What is an AI acceptable use policy?
An AI acceptable use policy is a written document that tells employees which AI tools they may use at work, what data they may enter into them, which tasks are permitted, and whom to ask when a situation is not covered. It sits alongside the existing acceptable use policy for email, internet, and company devices, and many companies publish it as an addendum to that document.
A workable policy is short and specific. It names the approved tools, such as the company’s own private AI platform and any licensed assistant. It lists the data classes that may never be entered into public tools, typically customer records, pricing, source code, and anything under a non-disclosure agreement. It states which AI-produced work a person must review before it reaches a customer, a regulator, or a court. And it names the owner who grants exceptions and approves new tools.
Why an AI acceptable use policy matters
Without a policy, staff decide for themselves, and the result is shadow AI: personal chatbot accounts holding supplier contracts, meeting transcripts, and patient details. The policy gives employees a clear answer, gives IT a basis for blocking unapproved tools, and gives the company a defensible position when a customer or auditor asks how AI use is controlled. It also supports the AI literacy that the EU AI Act expects companies to build among the staff who operate AI systems.
AI acceptable use policy in practice
A building-products distributor with 600 employees found that sales representatives were pasting supplier price lists into a free chatbot to draft quotes. The new policy approved one internal assistant running on the company’s own infrastructure, allowed public tools only for text containing no customer or supplier data, and required a manager to review any AI-drafted quote above a set value. IT paired the policy with a 30-minute training session and a request form for new tools, and every approved tool was added to the company’s AI inventory.
What to watch for
- Keep it enforceable. A policy that bans every public tool will be ignored, while one that approves a good internal option will be followed.
- Tie data rules to data classification. Staff can follow “never enter restricted data” only if they know which data is restricted.
- State the review rule. Name the outputs a human must check before they leave the company, such as contracts, financial figures, and anything sent to a regulator.
- Cover agents separately. An assistant that drafts text and an agent that can change records in the ERP carry different risks and need different approvals.
- Assign an owner and a review date. Tools, vendor terms, and regulations change, and a policy nobody maintains stops being followed.