AI acceptable use policy template your staff can follow

1. Purpose

This policy sets the rules for using artificial intelligence (AI) tools at [Company name] (the Company). It helps staff use AI productively while protecting customers, colleagues, confidential information and Company systems.

This policy supports the Company's duties under the data protection, confidentiality, intellectual property and AI laws that apply to it, including [Applicable laws and regulations]. It works together with the [Information security policy], [Data protection policy] and [Data classification policy]. Where they conflict, the stricter rule applies.

2. Scope

This policy applies to:

• All employees, contractors, temporary workers and consultants of the Company (staff).
• All AI tools used for Company work, free or paid, on Company or personal devices.
• AI features built into other software, such as writing assistants in email, office, CRM or meeting tools.
• AI agents and automations that connect to Company systems or data.

Private use of AI tools outside work is not covered unless it involves Company data, accounts or systems.

3. Definitions

• AI tool: any software that uses AI to generate, analyze, summarize, translate or act on content, including AI features inside other software.
• Generative AI: AI that creates text, images, audio, video or code in response to a prompt (the instructions or content a user gives it).
• Approved AI tool: a tool listed in [List of approved AI tools], contracted and configured by the Company and used through a Company account.
• Public or unapproved AI tool: any AI tool not on the approved list, including free versions of approved tools and any tool used with a personal account.
• Confidential information: non-public information about the Company, its customers, partners or staff, such as [Examples: contracts, pricing, financial data, source code].
• Personal data: any information about an identified or identifiable person, such as a name, email address, phone number, account number or voice recording.
• Special category or regulated data: data the law protects more strictly, such as health, biometric and genetic data, government ID numbers, payment card data and [Other regulated data in your sector].
• Credentials and secrets: passwords, API keys, access tokens, private keys and any other data that grants access to a system.
• AI agent: an AI system that can take actions through connected tools, such as sending email, updating records or making payments.
• Prompt injection: an attack that hides instructions in content an AI reads, such as an email, file or web page, to change what the AI does.

4. Roles and responsibilities

• [Policy owner]: owns this policy, keeps [List of approved AI tools] current, answers questions and runs the reviews in section 18.
• [Approval contact]: receives requests for new AI tools and AI agents and coordinates their review with IT, security, legal and data protection.
• IT and security: configure approved tools, manage access, detect unapproved AI use as the law permits and handle AI incidents.
• Legal and data protection, [Legal or privacy contact]: review vendor contracts and data processing terms and advise on legal duties.
• Managers: make sure their teams know this policy and complete training.
• All staff: follow this policy, check AI output and report incidents.

5. Approved and prohibited AI tools

1. 1Approved AI tools. Staff may use the tools in [List of approved AI tools] for Company work, through Company accounts only. The list states the data classes each tool may process. It is published at [Location of the approved tool list].
2. 2Prohibited AI tools. Staff must not use [List of prohibited AI tools or categories] for Company work or on Company devices.
3. 3Other public AI tools. Staff may use other public AI tools only with Public data (section 6), only for [Permitted low-risk tasks] and never with a Company account or a connection to Company systems.

Requesting a new AI tool or AI feature

1. 1Send a request to [Approval contact] through [Request form or channel] with the purpose, the users, the data involved and any systems the tool will connect to.
2. 2[Approval contact] coordinates a review of the vendor's security, data retention and storage location, whether it trains models on inputs and its contract terms.
3. 3The request is approved, approved with conditions or rejected within [Number of business days]. The decision is recorded.
4. 4Staff may use the tool only after it appears on [List of approved AI tools].

The same process applies to new AI features in software the Company already uses. Staff must not switch on AI features, plug-ins or browser extensions until they are approved.

6. Data rules

Before entering data into an AI tool, staff must identify its class under the [Data classification policy] and follow the table below. When unsure, treat the data as the stricter class and ask [Policy owner].

• Enter only the minimum data a task needs. Remove or mask names and other identifiers where possible.
• Do not upload whole databases, customer lists, mailboxes or shared folders unless that use is approved.
• Do not change the history, retention or model training settings that IT has configured.
• Customer and partner contracts may limit AI use further. Follow the stricter rule.

7. Acceptable uses

Within the data rules in section 6, staff may use approved AI tools to:

• Draft, edit, summarize and translate text.
• Brainstorm ideas, outlines and first drafts.
• Research topics, after checking the sources.
• Write and review code under the [Secure development policy].
• Analyze data the tool is approved to process.
• Transcribe and summarize meetings, with the notice or consent that local law or Company rules require.
• [Other approved uses for your business].

Each person remains responsible for work they produce with AI, as if they had produced it without AI.

8. Prohibited uses

Staff must not use any AI tool to:

1. 1Enter passwords, API keys, tokens or other credentials and secrets.
2. 2Upload customer, staff or candidate personal data to public or unapproved AI tools.
3. 3Make decisions that significantly affect a person, such as hiring, dismissal, pay, credit or access to services, without meaningful review by a qualified person.
4. 4Create deceptive content, such as fake reviews, misleading advertising or fabricated records.
5. 5Impersonate a real person, including creating a synthetic voice, image or video of someone without their written consent and approval from [Approval contact].
6. 6Bypass or disable security controls, content filters or monitoring, except in an authorized security test.
7. 7Give legal, medical, financial or other professional advice based on AI output without review by a qualified person.
8. 8Monitor or profile staff or customers without written approval from [Legal or privacy contact].
9. 9Create unlawful, discriminatory, harassing or sexually explicit content.
10. 10Infringe copyright, trademarks or other intellectual property rights.

9. Accuracy and human review

AI output can be wrong, incomplete, out of date or biased, and AI tools can invent facts, quotes and sources.

1. 1Staff must review AI output before they use it, send it or rely on it.
2. 2The review must match the impact: [Review levels, for example an expert review for legal, financial or security content].
3. 3Staff must check facts, figures, quotes and sources against reliable sources.
4. 4Code written with AI must pass the same review, testing and security scanning as other code.
5. 5Staff should report harmful or seriously wrong output to [Policy owner].

10. Transparency and disclosure

1. 1People who communicate with a Company AI system, such as a chat assistant or voice agent, must be told they are dealing with AI unless this is obvious. Use [Approved AI disclosure wording].
2. 2Realistic images, audio or video of people, places or events created or changed with AI must be labeled as AI-generated before publication.
3. 3Other AI-generated content is labeled as required by [Applicable laws and regulations] and the [Content disclosure guideline].
4. 4Staff must follow customer contract rules on AI use and must not claim that content was made without AI when it was.

11. Intellectual property and confidentiality

• Confidentiality duties in employment contracts, NDAs and customer contracts apply in full to AI tools.
• The Company approves only AI tools whose terms meet [Contract requirements for AI vendors, for example no training on Company data].
• Staff must not enter third-party content, such as copyrighted text, images or code, unless the Company has the right to use it that way.
• The Company may not be able to protect content produced mainly by AI, and AI output can resemble existing works. Check important output before publishing it.
• Work that staff produce with AI tools for the Company belongs to the Company under [Employment or contractor agreement terms].

12. AI agents and automation

AI agents that read Company data or act in Company systems carry more risk than chat tools. These rules apply in addition to the rest of this policy.

1. 1Only [Authorized roles] may connect an AI tool or AI agent to Company systems, accounts or data. Staff must not connect AI tools to Company systems through plug-ins or connectors without approval.
2. 2Each AI agent must have a named owner and a documented purpose and be recorded in the [AI system inventory].
3. 3Each AI agent must use its own credentials with least privilege: only the access its task needs.
4. 4Actions with financial, legal, security or customer impact, such as payments, deleting data or bulk external messages, must wait for approval by an authorized person. See [List of actions that need human approval].
5. 5AI agents must log their inputs, actions, outputs and approvals for [Log retention period].
6. 6AI agents must be tested for prompt injection and data leaks before launch and after major changes.
7. 7The owner must be able to pause an AI agent quickly and must do so if it behaves unexpectedly.

13. Security

• Use Company accounts with single sign-on and multi-factor authentication (MFA) where available. Never use personal accounts for Company work.
• Do not share AI tool accounts or API keys.
• Treat emails, web pages and files from outside the Company as untrusted, because they can contain prompt injection.
• Report suspected prompt injection, unexpected AI actions or an AI tool asking for credentials to [Security contact] at once.
• Verify unusual requests for payments, data or access through a second, known channel, because AI can clone voices and fake video calls.

14. Incident reporting

Report the following to [Security contact] through [Reporting channel] within [Reporting deadline, for example 24 hours]:

• Confidential information, personal data or credentials entered into a public or unapproved AI tool, even by mistake.
• AI output that exposed data to the wrong person.
• An AI agent that took an unapproved or unexpected action.
• Suspected prompt injection or misuse of AI tools by others.

Fast reporting helps the Company limit harm and meet any legal notification deadlines. A report made promptly and in good faith will not in itself lead to disciplinary action. Incidents are handled under the [Incident response plan].

15. Training and AI literacy

1. 1All staff must complete [AI training course] before using approved AI tools and a refresher every [Refresher interval].
2. 2Training covers how the approved tools work and fail, the data rules, checking output, prompt injection, AI-enabled fraud and each person's duties under this policy.
3. 3Staff in higher-risk roles, such as [Roles, for example developers, AI agent owners and HR], receive additional training.
4. 4[Policy owner] keeps records of completed training and of each person's acknowledgment of this policy.

This training supports the Company's measures to develop its staff's AI literacy, including under [Applicable AI laws, for example Article 4 of the EU AI Act].

16. Monitoring and enforcement

1. 1The Company may monitor AI use on Company systems, networks and accounts to detect unapproved AI tools, data leaks and security incidents.
2. 2Monitoring must be lawful and proportionate and follow the [Employee privacy notice] and local law, including any duty to inform or consult staff representatives.
3. 3A breach of this policy may lead to removal of AI access and disciplinary action under the [Disciplinary policy], up to termination of employment or contract where local law allows.

17. Exceptions

1. 1Request an exception in writing from [Policy owner], stating the reason, the data involved, the duration and the safeguards.
2. 2Exceptions need approval from [Exception approver], last no longer than [Maximum exception period] and are recorded in the [Exceptions register].
3. 3No exception may allow staff to enter credentials, secrets or special category or regulated data into a public or unapproved AI tool.

18. Review and version history

[Policy owner] reviews this policy at least every [Review interval, for example 12 months], after a significant AI incident and when the Company adopts a major AI tool or when relevant laws change. Questions go to [Policy owner] at [Contact email].