How to Write an AI Acceptable Use Policy for Employees (With Outline)
A section-by-section outline for an employee AI acceptable use policy, covering approved tools, data rules, human review, disclosure and enforcement.
An AI acceptable use policy tells employees which AI tools they may use, what data they can and cannot enter, when a person must review AI output, and when AI use must be disclosed. Write it in 8 short sections, map it to your data classification, get legal and IT sign-off, train staff and review it twice a year.
Photo: Unsplash
On this page
Your employees are already using AI. Some use the assistant built into your office suite, some paste emails into a free chatbot on their phone, and a few have connected AI tools to company accounts without asking anyone. Banning it rarely works. A clear AI acceptable use policy does.
This guide gives you a section-by-section outline you can adapt, with sample wording, a data rules table and a rollout plan. It is written for small and midsize US businesses without a dedicated AI governance team.
What an AI acceptable use policy is and why you need one
An AI acceptable use policy (AUP) is a short internal document that sets the rules for how employees use artificial intelligence tools at work. It sits alongside your IT acceptable use, information security and privacy policies, and it answers 4 practical questions:
- Which AI tools are approved?
- What information can go into them?
- Who checks AI output before it is used?
- When do we tell customers or colleagues that AI was involved?
Without those answers, you risk confidential data ending up in consumer AI services, inaccurate AI content reaching customers, and AI being used in hiring or other decisions in ways that break the law. Frameworks such as the NIST AI Risk Management Framework and its Generative AI Profile (NIST AI 600-1) treat clear policies and accountability as a foundation of the “Govern” function. A written AUP is the simplest way to start.
Before you write: 4 decisions to make
- Who owns the policy? Name one person or role, often IT, security, legal or operations, responsible for updates and questions.
- What is your stance? Most businesses choose “allowed with guardrails” rather than a ban or a free-for-all.
- What data classes do you have? If you do not have a data classification (public, internal, confidential, restricted), create a simple one first. The AI policy depends on it.
- What laws apply? Industry rules (HIPAA, GLBA, FERPA), state privacy laws and AI-specific laws in the states where you hire or sell all affect what is allowed.
The policy outline, section by section
Section 1: Purpose and scope
State why the policy exists and who it covers: employees, contractors, interns and anyone using company systems or data. Clarify that it covers standalone AI tools, AI features inside other software and AI agents that act on the company’s behalf.
Sample wording: “This policy applies to any use of artificial intelligence tools for company work, on company or personal devices, including AI features built into approved software.”
Section 2: Definitions
Keep it short. Define “AI tool,” “generative AI,” “approved tool,” “confidential information” and “personal data” so nobody argues about scope later. Add a plain-language appendix if staff need more context.
Section 3: Approved, restricted and prohibited tools
List tools in 3 tiers and keep the list in a separate, easy-to-update page:
- Approved: Tools the company has vetted and licensed, usually business or enterprise plans with contract terms on data use and retention.
- Restricted: Tools allowed only for specific roles or tasks, or only with non-confidential data.
- Prohibited: Tools or uses not allowed, such as unvetted browser extensions that read every page, or personal AI accounts used with company data.
Include a simple request process for new tools, with a named reviewer and a target response time.
Section 4: Data rules
This is the most important section. Map each data class to what is allowed, as in the table below. Our guide on whether it is safe to put company data into AI tools explains the training, retention and enterprise settings to check.
Section 5: Human review and accuracy
AI can produce confident errors. Require a person to review AI output before it is sent to customers, published, used in code that ships, or used in any financial, legal, medical or HR decision. The reviewer owns the result, not the tool.
Section 6: Decisions about people
Set extra rules for AI used in hiring, performance, lending, housing, insurance or other decisions with a big effect on someone. For example, Illinois Public Act 103-0804, effective January 1, 2026, amended the Illinois Human Rights Act to make it a civil rights violation for an employer to use AI that has a discriminatory effect, and requires notice to employees when AI is used for covered employment decisions. Require HR and legal approval before any AI tool is used in these decisions. This is not legal advice.
Section 7: Disclosure, intellectual property and security
- Disclosure: Say when staff must disclose AI use, for example AI chat on your website, AI-generated images in ads, or AI-drafted content in client deliverables if contracts require it.
- Intellectual property: Do not put others’ copyrighted material or trade secrets into AI tools without rights to do so, and know that purely AI-generated content may not be protected by copyright. See who owns AI-generated content.
- Security: Use company accounts with single sign-on and multi-factor authentication, never share credentials with AI tools, and report suspected AI-enabled phishing or deepfake requests. AI agents that can take actions should get the minimum access they need, in line with zero trust security.
Section 8: Training, reporting and enforcement
Require training before using approved tools, explain how to report mistakes or data leaks without fear of punishment for honest errors, and state the consequences of serious violations under your existing disciplinary policy. Set a review date.
Data rules table: what employees can put into AI tools
| Data class | Examples | Approved enterprise AI tool | Personal or free AI account |
|---|---|---|---|
| Public | Published website copy, press releases | Allowed | Allowed |
| Internal | Meeting notes, internal process docs | Allowed | Not allowed |
| Confidential | Contracts, pricing, unreleased plans, source code | Allowed only in tools approved for this class | Not allowed |
| Restricted or regulated | Customer personal data, health records, payment card data, Social Security numbers, passwords | Only if the tool is specifically approved and the contract covers it (for example a HIPAA business associate agreement) | Never |
Adjust the rows to match your own classification and industry rules.
Key takeaway: The data rules section does most of the work. If employees remember one thing, it should be which kinds of information are allowed in which tools.
How to roll out your AI policy in 6 steps
- Survey current use. Ask teams which AI tools they already use and for what. You will find shadow AI; treat it as useful input, not a disciplinary issue.
- Draft with a small group. Include IT or security, legal or HR, and 1 or 2 heavy AI users who know the real workflows.
- Approve a few good tools first. People follow a policy more easily when there is an approved option that works. A policy that only says “no” pushes use underground.
- Get sign-off. Have leadership, legal and IT approve the final version, and align it with your AI strategy if you have one.
- Train and acknowledge. Run a 30-minute session with real examples, then have employees acknowledge the policy.
- Review on a schedule. AI tools and laws change quickly. Review the policy at least twice a year and the approved tool list monthly.
Common mistakes to avoid
- Writing a 20-page policy. Most employees will not read it. Aim for 2 to 4 pages plus a one-page summary.
- Banning AI outright. Bans are hard to enforce and push staff to personal accounts with no protections.
- Forgetting built-in AI features. Your CRM, email, office suite and design tools may have AI switched on by default. Review admin settings.
- No owner. A policy without an owner goes stale within months.
- Ignoring agents. AI tools that can send emails, change records or make purchases need tighter permissions and logging than chat tools. Our AI agents guide covers the basics.
Conclusion
A good AI acceptable use policy is short, specific and paired with approved tools people actually want to use. Define your tool tiers, tie the data rules to your classification, require human review where it matters, and set clear disclosure expectations. Then train your team, assign an owner and revisit it twice a year. That is enough to cut most of the risk while letting employees get real value from AI.
Sources
- NIST AI Risk Management Framework — governance functions and voluntary risk practices
- NIST AI 600-1, Generative AI Profile — generative AI risks and suggested actions, published July 2024
- ISO/IEC 42001:2023, AI management systems — international standard for managing AI in organizations
- Illinois General Assembly, Public Act 103-0804 — AI in employment amendment to the Illinois Human Rights Act, effective January 1, 2026
Frequently asked questions
What should an AI acceptable use policy include?
An AI acceptable use policy should include purpose and scope, definitions, a list of approved, restricted and prohibited tools, data rules tied to your data classification, human review requirements, extra rules for decisions about people, disclosure, intellectual property and security expectations, and training, reporting and enforcement. Keep it to a few pages and maintain the approved tool list separately so it is easy to update.
Do small businesses need an AI policy?
Yes, most small businesses benefit from a short AI policy once employees use AI tools for work. Even a 1 or 2 page policy that lists approved tools and bans entering customer personal data or passwords into personal AI accounts prevents the most common problems. It also gives staff confidence about what is allowed, which tends to increase useful AI adoption rather than slow it.
Should employees be allowed to use ChatGPT at work?
Employees can usually use general AI assistants at work if the company approves the specific plan and sets data rules. Business and enterprise plans typically offer stronger contract terms on data use and retention than free personal accounts. Many companies allow public and internal information in approved business accounts but prohibit confidential or regulated data in personal accounts. Check each vendor's current terms before approving.
Is there a free AI acceptable use policy template?
Yes, many organizations publish sample AI policies, and the outline in this guide works as a starting template. Whatever you start from, adapt it to your data classification, industry rules and the states where you operate. A generic template copied without changes often misses regulated data types or AI-specific laws that apply to your business. Have legal counsel review the final version.
How often should an AI policy be updated?
Review an AI acceptable use policy at least twice a year, and update the approved tool list more often, ideally monthly. AI products change their features and data terms frequently, and new state AI laws keep taking effect. Also update the policy after any incident, a major new tool rollout or a change in the regulations that apply to your industry.
Who should own the AI policy in a company?
One named role should own the AI policy, commonly the head of IT, security, legal, compliance or operations, depending on company size. The owner keeps the tool list current, answers questions and coordinates reviews. In larger organizations, a small cross-functional AI committee with HR, legal, security and business leaders often approves changes while the owner handles day-to-day decisions.
What happens if an employee breaks the AI policy?
Consequences should follow your existing disciplinary policy and depend on severity and intent. An honest mistake, such as pasting the wrong file, is best handled with quick reporting, containment and retraining. Deliberate or repeated violations involving confidential or regulated data may lead to formal discipline. Encourage fast reporting, because a leak reported in minutes is far easier to contain than one found weeks later.
Was this guide useful
No reviews yet. Share your experience and help other readers.
Write a review
Manishdai
Manishdai writes about the technology that is reshaping every industry — from AI agents and cloud platforms to healthtech, fintech and the IT companies building it all across the United States.
manishdai.com