Product Acceptable Use Policy Template (SaaS, DSA)

Customer-facing AUP for SaaS or platforms: prohibited content and conduct, usage limits, AI rules, abuse reports, enforcement, statement of reasons, appeals

法務標準Regulation (EU) 2022/2065 (DSA) Arts. 14, 16, 17, 20, 21, 23product acceptable use policy更新 2026/10/29

エディタで開く.mdをダウンロード

使い方: Use it when customers or their users can upload content or use your service in ways that could harm others. Write each rule as an observable behaviour and set the enforcement ladder before publishing. The main pitfall is rules you do not enforce consistently, or restrictions without a statement of reasons and an appeal route under the DSA.

プレビュー

Acceptable Use Policy: [Product name]

Format for a customer-facing acceptable use policy (AUP) for a SaaS product, hosting service, API or online platform: what users and their end users may not do with the service, usage limits, rules for AI features, how to report abuse, how the provider enforces the policy and how users can appeal. Based on common online-service practice, with the EU Digital Services Act duties on terms and conditions and content moderation (Regulation (EU) 2022/2065, Art. 14 and related articles, applying since 17 February 2024). Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice. It makes no claim that the policy is enforceable or meets every legal duty that applies to your service. Have a qualified lawyer review it before you publish it. For an internal staff policy on using company IT, use the compliance/acceptable-use-policy template instead.

Document control

Field	Value
Document ID	[LEGAL-AUP-001]
Service	[Product name and URL]
Provider	[Legal entity]
Version	[0.1]
Status	[Draft / Legal review / Approved / Published]
Owner	[@owner, Trust and Safety or Legal]
Approvers / reviewers	[Legal counsel], [Security lead], [Product owner]
DSA role	[Hosting service / Online platform / Not a hosting service]
Last updated	YYYY-MM-DD
Classification	Public once published

Approvals

Role	Name	Decision	Date
Legal counsel	[@name]	[Approved / Changes requested]	YYYY-MM-DD
Trust and safety lead	[@name]	[Approved enforcement process]	YYYY-MM-DD
Security lead	[@name]	[Approved security rules]	YYYY-MM-DD

Revision history

Version	Date	Author	Change summary	Users notified
0.1	YYYY-MM-DD	[@name]	First draft	n/a
1.0	YYYY-MM-DD	[@name]	Example: First published version	n/a
1.1	YYYY-MM-DD	[@name]	Example: Added rules for AI form assistant (section 5)	Email and in-app notice, 30 days ahead

1. Scope

This policy applies to everyone who uses [Product name], including customers, the people they invite, and anyone who submits content through a customer's [forms, pages or apps] (together, users). It forms part of our Terms of Service. Customers are responsible for making sure their own users follow it.

Example: Tarnwick Forms (fictional) is a hosted form builder. Customers build forms; their respondents submit answers. The policy covers both groups, and customers must not build forms that collect content banned in section 2.

2. Prohibited content

You must not use the service to create, upload, store, share or collect content that:

ID	Category	Examples
AUP-C-001	Is illegal where it is published or received	[Content that infringes intellectual property, illegal hate speech, terrorist content]
AUP-C-002	Sexually exploits or endangers children	Any such content, which we report to the authorities
AUP-C-003	Threatens or incites violence against people	[Threats, glorification of attacks on identifiable people]
AUP-C-004	Harasses or bullies a person	[Targeted abuse, sharing private information to cause harm]
AUP-C-005	Deceives people to obtain data or money	[Phishing pages, fake log-in forms, impersonating another organisation]
AUP-C-006	Contains malware or links to it	[Viruses, ransomware, drive-by downloads]
AUP-C-007	Collects special categories of personal data without a lawful basis	[Health or biometric data collected without the protections the law requires]
AUP-C-008	[Other category your service restricts]	[Examples]

3. Prohibited conduct

You must not:

ID	Rule
AUP-B-001	Access or try to access accounts, systems or data you are not authorised to access, or probe, scan or test the service's vulnerabilities, except under our security disclosure policy
AUP-B-002	Interfere with or overload the service, for example by denial-of-service attacks or by bypassing rate limits
AUP-B-003	Send unsolicited bulk messages (spam) through the service, or use it to collect email addresses for spam
AUP-B-004	Reverse engineer, scrape or copy the service except where the law allows it or we permit it in writing
AUP-B-005	Resell or sublicense the service unless your plan allows it
AUP-B-006	Create accounts by automated means, or to evade a suspension
AUP-B-007	Use the service to break sanctions or export control laws
AUP-B-008	Help or encourage anyone else to do any of the above

4. Usage limits

ID	Resource	Limit	When exceeded
AUP-L-001	[API requests]	[(N) per minute per key]	[Requests are rejected with an error until the next minute]
AUP-L-002	[Storage]	[(N) GB per workspace, see plan]	[We notify you and ask you to delete or upgrade]
AUP-L-003	[Outbound email]	[(N) per day]	[Sending pauses until the next day]
AUP-L-004 (Example)	Form submissions	10,000 per month on the Starter plan	Form stays open; extra submissions are kept and we offer an upgrade

5. AI features

When you use [AI feature name], you must not:

use it to produce content banned in section 2;
try to bypass its safety measures (for example with prompts designed to make it ignore its instructions);
present its output as human-written where the law requires disclosure, or use it to impersonate a real person;
use its output as the only basis for decisions with legal or similarly significant effects on people, unless your own processes include human review.

[Say whether prompts and outputs are used to train models, and how to opt out. Link to the privacy policy.]

6. Reporting a violation

Anyone can report content or behaviour that breaks this policy, or content they believe is illegal, at [report link] or [abuse email].

A notice is easiest to act on when it includes:

why you think the content is illegal or breaks this policy;
the exact location, such as the URL;
your name and email address (not required for reports of child sexual abuse material);
a statement that you believe in good faith that the notice is accurate and complete.

We confirm receipt [electronically, without undue delay] and tell you what we decided. If you believe someone's life or safety is at risk, contact the local emergency services first.

7. Enforcement

7.1 How we review. We review reports [using a combination of automated tools and trained staff]. [Describe which decisions are automated and when a person reviews them.]

7.2 Measures. Depending on how serious the violation is, whether it is repeated and its effect on others, we may:

Level	Measure	Typical trigger
1	Warning and request to fix	First minor violation
2	Remove or disable the specific content	Content that breaks section 2
3	Restrict features (for example sending or publishing)	Repeated violations, spam
4	Suspend the account for a set period	Serious or repeated violations after warning
5	Terminate the account	Severe violations, or repeated serious violations

We may act immediately, without a prior warning, where needed to protect people or the service, or where the law requires it.

7.3 Statement of reasons. When we restrict your content or account, we tell you what we did, the facts and the rule or law it was based on, whether automated means were used, and how you can challenge the decision.

7.4 Repeated misuse. We may suspend, for a reasonable period and after a prior warning, accounts that frequently provide manifestly illegal content, and stop processing notices from people who frequently submit manifestly unfounded ones.

8. Appeals

If you disagree with a decision, you can appeal at [appeal link] within [six months] of being told of it. Appeals are free. A member of our team who was not involved in the original decision reviews it and tells you the outcome [within (N) days]. If we were wrong, we reverse the measure without undue delay.

[EU users of an online platform: you may also refer the dispute to a certified out-of-court dispute settlement body, and you can go to court at any time.]

9. Changes and contact

We will tell you about significant changes to this policy [by email and in the product at least (30) days before they take effect], unless a change is needed sooner for legal or safety reasons.

Questions: [trust@example.com]. Security vulnerabilities: see our security policy (dev/security-policy).

References

Source	Status / date checked	Used for
Regulation (EU) 2022/2065 (Digital Services Act), Arts. 14, 16, 17, 20, 21, 23, eur-lex.europa.eu/eli/reg/2022/2065/oj	Applies since 2024-02-17 (European Commission, DSA questions and answers, read 2026-10-30)	Terms content, notice and action, statement of reasons, complaints, misuse
Regulation (EU) 2024/1689 (AI Act) as amended by Regulation (EU) 2026/1744, Art. 50	Applies from 2026-08-02, as used across this collection's ai-data templates; check the current text and guidance	Section 5
Terms of Service (legal-lite/terms-of-service)	This collection	Binding effect, termination
Internal staff policy (compliance/acceptable-use-policy)	This collection	Not the same document: internal use of company IT

Standard and licence note

Based on common online-service practice for acceptable use policies, with EU clauses based on Regulation (EU) 2022/2065 (Digital Services Act), paraphrased in original words. Check the current consolidated text and any national rules before use. This is a documentation format, not legal advice: it does not create a lawyer-client relationship and makes no claim that the policy is enforceable. Original text written for this collection; examples are fictional. Template licence: MIT.