Most companies now need an AI acceptable-use policy. Most of the ones that exist are either a single line (“do not use AI with company data”), which everyone ignores, or a twenty-page legal document, which nobody reads.
A good policy sits in between. It fits on one or two pages, answers the questions employees actually have, and tells them how to get a yes instead of only telling them no.
If you have not yet found out which AI tools your teams already use, start there; see Shadow AI: how to find the AI tools your employees already use. The policy is much easier to write once you know what is really happening.
The seven sections that matter
1. Purpose, in two sentences
Explain why the policy exists: to let people use AI to work faster while protecting customer data, company information and the company’s obligations. Saying that AI is welcome sets a different tone from a list of prohibitions.
2. Approved tools
List the AI tools that are approved, the plan or account type that must be used (for example, the company workspace, not a personal account), and what each one is approved for. Keep the list in a place that is easy to update, because it will change often.
3. Data rules
This is the heart of the policy. Most companies can use three categories:
- Public: information already public, such as published marketing content. Allowed in any approved tool.
- Internal: non-sensitive internal information, such as process documents or meeting notes. Allowed only in approved tools on a company account.
- Restricted: customer personal data, health or financial records, contracts, source code, credentials, anything covered by a confidentiality agreement. Allowed only in tools specifically approved for that data, with a signed agreement in place. Never in free or personal tools.
Give two or three concrete examples for each category. Examples do more than definitions.
4. Human review
AI output can be wrong in convincing ways. State where a person must review output before it is used: anything sent to a customer, anything with legal or financial effect, any code that goes to production, any decision about a person (hiring, credit, discipline).
5. Disclosure and ownership
Say when employees must disclose that AI was used (for example, in client deliverables if your contracts require it) and that work produced with AI is still the employee’s responsibility. Check with counsel about ownership and confidentiality terms in your client contracts.
6. How to request a new tool
People will find new tools. Give them a simple path: who to ask, what information to include (the tool, the use case, the type of data), and how long a decision usually takes. A fast, clear process is the best defense against shadow AI.
7. Who to ask, and what happens if something goes wrong
Name a contact, not a committee. Explain what to do if someone pasted restricted data into the wrong tool: report it quickly, without fear of punishment for honest mistakes, so the company can act.
What to leave out
- Long definitions of AI.
- Lists of every tool that is banned. They go out of date in weeks; the data rules already cover them.
- Rules nobody will enforce. If you would not act on a violation, do not write it down.
Checklist to finish it this month
- Inventory of AI tools already in use, by team
- Decision on which tools are approved and on which account type
- Data categories with real examples from your business
- List of situations that require human review
- Contract check: client agreements, NDAs and regulatory obligations (HIPAA, financial rules, professional rules) that limit what data can go into AI tools
- Request process with a named owner and a target response time
- Incident process for data entered in the wrong place
- Review by legal, security and one person from each major team
- Short training or walkthrough, with the policy linked from where people work
- Date for the first review (quarterly is a good start)
Make it part of how people work
A policy that lives in a shared drive changes nothing. Link it from the tools people use, mention it during onboarding, and review it each quarter when you update the list of approved tools. When someone asks “can I use this?”, the answer should take minutes, not weeks.
Frameworks you can lean on
If you need to show auditors or customers that your approach is structured, the NIST AI Risk Management Framework is a widely used, voluntary reference in the United States. Its “Govern” function covers policies, roles and accountability, which is exactly what this document starts.
If you want help drafting the policy, setting up approved tools or connecting an internal assistant to your own documents, that is what our governance and security practice does. Our free AI Opportunity Audit is a good starting point if you are not sure where your biggest risks are.
Sources
- NIST, AI Risk Management Framework.