How to write an AI acceptable use policy

Why you need one now

If your team uses AI tools, you need an acceptable use policy. Not a thirty-page document nobody reads, but a clear set of rules that lets people use AI confidently while protecting your information and the people your work affects.

AI tools spread through companies faster than the rules get written. That gap is where the risk sits: client information pasted into tools that train on it, AI output shipped without review, decisions about people made without a human check. A policy closes the gap. Clients increasingly expect one too, and many ask for it in security reviews and questionnaires.

What to include

A good policy is short and specific. Cover these sections:

• Purpose and scope: why the policy exists and who it applies to, including contractors and personal accounts used for work.
• Approved use: what people can do freely with approved tools, so the policy enables rather than only restricts.
• Prohibited use: the hard lines, such as no confidential information in unapproved tools, no unreviewed high-impact decisions, and no passing off unchecked output as checked.
• Information handling: assume every prompt may be stored by the vendor, so sensitive information only goes into approved tools and accounts.
• Human review: people stay accountable for AI-assisted work, and output is a draft until a person has checked it.
• New tool requests: a simple way to ask for a tool or an exception, so people don’t go around the policy.
• Reporting concerns: where to raise a problem, with no penalty for good-faith reports.

Keep it enabling

The most common mistake is a policy that only says no. People route around rules that block them. The best AI policies make the safe path the easy path: a clear list of approved tools, a fast way to request new ones, and rules that are obvious rather than bureaucratic.

Roll it out, then keep it current

A policy only works if people know it and follow it. Brief the team on what changes for them, get an acknowledgment from each person, and name an owner who answers questions.

Review it at least once a year, and whenever you adopt a materially new AI use or a client requirement changes.

A worked example: five lines from Meridian Creative’s policy

Meridian Creative is a fictional 42-person agency. Its policy runs to two pages. Here are five lines from it, one from each of the sections people use day to day.

1. Approved use. You may use the approved tools listed below for internal drafts, research from public sources and internal meeting summaries, without asking first.
2. Prohibited use. Never enter client confidential information, unreleased client work or personal information into a tool that is not on the approved list.
3. Human review. AI output is a draft. A named reviewer checks facts, rights and client suitability before anything reaches a client.
4. New tools. To use a new tool, send the operations director a short request saying what it is for and what information it touches. You will get a decision within five working days.
5. Reporting. If something goes wrong, tell the operations lead the same day. Good-faith reports carry no penalty.

Look at what each line does. It says what is allowed without asking, who decides, and where to go when the answer isn’t obvious. None of them needs a lawyer to interpret, and none of them only says no.

The approved list sits in the policy as a short table, so anyone can check it in seconds:

The table is the part of the policy that changes most. When a request is approved or declined, the table changes, and the policy’s date changes with it. Meridian adopted its policy on October 8, 2026, with the operations director as owner and a review set for December 15. A declined tool stays on the list, so nobody has to guess whether it was ever considered.

What to leave out

Keep tool settings, vendor details and step-by-step procedures out of the policy itself. They change often, and a policy that needs editing every month stops being read. Link to them instead, and keep the policy to the rules, the owner and the approved list.

Common mistakes

• Copying a large company’s policy. It will describe committees and processes you don’t have, and people will ignore it.
• No approved tools list. Without one, every use is a judgment call and the safe path is unclear.
• No date and no owner. A policy without either is out of date the day a new tool arrives.

Using your AI assistant

An AI assistant can help you draft and test the wording, as long as it works only from your notes and marks the decisions it can’t make for you. Use your company’s approved AI account, and have a person approve the final policy.

Using only the notes and existing policies I paste below, draft wording for the [section name] section of our AI acceptable use policy. Keep it short and specific. Where my notes don't settle a decision, write UNRESOLVED and the question we need to answer, instead of choosing for us. Do not add rules, tools or commitments I haven't given you.

Notes and existing policies:
[paste]

Read this AI acceptable use policy draft as a new employee would. List anything unclear, any rule with no owner or no way to ask for an exception, and any place it only says no without an approved alternative. Quote the wording you mean. Do not rewrite the policy.

Draft:
[paste]

Common questions

Related guides

• What is AI governance? A practical guide
• AI vendor risk assessment: what to check
• How to answer the AI section of a security questionnaire

Extrasphere Media LLC. Content for general informational purposes, not legal advice and not a substitute for qualified counsel. Independent and not affiliated with ISO, the IEC, NIST, or the European Union.