AI Acceptable Use Policy: [Organisation name]

Organisational policy for the use of artificial intelligence tools by staff, including generative AI assistants, coding assistants and AI features inside existing software. It sets which tools are approved, what may and may not be done with them, what data may go into prompts, and how outputs are checked and disclosed. Replace every [bracketed] value and every item marked Example. This is a policy format, not legal advice.

1. Purpose

This policy enables [Organisation name] staff to use AI tools to work better and faster, while protecting confidential information, personal data, intellectual property, customers and the organisation's reputation. It explains which tools may be used, for what, with which data, and under which checks.

2. Scope

This policy applies to:

• All people listed in "Applies to" above, whenever they act for the organisation.
• Any AI tool used for work, whether provided by the organisation, embedded in software the organisation uses, or accessed personally for work purposes.
• All activities that create, analyse, summarise, translate, classify or decide using AI.

Out of scope: building and deploying AI systems as products, which is governed by [AI development standard and AI risk assessment process].

3. Definitions

4. Approved tools register

Only tools in this register may be used for work. Requests for new tools go to [@ai-governance-lead] through [request form].

5. Permitted uses

Staff may use approved tools for tasks such as:

• Drafting and editing documents, emails and presentations that will be reviewed before sending.
• Summarising long documents, meeting notes or research within the permitted data class.
• Generating, explaining and reviewing code, subject to the security rules in section 10.
• Brainstorming ideas, outlines, test cases and alternatives.
• Translating internal content, with review by a fluent speaker for anything external.
• Analysing data that is permitted for the tool, with results checked before decisions.

6. Prohibited uses

Staff must not use AI tools to:

• Make or materially determine decisions about individuals (hiring, promotion, discipline, credit, eligibility) without the approved process and human decision-maker in [AI decision procedure].
• Enter data above the tool's permitted class, or any data listed as never allowed in section 7.
• Create content that is deceptive, harassing, discriminatory or that impersonates a real person.
• Generate content that infringes copyright or trade marks, or reproduce third-party material at length.
• Bypass security controls, write malware, or test systems without authorisation.
• Use personal accounts or unapproved tools for work data.
• Present AI output as professional advice (legal, medical, financial) to customers without qualified review.

7. Data classification rules for prompts

Never enter into any AI tool: passwords, API keys, private keys, payment card numbers, or government identity numbers.

8. Human review requirements

The person who uses an output is responsible for it, regardless of whether AI produced it.

9. Intellectual property and confidentiality

• Outputs created for work belong to [Organisation name] as work product, subject to tool terms.
• Do not enter third-party confidential information unless the contract allows it and the tool is approved for that class.
• Check outputs for close copies of third-party text, images or code before external use; use the code assistant's licence filter where available.
• Do not use AI tools to process customer data unless the customer agreement and the data processing terms permit it.

10. Disclosure and transparency

• Tell recipients when content they receive is substantially AI-generated and not reviewed by a person, for example automated replies.
• Label AI-generated images, audio or video used externally as such.
• Inform meeting participants before AI transcription or recording starts.
• Follow customer or publisher rules that require disclosure of AI assistance.

11. Security

• Use only organisation accounts with single sign-on and multi-factor authentication.
• Do not connect AI tools to email, files or other systems through plug-ins or agents unless the integration is approved in the register.
• Treat content from external sources (web pages, documents, emails) given to an AI tool as untrusted; it may contain hidden instructions.
• Do not run AI-generated code or commands without reading and understanding them.

12. Training

All staff complete [AI basics course] within [30] days of joining and yearly after. Staff using restricted-class tools or building AI-assisted workflows complete [advanced course]. Completion is tracked by [HR system].

13. Incident reporting

Report immediately to [security contact or form] if you:

• Entered data into a tool that was not permitted for it.
• Received output that is harmful, discriminatory, or reveals someone else's data.
• Suspect a tool or integration has been manipulated or compromised.

Reports made promptly in good faith will not lead to disciplinary action for the original mistake.

14. Exceptions

Exceptions require written approval from [@ai-governance-lead] and [@security-lead], a documented risk assessment, and an expiry date of no more than [12] months. Exceptions are recorded in [exceptions register].

15. Enforcement and review

Breaches may lead to removal of tool access and to disciplinary action under [disciplinary policy]. The owner reviews this policy at least every [12] months and after significant changes in tools, law or incidents.

16. Acknowledgement

I have read and understood the AI Acceptable Use Policy [POL-AI-001] version [1.0] and agree to follow it.

Standard and licence note

Based on common industry practice for organisational AI acceptable use policies. Original text written for this collection; adapt it with your legal, security and privacy advisers. This is a policy format, not legal advice. Template licence: MIT.