How to Write an AI Acceptable Use Policy for Your Company

Most companies have discovered that their employees are already using AI tools without any guidance. ChatGPT, Claude, Gemini, Copilot — these are in use across every function. The question is no longer whether your people use AI. It is whether they use it in ways that create legal, security, reputational, and quality risk for the business without knowing they are doing so.

An AI acceptable use policy is the document that defines what is permitted, what is prohibited, and who is responsible for what. This guide explains what it needs to cover and how to structure one that people will actually read and follow.

Why Informal Guidance Is Not Enough

The instinct in most organisations is to send an all-hands email with some tips on using AI responsibly and call it done. This fails for several reasons.

An email is not a policy. It cannot be cited when someone misuses a tool and claims they did not know the rules. It does not create accountability. It does not get signed. And it does not address the specific decisions that actually matter: what data can go into an AI tool, who can use AI for customer-facing outputs, and what happens when something goes wrong.

A policy document creates a baseline that protects the company legally, creates clarity for employees who genuinely want to do the right thing, and establishes governance that scales as AI capability grows.

What an AI Policy Needs to Cover

Permitted and Prohibited Uses

Define explicitly what employees are permitted to use AI for, and what they are not.

Common permitted uses:

• Drafting internal documents, communications, and presentations for human review before use
• Summarising meetings, research, or reports
• Writing first drafts of content that will be edited and approved by a human
• Generating code that will be reviewed and tested before deployment
• Brainstorming and ideation

Common prohibited uses:

• Inputting customer personal data, financial data, or confidential client information into consumer-facing AI tools (those that may use inputs for training)
• Using AI-generated content in customer communications without human review
• Using AI tools to make or recommend consequential decisions about employees (hiring, performance, dismissal) without documented human review
• Representing AI-generated work as original human work in contexts where that distinction matters (academic, legal, regulatory)

The specific line between permitted and prohibited will vary by industry, by the sensitivity of your data, and by your regulatory environment. The policy needs to reflect your specific circumstances, not a generic template.

Data Classification

Not all data is equal risk when it enters an AI system. The policy should specify what data categories can and cannot be used with AI tools.

A practical three-tier approach:

Tier 1 (AI-safe): Public information, general business knowledge, company-published content, anonymised aggregates. These can be used with any AI tool.

Tier 2 (AI-use with restrictions): Internal documents, non-sensitive business processes, general commercial information. These can be used with AI tools that have signed data processing agreements and do not use inputs for training.

Tier 3 (AI-prohibited): Customer personal data, financial records, legal documents under privilege, medical information, confidential business strategies, employee personal data. These should not enter consumer AI tools under any circumstances.

This classification gives employees a usable decision framework rather than leaving them to guess in each situation.

Tool Approval

A blanket prohibition on all AI tools other than one approved vendor is not realistic in practice. People will use the tools that work best for their tasks. A more effective approach is a tiered approval model:

• Approved tools: Tools the company has evaluated, accepted the terms of service for, and confirmed meet data handling requirements. Employees can use these without additional approval.
• Conditional tools: Tools not yet evaluated that may be acceptable for Tier 1 or Tier 2 data. Require line-manager approval before use.
• Prohibited tools: Tools that do not meet your data handling requirements or that have known issues relevant to your use case.

Publish and maintain an approved tool list. An annual review at minimum, or whenever significant new tools become widely used.

Attribution and Transparency Requirements

Define when employees must disclose that AI was used in producing a piece of work. The answer varies significantly by context:

• Internal reports: disclosure may not be required
• Customer-facing content: disclosure requirements should match any regulatory obligations and your brand standards
• External publications under the company's name: establish whether AI-generated content is acceptable and under what conditions
• Work submitted to regulators or as part of legal proceedings: understand the disclosure requirements in your jurisdiction

The absence of an attribution policy leaves employees making individual judgment calls that may expose the company to reputational or legal risk.

Quality and Accuracy Standards

AI systems hallucinate. They produce confident-sounding incorrect information. Any use of AI for factual content — customer-facing materials, technical documentation, legal analysis, financial summaries — requires defined verification requirements.

The policy should state: AI-generated content that will be used externally must be verified for factual accuracy by a named person before it is used. This is not optional.

If you want to understand the nature and frequency of these failures, the guide on AI hallucinations and their business risk is essential context for building verification requirements that are appropriately calibrated.

Data Retention and Confidentiality

Consumer AI tools typically retain chat history that can be reviewed by the provider's staff for quality and safety purposes. Employees who input sensitive information into these tools are inadvertently sharing that information with the AI provider.

The policy should address: what data employees may share, with which tools, and what happens to data they have shared. In regulated industries, the policy should reflect legal obligations around data handling that apply to AI tools as third-party processors.

Incident Reporting

Define what employees should do when they:

• Suspect they have shared data they should not have
• Observe AI-generated content that appears to be false and has been distributed
• Encounter an AI tool behaving unexpectedly in a way that could cause harm

A named contact (typically IT security, legal, or compliance depending on the incident type) and a clear reporting process turn incidents from unreported liabilities into manageable events.

Ownership and Accountability

Every section of the policy should have a named owner responsible for it. AI governance is not the job of "the company" in the abstract. It is the job of specific people.

Designate:

• An overall AI policy owner (typically the CTO, COO, or a specific compliance role)
• Function-specific owners for high-risk use areas (legal for any AI use in legal contexts, finance for financial applications)
• A named person employees contact when they are unsure whether a specific use is permitted

Making It Live in the Organisation

Policies only work if people read, understand, and can apply them. The implementation matters as much as the content.

Recommendations for rollout:

• Require all employees to acknowledge the policy before using company AI tools
• Build a brief (30-minute) AI use orientation into onboarding
• Include AI use expectations in role-specific guidance for functions with high AI exposure
• Review and update annually, or when significant capability changes occur

A policy created once and never revisited will be outdated within twelve months given the pace of AI development.

The Connection to AI Strategy

An AI acceptable use policy is not the same as an AI strategy. The policy governs responsible use. The strategy governs what you build and invest in. Both are required. An organisation with AI tools but no policy is accumulating risk. An organisation with a policy but no strategy is not capturing opportunity.

If you have not yet built your AI strategy, the AI strategy guide covers how to identify, prioritise, and sequence AI initiatives for your specific business.

For businesses that want support writing an AI use policy that reflects their specific regulatory environment, data classification requirements, and operational context, our AI automation team can help design governance frameworks alongside the AI solutions we build. Contact us to discuss your situation.