How to Write an AI Acceptable Use Policy for Your Business (With Template)

Your team is probably already using AI tools — to draft emails, summarise documents or brainstorm ideas — whether or not you have approved them. An AI acceptable use policy turns that informal use into safe, consistent practice. It does not need to be long: one or two pages that people actually read are better than a legal document nobody opens.

Why you need one

• Protect confidential and personal data from being pasted into consumer tools
• Make sure AI output is checked before it reaches customers
• Avoid paying for duplicate tools across teams
• Meet customer and contract expectations about how you handle their data
• Give staff confidence to use AI productively instead of secretly

What to include

1. Purpose and scope

State why the policy exists and who it covers: employees, contractors and anyone using company accounts or data.

2. Approved tools

List the AI tools staff may use for work and which plans (business plans, not personal consumer accounts). Explain how to request a new tool.

3. Data rules

Define what may and may not be entered into AI tools. A simple traffic-light system works well: green (public information), amber (internal information — approved business tools only), red (never: passwords, payment card numbers, health data, client confidential material unless explicitly permitted).

4. Human review

Require a person to check AI output for accuracy, tone and appropriateness before it is published, sent to customers, used in decisions or committed to code.

5. Disclosure and intellectual property

Say when AI assistance should be disclosed (for example to clients who require it) and remind staff to respect copyright and avoid passing off others' work.

6. Prohibited uses

List uses that are not allowed, such as making employment decisions solely with AI, generating misleading content or impersonating real people.

7. Ownership and review

Name who owns the policy and admin settings, how incidents are reported and how often the policy is reviewed (every six months is sensible given how fast tools change).

One-page template

1. Purpose: This policy explains how [Company] staff may use AI tools safely and productively.
2. Scope: It applies to all employees and contractors using company accounts, devices or data.
3. Approved tools: [Tool A — business plan], [Tool B — included with our Microsoft 365 / Google Workspace]. Request new tools from [owner].
4. Never enter: passwords, payment details, personal data about customers or staff, or client confidential information — unless [owner] has approved a specific tool and use.
5. Always review: a person must check AI output before it is published, sent externally or used to make decisions.
6. Be transparent: disclose AI assistance when a client, contract or law requires it.
7. Do not use AI to: make hiring or disciplinary decisions on its own, create misleading content or impersonate real people.
8. Report problems: tell [owner] immediately if confidential data may have been shared or AI output caused an error.
9. Review: this policy is reviewed every six months. Last updated [date].

Configure the tools to match the policy

• Use business or enterprise plans that exclude your data from model training by default
• Enable SSO and remove access when people leave
• Set data retention to the shortest period that works
• Restrict connectors to the data sources you have approved
• Review usage reports quarterly and reassign unused seats

Frequently asked questions

Does a small business really need an AI policy?

Yes, if anyone uses AI tools for work. A one-page policy prevents the most common problems: confidential data in consumer tools and unchecked output reaching customers.

Can we ban AI tools instead?

You can, but staff often use them anyway. Approving specific business tools with clear rules is usually safer than a ban.

Which AI tools should we approve?

Business plans from major vendors that exclude your data from training by default and offer admin controls. See our best AI assistants guide for options.

How often should we update the policy?

Every six months, or whenever you add a new tool or a new type of data.