The idea behind it
An AI acceptable use policy is a rule set for people, not a framework for the organization. It answers four questions an employee has at the moment of use: which tools may I use for work, what data may I put into each one, what must I check before I use the output, and what happens if I get it wrong. Employees can reach AI tools on personal accounts whether or not a policy exists, and on those accounts the company has no contract with the vendor and no admin control. A policy that only bans tends to move that use out of sight.
The template takes the middle position: approved tools, licensed on business terms and signed in with company accounts, are allowed for named data classes; other tools get public data only or nothing; some uses are prohibited outright. The data rules reuse the company's existing classification scheme rather than inventing an AI-specific one, so employees apply a scheme they already know. The approved list lives outside the policy, because tools change more often than rules. The manager FAQ covers the questions that reach managers first, such as a request for an unapproved tool or customer data pasted into a personal chatbot.
What's inside
- A two-page policy in ten sections, with every company-specific field in square brackets.
- An approved tools table: tool, sign-in, the highest data class it may receive and its conditions.
- A data table by classification (public, internal, confidential, restricted, credentials and secrets) for approved tools and for any other tool, including personal accounts.
- Prohibited uses, human review before using output, and when AI use must be disclosed.
- Rules on accounts and personal tools, connectors and agents, meeting recorders and intellectual property.
- How to request a new tool, how to report a mistake, consequences, the owner, the review date and a sign-off line.
- A one-page manager FAQ with nine questions, and a filled-in data table for a fictional company.
Format: PDF (4 pages) and Word document.
A look inside
Pages 1 and 2 of 4 of the PDF. Select an image to enlarge it.
Who uses it
- CIOs and CISOs, to issue one set of rules for AI tools that HR can enforce.
- Privacy and data protection leads, to set which data classes may go into which tools.
- HR and legal, to agree the consequences, the disclosure rules and the intellectual property language.
- Team managers, to answer their staff's questions from the FAQ without escalating each one.
When to use it
- Staff are already using AI tools and nothing in writing says which ones are allowed.
- The company has just licensed an enterprise AI assistant and needs rules for it before rollout.
- A vendor has switched on AI features inside software the company already licenses.
- An audit, a customer questionnaire or a contract asks for the company's AI use policy.
- Someone has pasted confidential or personal data into a consumer AI tool.
How to use it
Fill in the brackets from your data classification policy and approved tools list, have HR, privacy and legal review it, and give managers the FAQ before it goes live.
- List the AI tools licensed on business terms and check each vendor's current terms on training and retention.
- Fill in the approved tools table in section 2, and publish the full approved list as a separate page.
- Map each data class from your classification policy to the tools that may receive it in section 3.
- Fill in the remaining brackets: prohibited uses for your industry, disclosure cases, the request route and its response time, the reporting contact and the owner.
- Have HR approve section 9, privacy approve section 3 and legal review the whole policy, including whether works councils or unions must be consulted.
- Brief managers with the FAQ, publish the policy with training and controls, and set the review date.
You leave with: A two-page AI policy employees can apply without asking, with approved tools, data rules by classification, a request route, a reporting route and an owner, plus a FAQ for managers.
Where it goes wrong
- Writing a separate data classification for AI. Employees then have two schemes to apply, and they disagree.
- Putting the approved tool list inside the policy, so every new tool needs a policy revision.
- Approving a tool without approving its connectors and agents. Approval of the main tool does not cover every plug-in added to it.
- Publishing the policy without an approved tool for the jobs staff already use AI for, which leaves personal accounts as the only option.
Get the policy template
It is free. Enter your work email and we send the download link.
Questions
Should an AI acceptable use policy ban consumer AI tools?
The template limits personal and unapproved tools to public data, or bans them, at the company's choice. A total ban on AI is hard to enforce because employees can use personal devices and accounts. Licensing an approved tool for the work they need gives them an allowed route.
What data rules belong in an AI policy?
One row per class from your existing data classification policy, saying which approved tools may receive it and whether any other tool may. The template uses public, internal, confidential and restricted, plus a row for credentials and secrets, which go into no AI tool.
Who should own the AI acceptable use policy?
A named role, usually the CIO or CISO, with HR owning enforcement and privacy owning the data rules. The template has fields for the owner, the approver, the effective date and a review at least every 12 months or when an approved tool changes.