An AI acceptable use policy for your company, in a few minutes.

Governs how the Company personnel select and use artificial intelligence systems.

1. Purpose

This policy sets the rules for using artificial intelligence (AI) systems at the Company. It enables staff to use approved AI tools productively while protecting customers, employees and the organization from legal, security, privacy and reputational harm. It puts the organization's AI governance program into practice.

2. Scope

This policy applies to all employees, contractors and temporary staff of the Company, and to every AI system used for the Company business, whether licensed enterprise-wide, procured by a team, embedded in other software, or accessed on a personal account.

3. Definitions

• AI system - software that uses machine learning or similar techniques to generate content, predictions, recommendations or decisions from inputs.
• Approved AI system - an AI system listed in Section 5 or subsequently approved through Section 9.
• System owner - the person accountable for an AI system's risk assessment, controls and periodic review.
• Shadow AI - any AI system used for business purposes that is not recorded in the AI inventory.
• Consequential decision - a decision with a material legal or similarly significant effect on a person, such as employment, credit, insurance, housing, education or access to essential services.

4. Roles and responsibilities

5. Approved AI systems

The following systems are approved for use subject to the conditions shown. Use of any AI system not on this list for business purposes is prohibited until approved under Section 9.

6. Data handling rules

• Never enter passwords, API keys, access tokens or other credentials into an AI system.
• Never enter the following into any AI system that is not explicitly approved for it: personal data about customers or their users.
• Never enter the following into any AI system that is not explicitly approved for it: health, biometric and other special-category personal data.
• Never enter the following into any AI system that is not explicitly approved for it: payment card numbers and bank account details.
• Never enter the following into any AI system that is not explicitly approved for it: customer confidential information and anything covered by a non-disclosure agreement.
• Do not upload customer personal data to a system unless it is approved for that classification and the purpose is documented.
• Treat AI outputs as drafts: you remain responsible for accuracy, confidentiality and intellectual-property compliance.

7. Prohibited uses

Personnel must not use any AI system to:

• Deploy subliminal, manipulative or deceptive techniques that distort a person's behaviour, or exploit vulnerabilities due to age, disability or social or economic situation.
• Evaluate or classify people based on social behaviour or personal characteristics (social scoring) leading to unjustified detrimental treatment.
• Infer emotions of employees or students, or categorise people by biometric data to infer sensitive characteristics.
• Build facial-recognition databases through untargeted scraping of images.
• Make a consequential decision about a person without the human review, notice and appeal steps required by Section 8.
• Generate content that impersonates a real person, or publish AI-generated or manipulated media without the disclosure required by Section 10.
• Process restricted data in a system that is not approved for it, or circumvent security controls of an AI system.

The practices in the first four bullets reflect the categories prohibited by EU AI Act Article 5 (prohibited AI practices), applicable since 2 February 2025, and are prohibited here regardless of jurisdiction.

8. Requirements by risk tier

Each AI system is assigned an internal risk tier in the inventory. The tier sets the minimum controls and review cadence. The internal tier is a governance classification; it does not by itself determine the legal classification of a system under any law.

AI systems used to make or materially support consequential decisions about individuals additionally require: a completed impact assessment, a consumer notice before use where required by law, a route to human review or appeal, and an explanation process for adverse outcomes.

9. Requesting a new AI system

1. 01Submit a request to the IT team describing the use case, users, data classification and vendor. A decision is given within 10 working days.
2. 02The system is recorded in the AI inventory and assigned a provisional risk tier and owner.
3. 03Security, privacy and legal review the vendor (Third-party AI vendor assessment) and contract terms.
4. 04High-tier systems complete a risk assessment and impact assessment before approval.
5. 05On approval, the system is added to Section 5 and users are trained before access is granted.

An AI system found in use without approval is either brought through this process within 30 days or its use stops.

10. Transparency and AI-generated content

• Where people interact with an AI system on our behalf (for example a chatbot), they must be told they are interacting with AI unless this is obvious.
• Images, audio or video that are AI-generated or manipulated to resemble real people, places or events must be labelled as such before publication.
• AI-generated text published to inform the public on matters of public interest must be disclosed as AI-generated unless it has undergone human editorial review.
• These rules implement EU AI Act Article 50 (transparency obligations for providers and deployers of certain AI systems), applicable from 2 August 2026. Approved notice wording is maintained in the organization's Article 50 transparency notice.

11. AI literacy and training

All users of approved AI systems complete AI literacy training before first use and annually thereafter, covering this policy, data handling, output verification and incident reporting. Users of high-tier systems complete additional system-specific training delivered by the system owner. This supports the organization's measures under EU AI Act Article 4 (AI literacy).

12. Incident and concern reporting

Report suspected AI incidents (for example data entered into an unapproved tool, harmful or discriminatory output, or an AI system behaving unexpectedly) immediately to [Confirm: AI governance contact mailbox]. Incidents are handled under the AI incident response plan. Concerns may be raised without fear of retaliation.

13. Exceptions

Exceptions require written approval from the AI governance lead, must be time-limited (maximum 90 days) and are recorded by the AI governance lead.

14. Compliance and enforcement

the Company does not monitor individual use of AI tools. Compliance with this policy is checked through the AI inventory, access records of approved tools and periodic review. Violations may result in removal of access and disciplinary action consistent with HR policies.

15. Review

This policy is reviewed at least annually and whenever a material regulatory or technology change occurs. Next scheduled review: 13 November 2027.

16. Regulatory and framework basis

• EU AI Act Article 4 (AI literacy); EU AI Act Article 5 (prohibited AI practices); EU AI Act Article 50 (transparency obligations for providers and deployers of certain AI systems) - EU AI Act (Regulation (EU) 2024/1689), as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744).
• NIST AI Risk Management Framework 1.0 (NIST AI 100-1) - GOVERN 1 (policies and AI system inventory) and GOVERN 2 (accountability and training).
• ISO/IEC 42001:2023 (AI management systems) - Annex A.2 (Policies related to AI) and A.9 (Use of AI systems).

Regulatory references reflect GhostAudit's regulatory library as of 10 November 2026. Where an obligation's applicability depends on facts not recorded in the inventory, it is flagged for confirmation.

Approval

This document was generated with the GhostAudit AI policy generator on 13 November 2026 from the answers given. It is a template, not legal advice: review it with counsel before adoption.