AI Acceptable Use Policy
Suggested wording for seven policy topics. These are sample starting positions, not decisions made by your organization. Review each position and replace it where needed before approval.
- Prepared for
- Your team
- Coordinator
- To assign
Purpose
Help people use AI for useful work while protecting information, keeping human responsibility clear and giving staff a practical route for questions. The policy does not itself approve any tool, account or workflow.
Scope and responsibility
This policy applies to employees, freelancers and other contractors using AI for company work, including AI embedded in existing software and connected agents.
Approved tools and accounts
Use only the tool, account and purpose combinations recorded in the approved-use list. Personal AI accounts are not permitted for company work. The owner and location of the approved list must be confirmed before rollout.
Information handling
Use only public information and company-owned nonconfidential material within an approved tool and account. Do not enter confidential client material, personal data, credentials or unpublished work. Client restrictions still apply.
Human review and client delivery
A named human reviewer must check factual accuracy, confidentiality and client requirements before AI-assisted work reaches a client. AI output must not be sent or delivered automatically.
Agents and connected systems
Agents may assist with drafts but must not send, publish, spend or change records in connected systems. Any proposal for connected actions requires a separate permission and human-oversight review before use.
Requests and exceptions
Submit new tool, account and exception requests to the policy owner before use. Record the business need, proposed information, access, decision owner and conditions. A pending request grants no permission. The request channel and response target must be confirmed before rollout.
Reporting concerns
For suspected exposure, unexpected agent actions or restricted information entered into AI, stop the affected workflow where authorized, preserve relevant facts and report immediately to the responsible incident contact. Use the existing incident process. Good-faith reporting should receive a constructive response. Confirm the contact before rollout.
Decisions to complete
Review all seven suggested positions with your responsible owner. Confirm the named owner, tool-list location, request channel and incident contact before approval.
Outside this starter’s scope
This starter covers seven core topics. Review meeting assistants, contractor-specific arrangements, decisions affecting people, and the policy review schedule separately before adopting a company-wide policy. The full Policy & Rollout Kit includes starting clauses and working records for those areas.
Everyday examples
Within an approved use: ask AI to help draft an internal outline from permitted source material, then review it. Ask first: a meeting assistant, a new plugin, an agent connection or a use outside the approved list. Stop and report: restricted client material entered by mistake, or an agent taking an unexpected action. These examples do not grant permission beyond the rules above.
Before this becomes staff policy
Confirm the policy owner, approved-use list and its location, request channel and incident contact. Review every clause and complete the decisions listed above, then record the authorized approver, version, effective date and next review date. Distribute the exact approved version and explain it with one realistic team scenario.
Approval record
Status: DRAFT — not approved. Version: 0.1. Authorized approver: TO CONFIRM. Effective date: TO CONFIRM. Next review: TO CONFIRM.