How to write an AI acceptable use policy for your company

An AI acceptable use policy tells employees which AI tools they can use, for what purposes, and with what data. A good policy covers approved tools, data rules, human review requirements, transparency, intellectual property, and how new use cases are approved. Keep it short, practical and backed by training, so people know how to use AI safely rather than avoiding it or using it in secret.

Your employees are already using AI, whether or not you have a policy. A clear acceptable use policy protects the organization while encouraging people to use AI productively.

Why every company needs an AI policy now

Microsoft and LinkedIn's 2024 Work Trend Index, based on a survey of about 31,000 people in 31 countries, found that 75% of knowledge workers use AI at work. Of those, 78% bring their own AI tools rather than using tools provided by their employer. Only 39% of AI users had received AI training from their company.

That combination creates real risk: sensitive information pasted into public tools, unchecked AI output sent to clients, and no record of how AI is being used.

Regulation is also moving. In the European Union, Article 4 of the EU AI Act has required organizations that provide or deploy AI systems to take measures to ensure a sufficient level of AI literacy among their staff since 2 February 2025. Even outside the EU, customers and partners increasingly expect clear AI governance.

What an AI acceptable use policy should include: a ten-section outline

1. Purpose and scope

Explain why the policy exists and who it applies to: employees, contractors and anyone using AI on the organization's behalf. Make clear that the goal is to enable safe, productive use.

2. Definitions

Define key terms in plain language, such as generative AI, AI tools, confidential information and personal data.

3. Approved tools

List the AI tools employees may use for work, and explain how to request a new tool. Distinguish between enterprise tools with data protections and public consumer tools.

4. Permitted and prohibited uses

Give concrete examples. Permitted uses might include drafting, summarizing, brainstorming and research. Prohibited uses might include making final decisions about people, such as hiring or performance, without human review, or creating misleading content.

5. Data rules

This is the most important section. State clearly what information must never be entered into AI tools, such as:

• Personal data about customers or employees
• Confidential financial, legal or strategic information
• Client information covered by confidentiality agreements
• Passwords, access credentials and security details

A simple traffic-light table helps:

6. Human review and accountability

AI output can be wrong. Require employees to review and verify AI-generated content before using or sharing it, and make clear that the employee remains accountable for the final work.

7. Transparency

Set expectations for when AI use should be disclosed, for example in client deliverables, published content or decisions that affect people.

8. Intellectual property

Explain how to handle copyright and ownership questions, including avoiding inputs that infringe third-party rights and checking outputs before commercial use.

9. Approval of new use cases

Describe how teams can propose new AI use cases or tools, and who reviews them. Higher-risk uses, such as those involving personal data or customer-facing automation, should receive closer review.

10. Training, monitoring and review

Commit to training employees on the policy, explain how compliance will be monitored, and set a review date. AI changes quickly, so review the policy at least every six to twelve months.

Use recognized frameworks as a foundation

You do not need to start from scratch. Two widely used frameworks can guide your approach:

• NIST AI Risk Management Framework, published by the US National Institute of Standards and Technology in 2023, which organizes AI risk management into four functions: govern, map, measure and manage.
• ISO/IEC 42001, the international standard for AI management systems, published in late 2023, which sets out requirements for governing AI responsibly within an organization.

Aligning your policy with these frameworks makes it easier to answer customer due diligence questions and prepare for future regulation.

How to roll out your AI policy so people follow it

A policy that sits in a shared drive does little. To make it work:

1. Involve the right people. Draft the policy with input from legal, IT, security, HR and business teams.
2. Keep it short. Aim for a few pages, with a one-page summary for everyday use.
3. Train everyone. Walk employees through the policy with real examples of what is and is not allowed.
4. Provide approved tools. People turn to unapproved tools when good alternatives are not available.
5. Make it easy to ask questions. Name a contact or channel for AI questions.
6. Review regularly. Update the policy as tools, risks and regulations change.

Common mistakes to avoid

• Banning AI outright. Bans push usage underground and create more risk, not less.
• Writing in legal language only. Employees need practical, plain-English guidance.
• No list of approved tools. Without one, people guess.
• Ignoring training. A policy without training is rarely followed.
• Setting it and forgetting it. An outdated policy quickly loses credibility.

Key takeaways

• Most employees already use AI at work, often with their own tools and without training.
• An AI acceptable use policy should cover approved tools, data rules, human review and approval of new uses.
• Frameworks such as the NIST AI RMF and ISO/IEC 42001 provide a strong foundation.
• Training and approved tools are what turn a policy into everyday practice.