An AI acceptable-use policy tells everyone in the company what AI they may use, with what data, for what purposes, and what checks apply. Legal usually drafts it with security, IT, HR and the AI lead.
What a good policy covers
- Approved tools and how to request new ones.
- Data rules: a simple matrix of data classes and tools.
- Prohibited uses: for example, uploading confidential data to unapproved tools, automated decisions about people without review, impersonation, or AI-generated content presented as human where disclosure is required.
- Human review: who must check AI output before it is relied on or published.
- Transparency: when to tell customers, colleagues or counterparties that AI was used.
- IP and confidentiality: inputs you have rights to; outputs treated as company information.
- Incidents: how to report a problem.
- Accountability: consequences for breaches.
Policies fail without the rest
A policy is only as good as the system around it:
- Approved tools that are good enough that people use them.
- Training with real examples.
- Technical controls (blocking, data loss prevention, logging) where risk is high.
- Monitoring and spot checks.
- Updates at least twice a year.
Keep it short
Two pages people read beat twenty pages nobody reads. Put detail in short guides by role (legal, HR, marketing, engineering).