This AI acceptable use policy template tells staff how they may use AI tools at work. It is short on purpose so people actually read it. Replace the text in [brackets], adjust the data rules to your business, and have it checked by your legal adviser.
[Company name] AI acceptable use policy
Version: [1.0] · Owner: [name, role] · Effective: [date] · Review: every 12 months
1. Purpose
We use AI tools to work faster and better. This policy explains how to do that without putting our clients, our people or our company at risk.
2. Scope
This policy applies to all employees, contractors and partners who use AI tools for [Company name] work, on any device.
3. Approved tools
- Use only the AI tools on the approved list: [list tools and plans, e.g. ChatGPT Business, Claude Team, Microsoft 365 Copilot].
- To request a new tool, follow the AI tool approval process. Do not sign up for AI tools with your work email without approval.
- Browser extensions and plugins that read your screen or email count as AI tools.
4. Data rules
| Data type | Approved AI tools | Unapproved or free AI tools |
|---|---|---|
| Public information | Allowed | Allowed |
| Internal information | Allowed | Not allowed |
| Client confidential information | Allowed only in tools approved for client data [and with client consent where required] | Never |
| Personal data (names, contact details, HR records) | Only if the tool has a signed DPA and it is necessary | Never |
| Special category data (health, biometrics) and passwords, keys or financial account details | Never | Never |
5. Using AI output
- You are responsible for anything you send or publish, whoever drafted it. Check facts, figures, citations and code before use.
- Do not use AI to make final decisions about people (hiring, promotion, credit, discipline) without human review and approval from [role].
- Tell clients when AI plays a material part in work delivered to them, following our client AI disclosure statement.
- Label AI-generated images, audio or video when they could be mistaken for real.
6. Not allowed
- Creating deepfakes or impersonating real people.
- Using AI to get around security controls or to collect personal data without a lawful basis.
- Uploading content you don't have the right to share.
- Letting AI agents send emails, make payments or change systems without a human approving each action, unless approved by [role].
7. Reporting
Report mistakes, data leaks or harmful outputs to [email/channel] the same day. We focus on fixing problems, not blaming people.
8. Breaches
Breaking this policy may lead to disciplinary action under our [disciplinary policy].
Acknowledgement
I have read and will follow the AI acceptable use policy. Name: ____________ Signature: ____________ Date: ________