How to write an AI acceptable use policy

What the policy is for

An AI acceptable use policy tells everyone who works for you which AI tools they may use, what they may put into them, what they may do with the output, and who to ask when unsure. It is the document an employee should be able to read in ten minutes and then act on.

It also does external work. It is the first thing an auditor asks for under any AI governance framework, and it supports specific legal duties: the EU AI Act's Article 4 asks organizations to take measures to support the AI literacy of staff, and Article 5 prohibits certain practices outright, including emotion recognition in the workplace and social scoring. A policy is where those become instructions.

The policy is not the whole programme. It rests on an inventory of your AI systems and a way of assessing them. If those do not exist yet, write the policy anyway, and let its gaps show you what to build.

Before you write: three inputs

An inventory of what is in use. You cannot list approved tools without knowing what people use today. If the policy approves three tools while staff use fifteen, it is out of date on the day it is published. See how to find the AI tools already in use.

Your data classification. Most organizations already sort information into something like public, internal, confidential and restricted. Reuse it. A new AI-specific scheme is one more thing nobody will remember.

An owner. A named person or function that maintains the policy, answers questions and approves new tools. Without one, the policy stops being true within months.

The sections, one by one

1. Purpose and scope

State who is covered: employees, contractors and temporary staff. State what is covered: every AI system used for company business, whether licensed company-wide, bought by a team, embedded in other software or accessed through a personal account. That last clause matters. Much unapproved use happens through personal accounts on consumer tools, and a policy that covers only "company AI systems" misses it.

2. Approved AI systems

List them, in a table: the tool, the vendor, what it is approved for, the highest data classification it may receive, its owner, and any conditions. For example, a company chat assistant approved for data up to confidential under an enterprise agreement, or a hiring tool approved for named users only, with documented human review of every output used in a decision.

This table is the most-read part of the policy. Keep it current, and consider publishing it where people can find it without opening a PDF.

3. How new tools get approved

People will find tools you have not reviewed. Give them a route: who to ask, what information to provide, how long a decision takes. A short form and a quick answer for low-risk tools will do more for compliance than any prohibition. State plainly that a tool is not approved until it appears in the list.

4. Data rules

Use a matrix: classification on one axis, approved and unapproved tools on the other.

Give two or three concrete examples from your own business. "Do not paste customer contract terms into a personal chatbot account" is remembered. "Protect confidential information" is not.

5. Prohibited uses

Keep this list short and absolute. Typical entries: using AI for any practice prohibited by law, such as emotion recognition of employees; making decisions about hiring, promotion, credit or similar matters by AI alone, without human review; entering credentials or secrets into any AI tool; presenting AI-generated content as human-made where disclosure is required; using AI to generate content that is unlawful or infringes others' rights.

6. Requirements by risk tier

Not every system deserves the same treatment. Set out tiers and what each requires. One workable scheme:

• Minimal risk. Registration in the inventory and the standard rules above.
• Limited risk. A risk assessment, human review of generated or predictive outputs, and transparency labelling where outputs reach third parties.
• High risk. A documented risk and impact assessment before use, human oversight, bias monitoring, audit logging and data governance.

Add a review cadence for each tier, with high-risk systems reviewed most often.

7. Human oversight and accountability for output

State the principle that the person who uses an AI output is responsible for it. Generated text is checked before it is sent. Generated code is reviewed like any other code. Where AI supports a decision about a person, a human with authority makes the decision and can explain it.

8. Transparency to others

Say when AI use must be disclosed: to customers interacting with an AI assistant, on synthetic media, and wherever a law requires it. In the EU, Article 50 of the AI Act has applied since 2 August 2026.

9. Monitoring

If you measure AI use, say so here. Describe what is collected and what is not, who can see it, and why. Monitoring that employees learn about from a colleague damages trust; monitoring that is described in the policy is a known rule. See monitoring employee AI use without surveillance.

10. Training, incidents and enforcement

Tell people what training exists and who must take it. Tell them how to report a problem, such as confidential data pasted into the wrong tool, and make clear that prompt reporting is expected and will not be punished in itself. State the consequences of deliberate violations by reference to your existing disciplinary policy; do not invent a parallel one.

11. Ownership and review

Name the policy owner, the effective date and the review interval. Annual review is a reasonable default, with earlier review when a major tool is added or a law changes.

Common mistakes

Banning everything. A blanket ban moves use to personal devices and accounts, where you can neither see nor guide it.

Listing no tools. Principles without a list leave every decision to the individual.

Writing for lawyers. If the people who must follow the policy cannot read it quickly, it will not be followed. Put the approved-tools table and the data matrix first; put definitions in an appendix.

Publishing once. The list of tools changes monthly. A policy without a maintenance process describes the past.

Framework alignment

A policy of this shape supports the governance requirements that the main frameworks share: the Govern function of the NIST AI Risk Management Framework, which asks for AI risk policies, roles and accountability; the AI policy required by ISO/IEC 42001; and Articles 4, 5 and 50 of the EU AI Act.

Generating it from your own records

GhostAudit includes an AI acceptable use policy template with the structure described here. Because it is filled from your inventory, the approved-systems table lists your actual tools with their owners, risk tiers, permitted data levels and conditions; the tier table shows how many systems you have at each level; and open control gaps are named. Anything the records cannot answer, such as the effective date, is marked for you to complete. The draft then goes through review and approval, and is due for review a year later.