An AI acceptable use policy is a short document that tells your team which AI tools are approved, what they can be used for, and what information must never be entered into them. The template below covers the eight sections most businesses need, with sample wording you can adapt.
Why you need one now
In most businesses, AI arrived before any rules did. People started using ChatGPT, Copilot, Gemini, AI note-takers and browser extensions on their own, often with personal accounts. That creates real exposure: client data in tools with consumer terms, AI-written content sent without review, and meeting recordings stored by vendors nobody vetted.
A policy fixes the “nobody decided” problem. It gives staff clear permission to use AI well, and clear limits on the risky parts.
This template is a starting point, not legal advice. Adapt it to your business, and have counsel review it if you work in a regulated industry.
The template
1. Purpose and scope
Sample wording: “This policy explains how employees, contractors and volunteers may use artificial intelligence tools for company work. It applies to all AI tools, including chat assistants, writing and coding assistants, meeting note-takers, image generators and AI features built into other software, whether accessed on company or personal devices.”
2. Approved tools
Sample wording: “Only AI tools on the approved list may be used for company work. Approved tools must be used through company-provided business accounts, not personal accounts. To request a new tool, contact [owner]. Tools are reviewed for security, data handling and contract terms before approval.”
Keep the approved list in a separate, easy-to-update document, and link to it from the policy.
3. Data rules (the most important section)
A traffic-light rule is easy to remember:
| Category | Examples | Rule |
|---|---|---|
| Green | Public information, general questions, your own non-confidential drafts | OK in any approved tool |
| Yellow | Internal documents, non-sensitive business data | Approved business tools only, with data retention and training turned off |
| Red | Client confidential information, personal data, health or financial records, passwords, source code, legal matters | Never, unless a specific tool is approved for that data in writing |
Sample wording: “Never enter Red information into any AI tool unless that tool has been specifically approved for that type of information. When in doubt, treat information as Red.”
4. Permitted and prohibited uses
Sample wording: “AI may be used to draft, summarize, brainstorm and research. AI may not be used to make final decisions about hiring, firing, credit, pricing or anything else that significantly affects a person, without human review. AI may not be used to create content that impersonates real people or misleads clients.”
5. Human review and accuracy
Sample wording: “You are responsible for anything you produce with AI assistance. Review AI output for accuracy before using it. AI tools can invent facts, figures and citations. Verify anything you rely on, especially numbers, legal or medical statements, and quotes.”
6. Transparency
Sample wording: “Tell clients when AI is used in a way that materially affects their work or data, as required by contract, law or professional rules. Do not record meetings with AI note-takers without telling participants and following applicable consent laws.”
7. Security
Sample wording: “Do not install AI browser extensions or connect AI tools to company email, files or calendars without approval. Report suspected AI-related data exposure, or AI-generated phishing, to [contact] immediately.”
8. Ownership, training and review
Sample wording: “[Owner] is responsible for this policy and the approved-tool list. All staff complete AI-use training when they join and annually. This policy is reviewed at least every six months.”
Industry additions
Regulated businesses usually need a few extra lines:
- Law firms: reflect your confidentiality duties and ABA Formal Opinion 512 on generative AI, including when client consent is needed. See cybersecurity for law firms.
- Healthcare: patient information may only go into tools covered by a business associate agreement. See cybersecurity for healthcare practices.
- Accounting and tax: add AI use to your written information security plan, and keep taxpayer data out of unapproved tools. See cybersecurity for accounting firms.
Making the policy stick
A policy on its own changes little. Three things make it work:
- Visibility. Find out which AI tools people actually use, including personal accounts and extensions. Shadow AI discovery does this.
- Good approved options. If the approved tools are useful, people use them instead of workarounds.
- Short training. Ten minutes on the traffic-light rule and a few real examples does more than a long document. Add AI scenarios to your security awareness training.
If you want this built and rolled out for you, including the approved-tool review, that’s part of our AI governance service. The NIST AI RMF guide explains how a policy like this fits into a broader AI risk program.