AI Acceptable Use Policy Template for Employees

A free AI acceptable use policy template: approved tools, prohibited data, review rules, disclosure, vendor use and consequences.

Email hello@ps3g.com

This AI policy template is a complete, editable acceptable use policy for employees of any organization, from a five-person firm to a department inside a larger company. It covers the questions that matter in practice: which AI tools are approved, which data must never go into a prompt, when a person has to review an AI output, when AI use has to be disclosed, how AI inside purchased software is handled, how problems are reported and what happens when the rules are broken. Copy the text, replace the bracketed placeholders, have HR and counsel read it, and publish it.

Why you need one this quarter

Your staff are already using AI, whether or not a company AI policy exists: personal accounts on general-purpose assistants, AI features switched on inside the office suite and the CRM, and a browser extension or two nobody approved. The risk is not the tools; it is the data going into them (client records, source code, personal information) and the outputs coming back unreviewed (wrong figures, invented citations, biased screening).

A written AI usage policy for employees is the fastest control you can put in place, and the first thing a customer questionnaire, a cyber-insurance form, a SOC 2 auditor or a HIPAA risk analysis will ask for. The policy below can be adopted as is and expanded later into a fuller program; our guide to what AI governance is describes that structure, and our guide to shadow AI explains how to find the use you do not know about.

The template (full text, section by section)

Everything in brackets is a placeholder. Delete the sections that do not apply to you, but keep sections 4, 5, 6 and 11; they carry the controls that matter most. The template is written as a generative AI policy first, since that is where most employee use sits, and it also covers AI features in purchased software.

[Company Name] AI Acceptable Use Policy

Version [1.0] · Owner: [role, e.g., Chief Operating Officer] · Approved by: [name, title] · Effective: [date] · Next review: [date]

1. Purpose

This policy sets the rules for using artificial intelligence (AI) tools for work at [Company Name]. Its purpose is to let employees use AI productively while protecting our clients, our people, our data and our obligations under law and contract.

2. Scope

This policy applies to all employees, contractors, temporary staff and interns of [Company Name] (together, “staff”), on any device and any account, whenever AI is used for work or with company or client information. It covers general-purpose AI assistants, AI features built into software we license, AI tools built by [Company Name], and AI used by vendors on our behalf.

3. Definitions

AI tool: any software that generates text, images, code, audio or video, makes predictions, classifications or recommendations, or takes actions based on a machine-learned model, including chat assistants, copilots, summarizers, transcription tools, image generators, coding assistants and AI features inside other applications.
Approved AI tool: an AI tool listed in the Approved AI Tools register maintained by [role].
Confidential information: information defined as confidential in [Company Name]’s [information classification policy], including client information, personal information, financial information, source code, contracts, pricing and anything marked confidential.
Regulated data: data covered by a law or contract that restricts its handling, such as protected health information, payment card data, personal information covered by privacy laws, student records and controlled unclassified information.
Consequential decision: a decision that affects a person’s access to employment, credit, housing, insurance, healthcare, education, legal services or government benefits.

4. Approved tools

Staff may use only approved AI tools for work. The current list is kept at [location, e.g., intranet page] and states, for each tool, the approved account type (company-managed only, or personal account permitted), the data classes it may be used with, and the owner. Using an unlisted AI tool for work, including a personal account on an otherwise approved product, requires an exception under section 15.

To request a new tool, submit [form or email address] with the tool name, the intended use, the data it would process and the vendor’s terms. [Role] will review the request against this policy and the vendor review process and respond within [number] business days.

5. Prohibited data

Unless the Approved AI Tools register states that a specific tool is approved for that class of data under a company-managed account, staff must not enter, upload, paste, dictate or otherwise provide the following to any AI tool:

Regulated data, including protected health information and payment card data.
Personal information about clients, patients, employees, candidates or members of the public, including names combined with contact details, identifiers, health, financial or employment details.
Confidential information, including client deliverables, contracts, pricing, financial results, strategy documents and source code.
Passwords, keys, tokens and other secrets.
Information covered by a non-disclosure agreement or a client contract that restricts third-party processing.
Any data the staff member is not authorized to share outside [Company Name].

When in doubt, treat the information as prohibited and ask [role].

6. Prohibited uses

Staff must not use AI tools to:

Make a consequential decision about a person without human review and approval by an authorized staff member.
Monitor, profile or evaluate employees or candidates except through tools and processes approved by HR and [legal/compliance].
Generate content that is unlawful, discriminatory, harassing, deceptive or that infringes another party’s intellectual property.
Impersonate a person or present AI-generated content as a human communication where disclosure is required under section 8.
Circumvent security controls, including by using AI tools to extract data from systems the staff member is not authorized to access.
Connect an AI tool or agent to company systems, data sources or accounts without approval under section 11.

7. Human review and accountability

Staff remain responsible for any work product they produce with AI assistance. Before AI-generated or AI-assisted content is sent to a client, published, filed, used in a decision or entered into a system of record, the responsible staff member must review it for accuracy, completeness, bias, confidentiality and appropriateness. Facts, figures, citations, legal and regulatory statements and code must be verified against a reliable source.

8. Disclosure and transparency

Staff must disclose AI use when: (a) a client, regulator or contract requires it; (b) AI-generated content is presented where a reader would reasonably assume a human wrote it and the distinction matters, such as advice, opinions or testimony; (c) a person is interacting with an AI system, such as a chatbot, rather than a human; and (d) AI contributed to a consequential decision about a person. Internal use of AI for drafting, summarizing and research does not require disclosure unless one of these conditions applies. [Role] maintains the standard disclosure wording.

9. Accuracy, intellectual property and confidentiality of outputs

AI tools can produce content that is wrong, out of date, biased or copied from other sources. Staff must not rely on AI output as a sole source for factual claims. AI-generated text, images and code may carry intellectual property risk; staff must follow [Company Name]’s guidance on licensing and attribution and must not use AI to reproduce third-party material. Outputs produced from confidential information are themselves confidential.

10. AI in purchased software and vendor use

AI features inside software that [Company Name] licenses (for example, summarization, drafting, scoring or recommendation features) are subject to this policy. [Role] decides whether each feature is enabled, for which users and with which data, based on the vendor’s terms on data use, retention and model training. Staff must not enable AI features that [Company Name] has disabled. Vendors that process company or client data with AI on our behalf must pass the vendor review process and, where regulated data is involved, have the required agreements in place (for example, a business associate agreement for protected health information).

11. Security requirements

Use company-managed accounts for approved AI tools wherever the register requires it, with single sign-on and multi-factor authentication where available.
Do not install AI browser extensions, plug-ins or desktop agents without approval from [IT/security role].
Do not grant an AI tool or agent access to email, files, calendars, code repositories, databases or other company systems without approval from [IT/security role], and only with the minimum access needed.
Do not disable logging, data-loss prevention or other controls that apply to AI tools.
Treat AI outputs that contain links, code or instructions as untrusted content.

12. Reporting problems

Staff must report the following to [role or address] as soon as they become aware of it: prohibited data entered into an AI tool; an AI output that caused or could cause harm to a person, a client or [Company Name]; an AI tool taking actions it was not asked to take; and suspected use of AI tools in breach of this policy. Reports are handled under the [incident response procedure]. Reporting in good faith will not result in disciplinary action.

13. Training and acknowledgment

All staff must complete AI acceptable use training on joining and at least [annually]. Staff who own AI systems, approve AI tools or review AI outputs for consequential decisions must complete additional training defined by [role]. Staff must acknowledge this policy on joining and whenever it changes materially.

14. Consequences

Breaches of this policy may result in disciplinary action up to and including termination of employment or contract, in line with [Company Name]’s [disciplinary procedure], and may be reported to clients or regulators where required.

15. Exceptions

Requests for exceptions must be submitted to [role] in writing, stating the tool, the use, the data involved, the business justification and the proposed safeguards. Exceptions are granted in writing, are time-limited, and are recorded in the exceptions register.

16. Policy ownership and review

This policy is owned by [role] and approved by [role or body]. It is reviewed at least annually and whenever there is a material change in the AI tools in use, applicable law or [Company Name]’s risk assessment. Questions go to [address].

Acknowledgment

I have read and understood the [Company Name] AI Acceptable Use Policy and agree to comply with it.

Name: ______________________ · Signature: ______________________ · Date: ____________

How to adapt it by industry

The template is deliberately general. These are the adjustments we make most often when turning it into a corporate AI policy for a sector.

Healthcare. Name protected health information in section 5, add a rule in section 7 that AI-generated clinical documentation is reviewed and signed by the treating clinician, require a business associate agreement in section 10 for any tool that can see patient data, and align section 12 with your HIPAA incident and breach procedures.
Financial services. Add model risk management language: AI used in credit, underwriting, fraud or trading decisions is a model subject to validation and inventory. Add fair-lending and adverse-action considerations to sections 6 and 8, and record-retention rules for AI-assisted communications.
Law, accounting and consulting. Add privilege and client-confidentiality language to section 5, a requirement that AI research is verified against primary sources in section 7, and engagement-letter disclosure rules in section 8.
Software and product companies. Add a section on AI in the development lifecycle: coding-assistant rules, license scanning of generated code, a ban on pasting proprietary code into unapproved tools, and a requirement that AI features shipped to customers go through the AI risk assessment process.
Public sector and education. Add public-records rules, student and resident data in section 5, and procurement rules for AI vendors in section 10.
Manufacturing and operations. Add rules in section 11 for AI connected to operational technology and for agents that can change orders, schedules or machine settings.

In every case, check the current official text of the laws that apply to you and have counsel review the final policy. This is general information, not legal advice.

Rolling it out

Build the approved-tools list first. A policy that says “approved tools only” with no list drives use underground. Start with the tools people already use, decide which to approve under company accounts, and publish the list alongside the policy.
Get three reviews. HR for the consequences and training sections, security for sections 5 and 11, and counsel for sections 6, 8 and 10.
Announce it with the reason. Staff accept rules faster when they hear what the company is protecting. Keep the announcement to a page.
Train in thirty minutes. Cover the approved list, the never-enter data, the review rule and how to report. Record attendance and acknowledgments.
Make requests easy. A simple form and a short turnaround for new-tool requests are the difference between a policy people follow and one they route around.
Measure. Track requests, exceptions, reported problems and tool usage. Review the policy after the first quarter and then annually.

Once the policy is live, the next step is the structure around it: an inventory, risk tiers and controls. Our guide to building an AI governance framework picks up from here.

Where PS3G fits

PS3G tailors this AI governance policy for clients as the first deliverable of its AI governance consulting service, then adds the inventory, risk tiers, assessments, vendor reviews and training that make it enforceable. We work for organizations of every size, from a founder who needs the policy and an approved-tools list to a compliance team that needs it mapped to NIST AI RMF and ISO/IEC 42001. We run the same policy inside our own company, including for the AI features in our HIPAA-compliant EHR and telehealth platform, DocVilla, and we work with your counsel on the legal sections.

Frequently asked questions

What should an AI acceptable use policy include?

Purpose and scope, definitions, the approved-tools rule, prohibited data, prohibited uses, the human review requirement, disclosure rules, intellectual property and accuracy expectations, rules for AI inside purchased software, security requirements, how to report problems, training and acknowledgment, consequences, exceptions and policy ownership. The template above covers all of them.

Can we just ban AI tools instead of writing a policy?

You can write it, but it will not hold. Staff see real productivity gains and will use personal accounts on personal devices, which removes any visibility you had. An approved-tools list with company accounts, clear data rules and a request process keeps the productivity and gives you logs and contracts.

Does a small company need a formal AI usage policy?

Yes, and it can be short. A small company needs the approved-tools list, the prohibited-data rule, the review rule and a name to contact. That is two pages. The rest of the template matters more as you add regulated data, AI inside your product or AI in decisions about people.

How is a generative AI policy different from a general AI policy?

A generative AI policy focuses on tools that produce text, images and code: prompts, data entered, accuracy of outputs, intellectual property and disclosure. A general AI policy also covers predictive and decision systems such as scoring, screening and recommendation models, which raise fairness and impact questions. The template covers both.

How often should the AI policy be updated?

Review it annually at minimum, and sooner when a new law applies to you, an incident reveals a gap, or you start building AI into your own products. Keep the approved-tools register separate from the policy so it can change monthly without a policy re-approval.

Talk to us about your project

Want this policy tailored to your tools, data and industry, with the inventory and training behind it? We will reply with questions, not a sales pitch, and set up a short video meeting if it helps.

Email hello@ps3g.com