If your organisation has one AI document, it should be an AI acceptable use policy. It tells people which AI tools they can use, what they can put into them, and what’s off limits. It’s the fastest way to reduce AI risk, and it supports the AI literacy duty under the EU AI Act.
The best AI policies are short. If people won’t read it, it won’t change anything.
Why you need one now
- Your staff are already using AI, often with personal accounts you can’t see. That’s shadow AI.
- Data leaks through AI are real. Pasting client data, code or credentials into a public chatbot can send it outside your control. See AI chatbot data leakage.
- Customers and auditors ask whether you have one.
What to include
1. Purpose and scope
One paragraph: why the policy exists and who it covers, meaning employees, contractors and anyone working on your behalf, and which tools, meaning any AI system including AI features inside other software.
2. Approved tools
List the AI tools people may use for work, ideally business or enterprise versions with data protection terms. Make it easy to request a new tool.
3. Data rules
This is the most important section. Be concrete:
- Never enter: personal data about customers or staff, client confidential information, passwords, API keys and other credentials, unreleased financial results, or source code (unless the tool is approved for code).
- Allowed: public information, and your own drafts with sensitive details removed.
- When in doubt, remove names and identifiers, or ask.
4. Acceptable and unacceptable uses
Examples help more than principles:
- OK: drafting emails, summarising public documents, brainstorming, editing your own writing, coding help in approved tools.
- Not OK: making final decisions about people, such as hiring, firing or credit, based on AI output alone; generating content that impersonates real people; uploading other people’s work without the right to do so; anything illegal or discriminatory.
5. Checking the output
AI can be confidently wrong. Users are responsible for checking facts, figures, code and citations before using output, and AI output must not be presented as reviewed expert advice unless a qualified person has reviewed it.
6. Transparency
When must people say AI was used? For example in customer-facing content, client deliverables or anything published. Align this with the EU AI Act transparency rules if you’re in scope.
7. New AI tools and projects
Anyone who wants to buy, build or switch on an AI tool must get approval first, so it’s assessed and added to the AI inventory.
8. Reporting problems
How to report a mistake, such as sensitive data pasted into the wrong tool, or harmful output, and a promise of no blame for honest reports. Fast reporting limits the damage.
9. Ownership and review
Who owns the policy, and how often it’s reviewed. Every six to twelve months is realistic, given how fast tools change.
A simple outline you can adapt
- Purpose and scope
- Approved AI tools (and how to request new ones)
- Data you must never enter
- Acceptable and unacceptable uses
- You’re responsible for checking AI output
- When to disclose AI use
- Approval for new AI tools and projects
- How to report a problem
- Policy owner and review date
Making it stick
- Keep it to one or two pages, and link to detail rather than including it.
- Include it in onboarding and in your AI literacy training.
- Give people an approved tool. Bans without alternatives push usage underground.
- Review it when you adopt new tools, not just on the calendar date.
Official sources
- EU AI Act, Regulation (EU) 2024/1689: the official text on EUR-Lex
- NIST AI Risk Management Framework: the framework and its supporting documents
More primary sources, with a short note on each, are on our Sources page.
Last reviewed October 2026. This article is general information, not legal advice. Adapt any policy to your organisation and local law.