Keep it to two pages. Name the approved tools, the data that stays out, who checks AI output, and who to ask. Give the policy one owner, and review it twice a year.
Why you need one now
People are already using AI at work, often with their own accounts. Without a policy, each person decides alone where the line is. Some are too careful and skip tools that would help. Others paste customer data into a chat window without thinking about it.
A good policy fixes both. It tells people what is fine, so they use approved tools with confidence, and it names the few things that are never fine.
What to put in it
Most policies need these eight parts. Each one should take a short paragraph or a short list.
- Purpose and scope. Why the policy exists and who it covers: employees, contractors, or both. Say it applies to any AI tool used for work, including free ones people sign up for themselves.
- Approved tools. Which tools people may use, and how to ask for a new one. Keep the list itself on a page you can update often.
- Data that stays out. The kinds of information that must not go into an AI tool, such as customer records, health or financial data, passwords, and unreleased plans. Include what to do when someone isn’t sure.
- Human review. The person who uses AI output is responsible for it. Say what must be checked, and by whom, before it reaches a customer or affects a decision about a person.
- Disclosure. When people need to say that AI helped, for example in work for clients or in anything published.
- Prohibited uses. A short list of things that are not allowed, such as using AI to make final hiring decisions on its own.
- Reporting. How to report a mistake, such as private data entered into the wrong tool, and a promise that good-faith reports won’t be punished.
- Owner and review date. One named person or team, and a date for the next review.
How to write it, step by step
1. Find out what people already use
Ask. A short survey or a chat with each team lead will do. Make it clear you’re not looking to punish anyone. You want to know which tools are in use so the policy fits real work.
2. Sort your data into three groups
Fine to use with any approved tool, needs approval first, and never goes in. The AI data sharing checker walks through this one data type at a time, so you can see how the answer changes with the kind of tool.
3. Decide how much review each kind of output needs
A draft email needs less checking than a contract summary or a customer message. The AI human review matrix helps you set a level for each, from a quick self-check to expert sign-off.
4. Name an owner
Pick someone with the authority to approve tools and answer questions, such as IT, security, or a small group from several teams. A policy with no owner doesn’t get updated.
5. Write a first draft
The AI acceptable use policy generator turns your answers into a plain-language draft with the eight parts above. Edit it so it sounds like your organization.
6. Have it reviewed
Ask legal counsel to read it before you adopt it. Rules differ by industry and country, and a template can’t know yours. I’m not a lawyer, and nothing here is legal advice.
7. Tell people, and train them
A policy nobody reads does little. Send a short message that says what is changing and why. The AI rollout announcement writer drafts one, with answers to likely questions. Then use the AI training plan generator to plan short training for each group.
Mistakes to avoid
- Making it too long. Long policies get skipped. Move details to a linked page.
- Banning everything. People keep using AI, and you lose sight of how. It works better to approve good tools and be clear about the limits.
- Leaving out examples. “Do not share confidential information” is hard to apply. “Do not paste customer names or contracts into a chat tool” is easier.
- Setting it and forgetting it. Tools and risks change quickly. Review the policy at least twice a year, and again after any incident.
Common questions
- How long should an AI acceptable use policy be?
- One to two pages is enough for most teams. If people won’t read it, they won’t follow it. Put the long detail, such as the list of approved tools, in a separate page that you can update without rewriting the policy.
- Should we ban AI tools until the policy is ready?
- A ban rarely stops use. People often keep using AI on their own accounts, where you can’t see it. A short interim rule is usually better: use only the tools you have approved, and keep restricted data out of every AI tool until the policy is done.
- Does a small team need one?
- Yes, a short one. A small team has the same questions about data and review as a large one. It just needs fewer words to answer them.
I’m Courtney Stephenson, an AI strategy and implementation leader. Get in touch if you’re rolling out AI and want someone to look over your plan or your AI rules.