrative hygiene. Anyone who has tested automated transcription and summarization knows that large language models can occasionally hallucinate a consensus that never happened or miss the nuance of a heated committee debate. Requiring an explicit "AI-assisted" label ensures that councillors, officers, and the public know a machine helped draft the record—and reminds human reviewers to actually check the output before signing off.
Equally important is the ban on using AI to make decisions that affect people without human oversight. In local government, where decisions touch everything from social care to planning and public services, handing the gavel to an algorithm is both an ethical minefield and a legal non-starter.
And if someone decides to bypass the rules anyway? The draft policy gives enforcement real teeth. Breaching the policy would be treated as misconduct, which could result in disciplinary proceedings for council employees or contractual consequences for agency staff and contractors.
Committee Scrutiny and the Road to April 2027
When the Resources and Performance Select Committee examined the draft on October 8, featuring input from councillors as well as the Director of Customer, Culture & Transformation and the Assistant Director of Digital Transformation, the panel did not simply rubber-stamp the document. According to Greatest Hits Radio's reporting, the committee put forward several recommendations before the policy heads to the Cabinet:
- Future-Proofing for Local Government Reorganization: The committee recommended sharing the policy with the future West Surrey and East Surrey councils, which are scheduled to take over local authority responsibilities in April 2027. Aligning IT and data governance standards prior to a major municipal split is vital if two successor councils are going to inherit staff, data, and software habits.
- Stronger Training Provisions: Councillors called for the policy to be strengthened around staff and member training for using AI technology. Giving workers access to Copilot 365 without teaching them how to prompt safely or verify outputs is like handing out power tools without safety goggles.
- Environmental Impact: The committee recommended that the environmental footprint of artificial intelligence be factored into the policy.
- Annual Reviews: Once adopted, the policy would be reviewed every year—or sooner if necessary—to ensure it stays aligned with any new national legislation or regulatory changes.
Practical Takeaways for Enterprise and Public-Sector Admins
Whether you manage a municipal network in Surrey or a corporate Windows domain anywhere else, Surrey County Council's draft policy highlights a reality of modern IT administration: you cannot govern shadow AI solely through vague "best practice" memos.
For IT leaders looking to implement similar guardrails in their own organizations, Surrey's approach offers a clear blueprint:
- Name the Alternatives Explicitly: Banning ChatGPT or Gemini in a vacuum only drives users to use them on their personal phones. Surrey's policy pairs the restriction with an explicit, accessible alternative—Microsoft Copilot Chat and Copilot 365.
- Require Provenance Labels on AI Output: Mandating that AI-assisted meeting minutes be labelled as such creates a culture of transparency and prevents silent errors from entering official records.
- Include Contractors in the Scope: Modern enterprises and councils rely heavily on agency staff and third-party contractors. Tying AI policy breaches to contractual consequences, alongside standard employee disciplinary procedures, closes a common compliance loophole.
- Keep Humans in the Loop: Drawing a bright line against automated decision-making without human oversight protects both the public and the organization from algorithmic bias and accountability failures.
Surrey's Cabinet still needs to discuss and finalize the policy following the select committee's recommendations. Yet the trajectory is unmistakable: the wild west era of pasting work documents into whatever free chatbot happens to be open in a browser tab is coming to an end, and enterprise-governed tools like Microsoft Copilot are becoming the only approved game in town.