Notifications
Clear all
Topic starter
21/08/2026 4:44 pm
TL;DR: AI acceptable use policies are becoming a basic control for organisations that already have employees using ChatGPT-style tools, because the real risk is accidental data exposure rather than overt misuse, according to Orion. The policy only works when it pairs plain-language rules with visibility and enforcement, because shadow AI turns written guidance into a false sense of control.
NHIMG editorial — based on content published by Orion: How to Write an AI Acceptable Use Policy: What to Include
Questions worth separating out
Q: How should organisations write an AI acceptable use policy that employees will follow?
A: Start with a short policy that names approved tools, prohibited tools, allowed data classes, human review requirements, and accountability.
Q: Why do AI acceptable use policies fail when teams rely on them alone?
A: They fail because policy cannot observe prompts, uploads, or model interactions in real time.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Define sanctioned AI usage by data class Write the data rule in plain language, with examples that say exactly which data types are allowed in approved tools and which are never allowed, including source code, secrets, API keys, regulated records, and customer data.
- Create a fast approval path for new AI tools Build a request process that returns in days, not weeks, so employees do not bypass governance with consumer tools.
- Tie AI use to existing identity and conduct controls Map the policy to employee accountability, acceptable conduct, and data handling obligations so the rule is enforceable under existing governance processes rather than a standalone document.
What's in the full article
Orion's full guide covers the operational detail this post intentionally leaves for the source:
- A step-by-step AI AUP template with the seven sections mapped into ready-to-use policy language.
- Examples of approved and prohibited AI data types that teams can adapt for their own environment.
- Rollout guidance for cross-functional ownership across security, legal, HR, and business teams.
- Practical guidance on quarterly review cadence and how to keep the approved-tools list current.
👉 Read Orion's guide to writing an AI acceptable use policy →
AI acceptable use policy governance: is your data rule actually working?
Explore further
21/08/2026 5:04 pm
AI acceptable use is now an identity governance problem, not just a policy exercise. The article correctly treats employee AI use as a control boundary issue, because human identities are already interacting with unmanaged external models. Once data leaves the governed environment, traditional access controls no longer describe where it went or how it may be reused. That shifts the question from permission to accountability, and practitioners should treat AI AUPs as part of broader identity and data governance.
A question worth separating out:
Q: Who should be accountable for AI spend and access governance?
A: Accountability should sit with the identity and security programme, with finance as a partner on reporting. AI spend reflects active identity use, connected tools, and policy scope, so it cannot be managed as procurement alone. The right control model assigns ownership for accounts, integrations, and usage review.
👉 Read our full editorial: AI acceptable use policies are becoming a baseline control for data risk
