AI Acceptable Use Policy Template

Staff are already pasting contracts, customer records and source code into AI tools, and most organisations have no written rule that says which tools are allowed, what data may go into them or who answers for the output. This template is a ready-to-adapt AI acceptable use policy for employees and contractors. It covers generative AI chat tools, copilots and AI agents that act with a user's credentials: approved tools, data rules by classification, prohibited uses, human review, intellectual property, disclosure, security, incident reporting, training and enforcement. It is for CISOs, AI governance leads, HR and legal teams who need a policy staff can read in ten minutes.

How to use this template

• Replace text in square brackets, such as [Organisation], [AI governance group] and [approved tools register], with your own terms, and delete any section that does not apply.
• "Must" and "must not" are mandatory. "Should" is expected practice where a documented exception may be justified.
• Keep the tool list in the register, not the policy, so a new tool does not need policy re-approval.
• This policy covers how people use AI. Agents your organisation builds or deploys need their own controls: use the Agentic AI Security Policy Template alongside it.
• Have HR, legal, privacy and works council or employee representatives review it before issue, and align disciplinary wording with your existing acceptable use policy. It sits under your top-level security policy; see the Information Security Policy Template.
• This template is guidance, not legal advice. Check the data protection, employment and AI rules that apply in each country where you operate.

1. Purpose

This policy sets the rules for the use of artificial intelligence (AI) tools by people working for or on behalf of [Organisation]. It allows staff to use AI to work faster and better while protecting [Organisation]'s information, customers, intellectual property and reputation, and meeting its legal obligations, including data protection law and, where it applies, Regulation (EU) 2024/1689 (the EU AI Act).

2. Scope

This policy applies to all employees, contractors, temporary staff, interns and third parties who use AI tools for [Organisation] work, on any device, whether the tool is provided by [Organisation] or not. It covers:

• Generative AI chat and content tools, and AI features built into existing software, such as office, CRM and meeting copilots.
• AI coding assistants and AI browser extensions.
• AI agents and automations that act on a user's behalf, such as sending email, updating records or running code.
• Personal or free AI accounts when used for any [Organisation] work.

3. Definitions

• AI tool: any software that uses an AI model to generate content, answer questions, summarise, classify, write code or take actions.
• Approved AI tool: a tool listed in the [approved tools register], used under an [Organisation] account with the contractual and technical controls recorded there.
• AI agent: an AI tool that can decide on and carry out actions, such as calling APIs, using applications or changing data, with or without approval of each step.
• Prompt: any input to an AI tool, including typed text, uploaded files and connected data sources.
• Output: anything an AI tool produces, including text, code, images and actions.

4. Roles and responsibilities

• [AI governance group]: owns this policy, approves tools and high-risk use cases, and decides exceptions.
• [CISO / Security team]: assesses AI tools for security, sets technical controls, monitors use and handles AI-related incidents.
• [Data Protection Officer / Privacy team]: advises on personal data use and decides when a data protection impact assessment is needed.
• [Legal team]: advises on intellectual property, contracts, disclosure and regulatory obligations.
• Managers and users: managers make sure their teams complete training; every user follows this policy and reports concerns.

5. Approved AI tools and the request process

Users must use only AI tools in the [approved tools register] for [Organisation] work, under their [Organisation] account. The register sets one of three statuses for each tool:

To request a new tool or a new use of an approved tool:

1. Submit a request through [service portal] describing the business need, users, data types and any integrations or connections to [Organisation] systems.
2. [Security team] and [Privacy team] assess the tool, including the provider's terms on training use of data, data retention and location, sub-processors, single sign-on, admin controls, audit logs and security certifications. See the Third-Party AI Risk Guide.
3. Where the tool processes personal data in a way likely to result in high risk, [Privacy team] decides whether a data protection impact assessment is required before use.
4. [AI governance group] approves, approves with conditions or rejects the request within [target days], and the register is updated.
5. Users must not grant an AI tool access to [Organisation] email, files, calendars or other systems through OAuth consent, API keys or browser extensions unless that integration is approved.

Enterprise terms vary by product tier. For example, OpenAI states for its business offerings, such as ChatGPT Enterprise and the API, that "By default, we do not use your business data for training our models", while consumer accounts are governed by different settings. Assess the terms of the tier you will actually buy.

6. Data rules by classification

Users must apply [Organisation]'s [information classification policy] to everything they put into an AI tool, including uploaded files and connected data sources. Users must not enter confidential or personal data into any tool that is not approved for it. See the Data Classification Guide.

• Users must remove or mask personal data and client identifiers that the task does not need before entering content.
• Users must not enter passwords, API keys, tokens, private keys, connection strings or session cookies into any AI tool, including approved ones.
• Users must not upload third-party content where a contract or licence forbids it, such as client data covered by confidentiality terms or licensed research.
• Copilots inherit the user's own access. Microsoft, for example, states that "Microsoft 365 Copilot only surfaces organizational data to which individual users have at least view permissions." Users must report content they can see but should not, rather than use it.

7. Prohibited uses

Users must not use AI tools to:

1. Make or materially determine decisions about a person's employment, pay, credit, insurance or access to services without an approved use case, a human decision-maker and, where required, an impact assessment.
2. Profile colleagues, candidates or customers, or infer their emotions, health, political views or other sensitive characteristics.
3. Create deceptive content, such as deepfakes of real people, impersonation, fake reviews or fabricated evidence.
4. Generate malware or phishing content, except for security testing approved by [Security team].
5. Produce unlawful, harassing, discriminatory or sexually explicit content, or anything in breach of [code of conduct].
6. Bypass security controls, data loss prevention or AI tool restrictions, including through personal accounts or devices.
7. Present AI output as legal, medical, financial or safety advice without review by a qualified person.

Some of these uses are also unlawful. Article 5 of the EU AI Act has prohibited certain AI practices since 2 February 2025, including AI systems that infer the emotions of people in the workplace or in education, except for medical or safety reasons. See the EU AI Act Compliance Guide.

8. Human review of outputs

AI tools can produce confident but false content. NIST AI 600-1 lists this as "Confabulation" and lists "Human-AI Configuration" risks such as over-reliance and automation bias. The user who uses an output is accountable for it.

• Users must check facts, figures, citations, quotes and legal or regulatory references against a reliable source before using AI output in any work product.
• AI-generated code must pass the same review, testing and security scanning as human-written code, and must not be merged by the person who generated it without a second reviewer for [critical repositories].
• External communications, customer advice and published content drafted with AI must be reviewed by a person with authority to approve them.
• Users must not rely on AI output for decisions with legal or similarly significant effects on a person unless a qualified person has reviewed the output and can override it.

9. Intellectual property and confidentiality

• Users must not input third-party copyrighted material, trade secrets or client confidential information unless [Organisation] has the right to do so and the tool is approved for it.
• Users must not ask AI tools to reproduce identifiable copyrighted works, brands or a living artist's style for commercial use without [Legal team] approval.
• Copyright protection for AI output may be limited. The US Copyright Office concluded in January 2025 that "prompts do not alone provide sufficient control" to make the user the author. Where ownership matters, such as product code, designs or published works, users must keep a record of their human contribution and follow [Legal team] guidance.
• Open source code suggested by AI coding tools must comply with [open source policy], including licence checks.

10. Disclosure and transparency

• Users must tell recipients when content they receive was substantially generated by AI and has not been reviewed, and must label AI-generated images, audio and video that show real people or events.
• Customer-facing chatbots and AI assistants must tell people they are interacting with AI unless this is obvious, consistent with EU AI Act Article 50(1). The Article 50 transparency obligations apply from 2 August 2026.
• Under Article 50(4), deployers must disclose deep fakes, and AI-generated text published to inform the public on matters of public interest unless it has undergone human review or editorial control and someone holds editorial responsibility. [Communications team] owns these disclosures.
• Users must not use AI note-takers or recording tools in meetings without telling participants, and must follow [recording policy].

11. AI agents, automation and delegated access

When an AI agent or automation acts for a user, it uses that user's identity and access. OWASP identifies "excessive functionality", "excessive permissions" and "excessive autonomy" as the root causes of excessive agency. Users must:

1. Connect agents to [Organisation] systems only through approved integrations, granting the narrowest scopes offered, such as read-only rather than full mailbox access.
2. Never give an agent their password, MFA codes, personal access tokens or browser session, and never share their account with an agent through a shared login.
3. Not create personal API keys or service accounts for agents or scripts. Credentials for automations must be requested from [IAM team], stored in [approved secrets manager] and owned by a named person.
4. Require their own approval before an agent sends external communications, makes payments, deletes data, changes access rights or deploys to production.
5. Review and revoke agent and app consents they no longer need, at least every [quarter], and when they change role.
6. Record any agent that runs on a schedule or acts without them present in the [AI use case register].

The PocketOS database deletion shows what happens when an AI coding agent can reach an over-privileged token. See the AI Agent Authorisation Guide.

12. Security

• Prompt injection: content an AI tool reads, such as a web page, email, document or calendar invite, can contain hidden instructions. OWASP describes indirect prompt injection as occurring "when an LLM accepts input from external sources, such as websites or files." Users must be cautious when AI tools process untrusted content and must not approve actions an assistant proposes after reading it without checking them. The EchoLeak flaw showed how an email could make a copilot leak data.
• Secrets: users must not put API keys or credentials in prompts, custom instructions, agent memory or shared prompt libraries. Exposed AI API keys are actively abused; see the LLMjacking Guide.
• Extensions and accounts: users must install AI browser extensions, IDE plugins and MCP servers only from the [approved list], and sign in to AI tools with [Organisation] single sign-on.

13. Reporting incidents and concerns

Users must report the following to [security incident contact or portal] immediately, and in any case within [24 hours]:

• Confidential, Restricted or personal data entered into a tool not approved for it, or credentials entered into any AI tool.
• An AI tool or agent taking an action the user did not intend or approve, or suspected manipulation of an AI tool.
• Output containing other people's personal data, or harmful or discriminatory output that has been used or published.

Prompt self-reporting is treated as a mitigating factor. [Privacy team] assesses whether breach notification is required.

14. Training and AI literacy

All users must complete [AI acceptable use training] before receiving access to approved AI tools, and refresher training every [12 months]. Users of high-risk use cases, AI agents and developer tools must complete additional role-based training. Article 4 of the EU AI Act, which applies from 2 February 2025, requires providers and deployers to "take measures to support the development of AI literacy" of staff who use AI systems on their behalf. [Organisation] records completion as evidence of these measures.

15. Monitoring and enforcement

• [Organisation] monitors AI tool access, prompts and outputs in approved tools, and data transfers to AI services, in line with [monitoring policy] and applicable law, and may block unapproved AI services and revoke non-compliant integrations.
• Breaches of this policy may lead to withdrawal of access and action under [disciplinary procedure]. Breaches by contractors are handled under their contract.
• Exceptions must be requested through [service portal], approved by [AI governance group], recorded with compensating controls and an expiry date.

16. Review

[AI governance group] reviews this policy at least every [12 months], and sooner after a significant incident, a change in law or regulation, or the introduction of a new class of AI tool. The [approved tools register] is reviewed at least every [quarter].

17. Acknowledgement

I confirm that I have read and understood the [Organisation] AI Acceptable Use Policy, version [x.x], and that I will use AI tools in line with it.

Name: [ ] · Role: [ ] · Signature or electronic acceptance: [ ] · Date: [ ]

18. Related documents and references

Related [Organisation] documents: [Information Security Policy] · [Acceptable Use Policy] · [Information Classification Policy] · [Data Protection Policy] · [Agentic AI Security Policy] · [Open Source Policy] · [Incident Response Procedure] · [Disciplinary Procedure].

External references:

1. EU AI Act: Article 4, AI literacy
2. EU AI Act: Article 50, Transparency obligations for providers and deployers of certain AI systems
3. NIST: AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile
4. OWASP: LLM01:2025 Prompt Injection
5. OWASP: LLM02:2025 Sensitive Information Disclosure
6. OWASP: LLM06:2025 Excessive Agency
7. US Copyright Office: Copyright and Artificial Intelligence, Part 2: Copyrightability
8. Microsoft Learn: Data, Privacy, and Security for Microsoft 365 Copilot
9. OpenAI: Enterprise privacy

Implementation guidance

A policy without an approved alternative drives use underground. Roll it out in this order:

1. Discover current use first: review proxy, DNS, CASB and OAuth consent logs for AI services and AI apps already connected to email and files, so the approved list reflects real demand. See the Shadow AI Discovery Guide and the SaaS and OAuth App Governance Guide; the Vercel Context.ai breach began with a forgotten AI app's OAuth token.
2. Approve at least one enterprise tool before issuing the policy, with single sign-on, training on customer data switched off and retention set.
3. Configure copilots before rollout: fix overshared sites and apply sensitivity labels, because copilots surface whatever users can already open. See the Enterprise AI Copilot Security Guide.
4. Enforce the data rules technically: data loss prevention on AI sites and prompts, warn or block on unapproved AI domains, and restricted user consent to third-party apps. Run in audit mode for [four weeks], then block Restricted data; roll back to warn-only if false positives stop legitimate work. See the Generative AI Data Loss Prevention Guide.
5. Train, collect acknowledgements and review quarterly using the measures below. See the Security Awareness and Human Risk Management Guide.

ISO/IEC 42001: if [Organisation] runs an AI management system, this policy is evidence for clause 5.2 (AI policy) and Annex A control A.2.2, and its tool register can feed your AI system inventory. See the ISO/IEC 42001 Guide.

Small and large organisations: a small organisation can approve one enterprise assistant, adopt sections 1 to 8 and 12 to 17, and keep the register in a spreadsheet. A large organisation should run the request process through its third-party risk workflow, tie tool approval to its AI Governance Guide use case register, and set data rules per business unit. See the AI Governance Platform Buyer's Guide for tooling that runs registers and approvals at scale.

Measures: share of AI traffic going to approved tools; number of unapproved AI services and OAuth grants found per month; DLP blocks and overrides on AI destinations; training and acknowledgement completion; AI-related incidents self-reported versus detected; and time to decide tool requests.

This template is provided for guidance, must be adapted to your organisation and is not legal advice. Related NHI Mgmt Group resources: Agentic AI Security Policy Template · AI Governance Guide · Shadow AI Discovery Guide · Data Loss Prevention (DLP) Guide · Prompt Injection Guide