AI Acceptable Use Policy Template
Copy, edit the bracketed sections, and share with your team. Review quarterly.
Start here (5 minutes)
- If you want the full “ship it this week” sequence, follow the AI Policy Starter Kit.
- Pair this with vendor checks using AI Vendor Due Diligence in 30 Minutes.
- For incident handling, keep the AI Incident Response Playbook nearby.
[Company Name] — AI Acceptable Use Policy
Version: 1.0 Owner: [Name / Role] Last reviewed: [Date] Next review: [Date + 3 months]
Purpose
This policy defines how [Company Name] employees and contractors may use AI tools in their work. It exists to protect company data, maintain quality standards, and ensure AI is used responsibly.
Approved tools
Employees may use the following AI tools without additional approval:
- [Tool 1] — [approved use cases]
- [Tool 2] — [approved use cases]
Any other AI tool requires written approval from [Policy Owner / Manager] before use on company work.
Data rules — what you may NOT input
Do not enter the following into any AI tool unless it is on the approved list AND has a signed Data Processing Agreement:
- Customer personal data (names, emails, addresses, IDs)
- Employee personal data
- Credentials, API keys, passwords, or secrets
- Unreleased financial data, forecasts, or M&A information
- Client-confidential documents or communications
- Regulated health or payment data (HIPAA / PCI scope)
When in doubt, do not paste. Ask [Policy Owner] first.
Output rules — what requires human review
AI output must be reviewed by a human before use in the following contexts:
- Public communications (blog posts, social media, press releases)
- Legal documents, contracts, or compliance filings
- Financial calculations or reports
- Medical, health, or safety-critical recommendations
- Code that ships to production
Do not treat AI output as factual without independent verification.
Prohibited uses
The following uses are prohibited regardless of tool or tier:
- Generating content designed to deceive, mislead, or harm
- Using AI to make automated decisions about employees without human oversight
- Submitting AI-generated work as your own in contexts where that is deceptive (academic, certified, or regulated submissions)
- Using personal consumer accounts for company work involving sensitive data
Reporting and incidents
If you suspect a policy violation or accidental data exposure, report it to [Policy Owner / Channel] within 24 hours. No-blame reporting is encouraged — we fix the process, not the person.
Enforcement
Violations may result in access revocation, additional training, or disciplinary action depending on severity and intent. Repeated or wilful violations are treated as misconduct.
Acknowledgment
By using AI tools at [Company Name], you confirm you have read and understood this policy.
How to roll this out
- Paste the policy into your team wiki or shared drive.
- Fill in the bracketed sections — it should take under 20 minutes.
- Share the link in your team channel with a one-sentence summary.
- Add it to your onboarding checklist.
- Schedule a quarterly calendar reminder to review it.
The goal is a policy people have read, not a policy that covers every edge case.