An AI acceptable use policy tells employees which AI tools they may use for work, what data they must never put into them, and who is accountable for the output. A good one covers eight things: approved tools, data red lines, account types, human review, disclosure, intellectual property, incident reporting, and training with annual attestation. Keep it to a few pages, launch it alongside approved tools and training, and review it at least once a year. You can download our free AI acceptable use policy template below and adapt it in an afternoon.
This guide is for CIOs, CISOs, HR leaders, legal counsel and compliance teams who need a policy people will actually read and follow, not a document that sits on the intranet.
What an AI acceptable use policy is, and what it is not
An AI acceptable use policy (AUP) is a short, employee-facing set of rules for using AI tools at work. It sits underneath your wider AI governance framework, which deals with how the organisation selects, assesses and monitors AI systems, often using a reference such as the voluntary NIST AI Risk Management Framework. The AUP translates that framework into everyday behaviour: what to do on Monday morning when someone wants to summarise a contract or draft a customer email with AI.
It is not a ban. A policy that simply prohibits AI tends to push the same behaviour onto personal phones and home laptops, where you have no visibility at all. We cover that dynamic in our guide to finding shadow AI and stopping data leaking into ChatGPT. The aim is to make the safe route the easy route.
The eight sections every AI acceptable use policy needs
| Section | What it must say | Common gap |
|---|---|---|
| 1. Approved tools | Which AI tools are approved, where the list lives and how to request a new one | No request route, so people use unapproved tools while they wait |
| 2. Data red lines | What data may go into which tools, and what may never go into any tool | Rules not linked to the existing data classification scheme |
| 3. Account types | Company accounts only; no personal accounts for work, even on approved tools | Silence on personal accounts, which is where most leakage happens |
| 4. Human review | The user owns the output and must check it; no AI-only decisions about people | “Use judgement” with no definition of high-risk uses |
| 5. Disclosure | When to tell clients, customers and meeting participants that AI was used | No rule for AI note-takers in meetings |
| 6. Intellectual property | Respect third-party rights and client contracts; check output before publishing | Client contracts that restrict AI use are not flagged |
| 7. Incident reporting | What counts as an AI incident, who to tell and how fast | No no-blame route, so mistakes go unreported |
| 8. Training and attestation | Training before access, regular refreshers and a yearly signed confirmation | No record, so you cannot prove anyone read it |
1. Approved tools
Keep the approved list in a living register, not in the policy text, so you can add tools without re-approving the whole document. Include AI features that appear inside software you already use, such as CRM, HR and collaboration platforms. These often switch on with a product update and never get a fresh review.
2. Data red lines
This is the section that prevents most harm. Map your existing data classes (for example Public, Internal, Confidential, Restricted) to tool types, then add an absolute “never” list: credentials and API keys, payment card numbers, government ID numbers and any special category data you hold. Ask people to use the minimum data a task needs.
3. Account types
State plainly that work happens only in company-managed accounts. An employee using a personal account on the same tool your company licenses gets none of the enterprise contract protections, and you lose the audit trail.
4. Human review
Make the person who uses the output accountable for it. Require checks on facts, figures, citations and code. List the uses that need approval first, such as recruitment screening, performance management, credit or pricing decisions about individuals, and customer-facing chatbots.
5. Disclosure
Set rules for telling clients when contracts or professional standards require it, for labelling synthetic images, audio and video, and for announcing AI note-takers before a meeting starts.
6. Intellectual property
Remind people that uploading third-party material may breach licences or client agreements, and that AI-suggested code must follow your open source policy.
7. Incident reporting
Define an AI incident in plain words: sensitive data in the wrong tool, harmful output that was acted on, or an AI agent doing something nobody approved. Give one contact and a time limit. Promise fair treatment for prompt self-reporting, because speed matters more than blame.
8. Training and attestation
Tie access to training. Ask everyone to confirm each year that they have read the policy, and keep the record. That record is evidence of good practice and, in the EU, supports your AI literacy obligations.
Requirements vary by jurisdiction
Your policy should be global in principle and local in detail. A few examples of how the law shapes it:
- EU and UK: the GDPR and UK GDPR apply whenever personal data goes into an AI tool, and both require a data protection impact assessment for processing likely to result in a high risk to individuals. The UK ICO’s guidance on AI and data protection is a useful reference, although the ICO notes it is under review following the Data (Use and Access) Act.
- EU AI Act: the AI literacy duty in Article 4 has applied since 2 February 2025, and the European Commission says national authorities supervise and enforce it from 2 August 2026. The Commission also says no certificate is needed and that an internal record of training is acceptable.
- India: the Digital Personal Data Protection Act 2023 makes organisations responsible for protecting the personal data they process, and its Rules, notified in November 2025, are being phased in.
- Singapore: the Personal Data Protection Act 2012 applies, and the PDPC has issued advisory guidelines on using personal data in AI recommendation and decision systems.
Keep these differences in short country annexes rather than in the main policy. For a deeper view of the rules in each market, see our AI governance and compliance training.
How to roll out your AI acceptable use policy
- Find out what people already use. Combine SaaS and network logs with a short, no-blame survey. Your policy must address the tools people actually rely on.
- Draft with a small cross-functional group. IT, security, legal, data protection, HR and two or three business users. Business users keep the language practical.
- Approve tools before you publish. If the policy restricts tools but offers no approved alternative, people will ignore it.
- Get executive sign-off. Name the approving body and the policy owner in the document control table.
- Launch it with training, not an email. A 30 to 60 minute session with real examples from each function works far better than a PDF. Our Safe AI at Work training is built for exactly this moment.
- Collect attestations. Use your learning platform or HR system so the record is automatic.
- Back it with controls. Single sign-on for approved tools, blocks or warnings for unapproved ones and data loss prevention for prompts turn rules into defaults.
- Open a request channel. Publish how to ask for a new tool and how long a decision takes.
How to keep the policy current
AI tools change monthly, so treat the policy as a living document:
- Review the tool register every quarter. Add, restrict or retire tools without changing the policy itself.
- Review the full policy at least every 12 months, with a version history table that records each change and who approved it.
- Trigger an early review when you approve a significant new tool or AI agent, after a material AI incident, or when a law that affects you changes.
- Track a handful of signals: attestation rate, training completion, tool requests and turnaround time, and AI incidents reported.
Download the free AI acceptable use policy template
Our template covers all eight sections above, with [bracketed placeholders] for your company details, a data rules table, a roles table, a version control and approval table, and an employee attestation. Download the AI acceptable use policy template (Word). It is a starting point, not legal advice, so have your legal team and data protection officer review it before you adopt it.
If you would like help turning the policy into behaviour, Product Innovation Academy runs corporate AI training for every level, from Safe AI at Work sessions for all employees to governance programmes for risk and compliance teams, with AI Security and Governance programmes delivered in partnership with AccuroAI. Request a proposal and we will tailor it to your tools, policies and markets.
Frequently asked questions
How long should an AI acceptable use policy be?
Two to four pages is enough for most organisations. Put the detail that changes often, such as the approved tool list and country rules, in separate registers or annexes so the core policy stays short and stable.
Who should own the AI acceptable use policy?
One named executive should own it, usually the CISO, CIO, chief data officer or head of AI governance, with input from legal, data protection and HR. Shared ownership without a named owner tends to mean nobody updates it.
Should the policy ban public AI chatbots?
Usually not outright. A better approach is to approve enterprise versions with proper contracts and controls, ban personal accounts for work, and set clear data rules. Block specific tools only where they cannot meet your security and privacy requirements.
Do contractors need to follow the policy?
Yes. Anyone working on your behalf should be in scope, and the policy should be referenced in contractor and supplier agreements. In the EU, the Commission’s AI literacy guidance also extends to people such as contractors and service providers acting on the organisation’s behalf.
How often should we update it?
Review the approved tool register quarterly and the full policy at least annually, plus whenever a major new tool, a significant incident or a change in law makes the current text out of date.
Sources
- European Commission, “AI Literacy: Questions & Answers”. digital-strategy.ec.europa.eu
- European Commission, “AI Act: regulatory framework on AI” (application timeline). digital-strategy.ec.europa.eu
- Regulation (EU) 2016/679 (General Data Protection Regulation), Article 35 on data protection impact assessments. eur-lex.europa.eu
- Information Commissioner’s Office, “Guidance on AI and data protection”. ico.org.uk
- Ministry of Electronics and Information Technology, Government of India, “The Digital Personal Data Protection Act, 2023”. meity.gov.in
- Press Information Bureau, “DPDP Rules, 2025 Notified”, November 2025. pib.gov.in
- Personal Data Protection Commission Singapore, “Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems”, 1 March 2024. pdpc.gov.sg
- NIST, “AI Risk Management Framework”. nist.gov