To write an AI acceptable use policy, state its scope, list approved tools, define which data may never be entered, require human review of AI output, name an owner for questions and exceptions, and say what happens on a breach. Keep it to one or two pages so staff read it.
Key takeaways
- Data rules matter more than tool lists. Say what must never go into a prompt.
- Name approved tools, and give a fast route to request new ones.
- Require a human to review AI output before it reaches customers or production.
- If you operate in the EU, AI literacy for staff is a legal duty under Article 4.
What should an AI acceptable use policy cover?
It should cover scope, approved tools, data handling, output review, disclosure, ownership and enforcement. The EU AI Act's Article 4, applying from 2 February 2025, requires providers and deployers to take measures to build AI literacy among staff who operate AI systems. A policy plus short training is a reasonable way to show that.
Template you can adapt
AI Acceptable Use Policy
Owner: <name and role> Review date: <date>
1. Scope
This policy applies to all employees and contractors using AI tools
for company work, including chat assistants, coding assistants and
AI features inside other software.
2. Approved tools
Only the tools on the approved list may be used with company data.
To request a tool, message <owner> with the use case and data involved.
3. Data rules
Never enter customer personal data, credentials, API keys, source code
marked confidential, or unreleased financial information into a tool
that is not approved for that data class.
4. Review of output
A person is responsible for any AI output they use. Review code,
facts and citations before use. Do not publish AI output as verified.
5. Disclosure
Tell customers when they are talking to an AI system, and label
AI-generated content where the law or our contracts require it.
6. Incidents
Report suspected data exposure or harmful output to <owner> at once.
7. Consequences
Breach of this policy is handled under our normal disciplinary process.
How do you decide which data is off limits?
Sort data into classes and say which classes each tool may receive. Start with three: public, internal and restricted. Restricted covers personal data, secrets and customer contracts. Secrets scanning can catch keys pasted into prompts, and the secrets scanning demo shows the idea.
What about disclosure?
If customers talk to a chatbot, Article 50 of the EU AI Act says systems meant to interact directly with people must be designed so users know they are interacting with AI, unless that is obvious. Article 50 applies from 2 August 2026.
Frequently asked questions
How long should an AI policy be?
One to two pages. A longer document is less likely to be read.
Do I need to ban ChatGPT or similar tools?
Not necessarily. Approve specific tools for specific data classes, and block the rest for restricted data.
Who enforces the policy?
A named owner, usually in security or legal, with managers handling breaches under normal HR process.
Is an AI policy legally required?
No single law requires a document by that name, but EU AI Act Article 4 requires AI literacy measures, and customers often ask for a policy.
See the policies in plain English demo for how short policies can read.
Sources
- EU AI Act Article 4: AI literacy
- EU AI Act Article 50: Transparency obligations
- NIST AI Risk Management Framework
Last reviewed: 19 October 2026.
