Download the template.
Editable Word document with a one-page staff summary and an acknowledgement form. Aligned with ISO/IEC 42001, the NIST AI RMF and the EU AI Act.
AI Acceptable Use Policy Template.
Your staff are already pasting work into ChatGPT, Claude and Copilot. An AI acceptable use policy tells them which tools they can use, what must never go into a prompt, and what to do when something goes wrong. This free template gets you there in an afternoon.
What an AI acceptable use policy should cover
A policy staff actually follow is short at the front and specific at the back. The template has twenty sections, but most people only need to read the first four and the one-page summary. The rest is there for the questions that come up later.
- Scope: every employee, contractor and intern, any AI tool used for work (licensed, free or personal), on any device.
- Approved tools: a short list in tiers, kept on the intranet so it can change without reissuing the policy.
- What data may go into which tool: mapped to the classification labels you already use.
- Permitted and prohibited uses: concrete examples, including the decisions about people that AI must not make on its own.
- Checking the output: the person who uses it owns it.
- Disclosure: when AI-assisted work must be labelled, to customers and internally.
- Personal accounts and devices, agents and integrations: the places shadow AI actually lives.
- Reporting mistakes: who to tell, how fast, and a no-blame rule so you hear about leaks early.
- Accountability, training, exceptions and review.
The six rules
If staff remember nothing else, they should remember these. They open the template and form the one-page summary.
- Use approved tools for work. Check the list before you start.
- Never put restricted data into any AI tool, and never put confidential or personal data into a tool that isn't approved for it.
- You own the output. AI is wrong often, and confidently. Check it before you use it.
- Be open. Disclose AI use where the policy requires it, and never present AI output as verified fact or as someone else's work.
- No AI decisions about people without an approved, assessed system.
- Report mistakes fast. If you pasted something you shouldn't have, tell security within 24 hours. Early reporting counts as responsible behaviour, not misconduct.
Rule 6 is the one most policies leave out. If people expect to be punished, the leak you most need to know about is the one nobody reports.
Approved tools in three tiers
Banning every AI tool rarely stops the work. It moves to phones and personal accounts, where you have no contract, no logs and no retention terms. Tiers give people a route they can follow.
| Tier | What it means | Data allowed |
|---|---|---|
| A · Enterprise | Contracted, single sign-on, no training on your data, logging on, data residency agreed. | Public, internal and confidential. Personal data only for uses listed in an approved register. |
| B · Limited | Reviewed and allowed for low-risk use. The vendor may keep what you enter. | Public only. |
| C · Not approved | Anything not in A or B, including free consumer chat accounts and unknown browser extensions. | None. Not for work. |
Two rules make the tiers work. A tool not on the list is Tier C until IT says otherwise. And a new AI feature switched on inside an approved product, like a fresh "summarise" button, isn't automatically Tier A.
Data that never goes into a prompt
Whatever the tool, some data stays out unless a specific system has been assessed and approved for it:
- passwords, API keys, tokens and any other credential;
- payment card numbers, bank details and full government ID numbers;
- special category data: health, biometric, genetic, ethnicity, religion, political opinions, union membership, sex life or orientation;
- data about children, and criminal records or allegations;
- legally privileged material and anything under litigation or investigation;
- inside information and M&A material;
- client data a contract says may not go to third-party processors;
- security vulnerabilities, network diagrams and incident evidence.
Before pasting anything, minimise it. "Summarise this complaint" works just as well with the customer's name replaced by "Customer A".
How to roll it out in two weeks
- Day 1–2: name an owner. If there's no AI governance lead yet, the CISO or DPO usually holds it.
- Day 3–5: fill in the tool list with IT, and map the data table to your existing classification labels.
- Week 2: review with Legal, Security and HR in one meeting, then approve.
- Launch: publish the one-page summary, collect acknowledgements, and run a 45-minute session for all staff.
- After: review at least every 12 months, or sooner when you approve a new kind of tool such as AI agents.
Need the rest of the programme?
The acceptable use policy is template 01 of the AI Governance Starter Kit: 12 editable templates covering governance policy, AI inventory, risk classification, impact assessment, vendor due diligence, incident response and a 90-day roadmap. From €49.
Read next.
Writing the policy is the short part. These articles cover what comes after it: enforcing it, what governance costs, privacy, training and who to put in charge.
AIAI usage control policy for a Windows estateCopilot and ChatGPT access, paste-level DLP, app allowlists and an audit trail.
AIAI governance cost: pricing a Windows estateThe contained build, the estate assessment and the monthly retainer, priced rather than ranged.
AIAI data privacy for business: a GCC field guideWhat the law expects, where your prompts go, and seven questions to ask before you connect a system.
AIAI training for employees: a 4-week playbookWhat to teach by role, a four-week plan, and what to measure after.
AIAI automation for government teamsThree use cases that work, tender-safe pilots, Arabic accuracy and data residency.
AIWho to hire for AI workThe five real supplier types compared, the questions to ask, and what each costs.
Questions.
This template is a practical starting point, not legal advice. Have qualified counsel review it against the laws that apply to you before adoption.
Is the template really free?
Yes. It's a free download in editable Word format. You enter an email address on the checkout page so the file can be sent to you.
What's the difference between an AI acceptable use policy and an AI governance policy?
An acceptable use policy tells staff how they may use AI tools day to day. A governance policy sets how the organisation decides which AI systems to build or buy, who approves them and how risk is assessed. Most organisations need the acceptable use policy first, because staff are already using the tools.
Do we need an AI policy if we've banned AI tools?
Yes. A ban without a policy usually moves use onto personal phones and accounts, where the organisation has no contract, no logs and no retention terms. A tiered policy that names approved tools and the data allowed in each gives you control instead.
Does the EU AI Act require an AI acceptable use policy?
Not by that name. Article 4 asks organisations that use AI to take measures to support AI literacy among their staff (as amended in 2026). A clear acceptable use policy plus short training is the most direct way to show that. ISO/IEC 42001 also expects a documented AI policy. Confirm your own obligations with counsel.
How often should the policy be reviewed?
At least every 12 months, and whenever you approve a new category of tool, such as AI agents that can act on your systems. Keep the approved-tool list on your intranet so it can change without reissuing the policy.
Rather have it done with you?
The AI readiness and governance sprint puts the policy and the programme around it in place in three weeks. You end with a governance model, a ranked roadmap and one agent in production.