Teach · Executives
How to write an AI acceptable use policy
An AI acceptable use policy is a short company document that states which AI tools employees may use, which data must never be entered into AI tools, when a person must review AI output, and who is accountable for AI-assisted work. A clear policy lets staff use AI confidently while protecting customers and company data.
- Reading time
- 8 min
- Chapters
- 6
- Last reviewed
- November 10, 2026
- Author
- Lingows AI Team
- Difficulty
- Intermediate
Before you start
- An executive sponsor for the policy
- A list of AI tools staff use today, even informally
- Any existing data classification or acceptable use policy
The steps at a glance
- Step 01
Survey current AI use
Learn which tools and tasks staff already use AI for.
- Step 02
Form a drafting group
Include leadership, IT or security, legal or compliance, HR, and active managers.
- Step 03
Draft the core sections
Write purpose, scope, tools, data, uses, review, disclosure, accountability, and review.
- Step 04
Classify data for AI use
Map data classes to public accounts and approved company tools.
- Step 05
Review and approve
Have counsel review where needed, then get leadership approval.
- Step 06
Launch with training and maintain
Train by team, publish a summary, and review the policy on a schedule.
Chapter 01
Why does a company need an AI acceptable use policy?
A company needs an AI acceptable use policy because employees already use AI tools, often public assistants on personal accounts, and without written rules each person decides alone what data is safe to share. A policy replaces guesswork with clear boundaries, protects customer and company data, and gives managers a standard to train against.
Banning AI rarely works. Staff who find AI useful keep using AI quietly, and the company loses visibility into what data leaves the building. A clear policy that approves good tools and draws firm lines around sensitive data brings that use into the open.
A policy also helps the people who are hesitant. Many employees avoid AI because they are unsure what is allowed. Written rules give them permission to try approved tools on approved tasks.
Chapter 02
Who should write and approve the policy?
An AI acceptable use policy should be drafted by a small group that includes an executive sponsor, IT or security, legal or compliance, HR, and one or two managers from teams that use AI heavily. Leadership approves the final version. Broad input keeps the policy practical, and executive approval gives the rules weight.
Policies written only by legal tend to prohibit everything. Policies written only by enthusiasts tend to miss real risks. A mixed drafting group produces rules that are both safe and usable, and the managers in the group become early advocates when the policy launches.
Start from how staff use AI today. A short anonymous survey, as described in the guide on training a team to use AI, shows which tools and tasks the policy must address first.
Chapter 03
What sections should an AI acceptable use policy contain?
An AI acceptable use policy should contain a purpose statement, scope, approved tools, restricted data, permitted and prohibited uses, human review requirements, disclosure rules, accountability, security and account requirements, a process for requesting new tools, consequences for violations, and a review schedule. Short sections with concrete examples work better than broad principles.
Checklist
Policy outline checklist
Keep each section to a few sentences plus examples. Staff remember examples such as never paste a customer contract into a personal chatbot account far better than abstract principles about data stewardship.
Write permitted uses as generously as prohibited uses. A policy that lists only restrictions teaches staff that AI is dangerous. A policy that also lists encouraged tasks, such as drafting internal documents, summarizing public research, brainstorming, and cleaning up spreadsheets in approved tools, tells staff where to start and makes the restrictions easier to accept. Review both lists together whenever the approved tool list changes.
Chapter 04
How should the policy handle sensitive data?
The policy should name restricted data types explicitly, such as customer personal information, employee records, financial account details, health information, credentials, source code, and confidential contracts, and state which approved tools, if any, may process each type. Concrete lists and examples prevent the most common and most damaging policy mistakes.
Data classes and AI tools
| Data class | Examples | Public or personal AI accounts | Approved company AI tools |
|---|---|---|---|
| Public | Published marketing copy, public web pages | Allowed | Allowed |
| Internal | Process documents, internal memos | Not allowed | Allowed |
| Confidential | Contracts, pricing, strategy documents | Not allowed | Allowed only in tools the policy names for confidential data |
| Restricted | Personal data, health data, financial accounts, credentials | Not allowed | Allowed only in tools approved for the specific data type, if any |
Tie the AI data classes to any classification scheme the company already uses so staff learn one system, not two. The answer on whether AI is safe for business data covers how business accounts and consumer accounts differ in data handling, and the GDPR and AI answer covers personal data of people in the EU.
Chapter 05
What should the policy say about human review and disclosure?
The policy should require a person to review AI output before the output reaches customers, is published, enters a regulated record, or informs a decision about a person. The policy should also state when AI assistance must be disclosed to clients or recorded internally, and confirm that the person who signs off remains accountable.
Accountability is the anchor. The policy should say plainly that using AI does not transfer responsibility. A person who sends an AI-drafted email, files an AI-assisted report, or approves an AI recommendation owns the result exactly as if the person had written the work alone.
Disclosure rules vary by industry and client. Some client contracts require notice when AI is used on the client's work. Some regulated records need a note of how the content was produced. List the known cases and name a contact for unclear ones. The human in the loop answer describes common review patterns.
Chapter 06
How do you roll out and maintain the policy?
Rolling out the policy works best alongside training: announce the policy, walk through examples in team sessions, publish a one-page summary, and name a contact for questions. Maintain the policy with a scheduled review at least twice a year, and update the approved tool list whenever a new tool is evaluated and approved.
A policy that lives only in the handbook does not change behavior. Launch the policy in short team sessions with real examples from each department, and ask staff to acknowledge the policy as part of onboarding.
The AI market changes quickly. New tools appear, existing tools add features, and providers update data terms. Assign an owner to track changes and keep the approved list current. For technical controls behind the policy, see the guide on keeping AI systems secure and compliant. Lingows AI delivers policies alongside role-based sessions in AI training engagements.
01Summary
Key takeaways
What to remember
- Approve good tools rather than banning AI outright.
- Draft with leadership, IT, legal, HR, and active managers together.
- Name restricted data types explicitly and map each to allowed tools.
- State that the person who signs off owns AI-assisted work.
- Launch the policy with training, and review the policy on a schedule.
02FAQ
Questions about this guide
How long should an AI acceptable use policy be?
An AI acceptable use policy should be short enough for staff to read in one sitting, often two to four pages, with a one-page summary for daily reference. Length should come from concrete examples and named tools rather than abstract principles. A long policy that nobody reads protects no one.
Should the policy ban public AI chatbots?
The policy does not need to ban public AI chatbots entirely, but the policy should prohibit entering internal, confidential, or restricted data into public or personal accounts. Many companies allow public tools for public information and provide approved business accounts for everything else, which removes the main reason staff use personal accounts.
Does an AI acceptable use policy need legal review?
An AI acceptable use policy benefits from legal review, and companies in regulated industries or handling health, financial, or children's data should treat legal review as necessary. Counsel can check the policy against privacy law, employment law, client contracts, and sector rules that general guidance cannot cover.
How is an AI acceptable use policy enforced?
An AI acceptable use policy is enforced through a mix of training, technical controls, and accountability. Training explains the rules, technical controls such as approved company accounts and blocked tools reduce mistakes, and managers handle violations consistently with other policies. Many violations come from confusion, so clarity prevents more problems than penalties.
Is an AI acceptable use policy the same as an AI governance framework?
An AI acceptable use policy is one part of an AI governance framework. The policy tells employees how to use AI tools day to day. A governance framework is broader, covering how the company approves AI projects, assesses risk, monitors AI systems in production, and assigns oversight responsibilities.
Written by
Lingows AI Team
Engineering and strategy team, Lingows AI
The Lingows AI team has built AI systems since 2017 and software since 2012. Collective posts cover model landscape changes, tooling selection, and the direction of applied AI.
Put this guide to work with AI Training.
AI training puts this guide into practice with your own teams, on your own work, with a policy and playbooks they keep.