Draft, not legal advice. This draft was generated from a general-purpose template. It is provided as is, without warranty, and it is not legal advice. It does not create an attorney-client relationship or guarantee compliance with any law, regulation, or contract. Requirements differ by country, state, and industry. Have qualified legal counsel review and adapt it, and replace every bracketed placeholder, before you adopt it. Delete this note once that review is done.
[Organization name] AI Acceptable Use Policy
1. Purpose
This policy sets out how people at [Organization name] may use artificial intelligence (AI) tools, including chat assistants, writing and coding tools, and AI features built into other software. It exists to help us capture the benefits of AI while protecting people, data, and our reputation.
2. Who this applies to
This policy applies to all employees and contractors of [Organization name]. It covers any AI tool used for work, whether [Organization name] provides the tool or the person acquired it themselves.
3. Which tools you may use
Use approved AI tools for any work that involves non-public information. [Policy owner] maintains the current list. Public AI tools may be used only for tasks that involve no confidential, personal, or restricted data, such as brainstorming or explaining public concepts.
To request approval of a new tool, contact [Policy owner].
4. Protecting data
Never enter the following into an AI tool that has not been approved for that type of data:
- Customer personal data
- Employee and HR records
- Proprietary source code
- Non-public financial information
- Passwords, keys, and other credentials
- Unreleased products and strategy
- Confidential information that belongs to customers or partners
When you are unsure whether information is restricted, treat it as restricted and ask [Policy owner].
5. Human accountability and review
AI output can be wrong, biased, or out of date. The person who uses AI output is responsible for it, as if they had written it themselves.
Review and verify AI-assisted work before it reaches customers or is used in decisions that affect people, money, safety, or legal standing. Internal drafts and brainstorming are left to the individual’s judgment.
- Check facts, figures, citations, and quotations against reliable sources.
- Test and review AI-generated code before it ships.
- Don’t pass along AI output you don’t understand.
6. Transparency
Tell customers and other outside parties when they are interacting directly with an AI system, or when AI has produced substantial content that they are relying on.
7. Prohibited uses
The following uses are not permitted:
- Making hiring, firing, credit, or similar decisions about people without human review
- Creating deceptive content or impersonating real people
- Processing regulated data in tools that haven’t been approved for it
- Giving legal, medical, or financial advice based only on AI output
- Getting around security, licensing, or access controls
- Any use that breaks the law, our contracts, or other [Organization name] policies.
8. Reporting concerns and incidents
Report to [Policy owner] the same business day if you believe confidential data was entered into an unapproved tool, an AI tool produced harmful or biased output, or someone has misused AI. Reports made in good faith will not be penalized.
9. Training
Everyone covered by this policy must complete [Organization name]’s AI use training before using AI tools for work, and again when this policy changes in a significant way.
10. Enforcement and exceptions
Violations may lead to disciplinary action, up to and including ending employment or a contract, in line with [Organization name]’s existing policies. Exceptions require written approval from [Policy owner].
11. Review
[Policy owner] will review this policy every six months, and sooner if laws, tools, or risks change in a significant way.
Effective date: [date]. Policy owner: [Policy owner].