An AI acceptable use policy is a short written document that tells your employees which AI tools they may use, what data they may put into those tools, and who is accountable for the output. Below is a free, editable template you can copy and paste in full, download as Word or PDF, and adapt to your company — plus a section-by-section guide to what each part should say. Written for HR managers and operations leads who need to act fast without a 50-page legal document.
Jump to the full copy-and-paste template ↓
A year ago, an AI policy was something large enterprises put in their roadmaps for next quarter. Today it's something employees are asking for by name — and something auditors, insurers, and enterprise customers are starting to require before signing contracts.
The good news: you don't need a legal team or a six-month project to have one. You need clarity on seven things. This guide walks through each one.
A good AI acceptable use policy is short, specific, and enforceable. At a minimum it should cover eight things:
The template below contains all eight, written in plain language with fill-in-the-blank fields you can edit. Read on, or copy the whole thing.
This is a complete, generic AI acceptable use policy you can use as a starting point. Replace every [bracketed] field with your own details, delete what doesn't apply, and have it reviewed before adoption.
This policy explains how workers at [Company Name] may use artificial intelligence (AI) tools in the course of their work. Its goals are to let people use AI productively while protecting [Company Name]'s data, customers, employees, and legal obligations.
This policy applies to [all employees, contractors, interns, and temporary workers] who use [Company Name] devices, accounts, systems, or data. It covers all AI tools — generative AI assistants, AI writing and coding tools, AI meeting note-takers, and AI features built into other software — whether accessed through a company account or a personal account, when used for work purposes.
[Choose one: This policy applies to AI use on personal devices during work hours / only to company-owned devices and company accounts.]
[Company Name] classifies AI tools into three tiers. The current tier list is maintained at [link or location] and reviewed every [period]. Before using any AI tool that is not on the list, request approval from [role].
Connectors and app access. Approval covers a tool, not everything that tool can reach. Connecting an AI tool to company email, files, calendars, chat, code repositories, or any other system — through a connector, plug-in, extension, or “sign in with” authorization — requires separate approval from [role], because it gives that tool standing access to data nobody pasted into it. The personal or free tier of any tool must never be connected to a company account or company data, and Tier 2 and Tier 3 tools must not be connected at all.
Review the connections you have already granted at [link or location] every [period], and remove any you no longer use.
Do not enter the following into any AI tool unless that specific tool is approved for that data type:
Rule of thumb: if you would not post it publicly, do not put it into a non-approved AI tool. When in doubt, ask [role] before sharing.
Links and content you point a tool at. Data can leave an AI tool without anyone typing it in. A link, document, web page, or message that an AI tool opens on your behalf can contain instructions the tool follows as though you had given them — including instructions to gather whatever the tool can reach and send it somewhere else. Do not open AI-assistant links that arrive from outside [Company Name], and do not point a connected tool at content you do not trust. If a tool does something you did not ask it to do, stop using it and report it under Section 11.
The person who uses an AI tool is responsible for its output. All AI-generated work — emails, documents, code, and analysis — must be reviewed and verified by a qualified person before it is sent, published, or relied upon. AI must not make final decisions on [hiring, promotion, discipline, lending, or other high-stakes matters]. A person makes those decisions, and the review standing behind them has to be real.
What counts as review. A signature is not review. Where an AI tool has scored, ranked, or screened a person, and someone is affected by the result, whoever reviews that result must:
Where it is practical to do so, hold off acting on the decision until that review is finished. For discipline and termination of anyone working in California it stops being optional from 1 July 2027:
California — discipline and termination (Labor Code §§ 1520–1526.7, from 1 July 2027). These apply to any employee of [Company Name] working in California, at any company size:
Before any AI-generated or AI-modified content is published externally — website copy, marketing material, social posts, customer-facing documentation, or generated images, audio, and video — a named human reviewer must check it and record their sign-off. Keep a record of who reviewed what and when: [reviewer role / where sign-off is logged]. That record is the evidence of editorial control if a disclosure obligation is ever questioned (see Section 8).
Disclose AI use where required, for example: [AI-generated content shared externally with clients or the public; AI-assisted analysis in executive or board materials; AI used in any regulated process; AI-generated code deployed to production]. Follow any client or contractual disclosure requirements that apply to your work.
EU AI Act — Article 50 transparency. If [Company Name] has operations, staff, or customers in the EU, these duties have applied since 2 August 2026 and fall on employers as deployers of AI, not only on AI vendors:
Scope note: what applies now is the Article 50 transparency set above, plus the Commission's enforcement powers over general-purpose AI model providers — a vendor obligation, not the employer's. The AI Act's high-risk deployer obligations (risk management, impact assessments, logging, conformity paperwork) were deferred by the Digital Omnibus and do not apply until 2 December 2027 for standalone Annex III systems and 2 August 2028 for AI embedded in regulated products. Do not adopt high-risk controls on the assumption that they are already required; do plan for them if [Company Name] uses AI in hiring, credit, education, or essential services.
United States — synthetic performers in advertising. These rules apply whether or not [Company Name] has any EU exposure, and they are not the deepfake rules above. A deepfake rule covers AI-made content depicting a real person. These cover the opposite: a convincing performer who does not exist. Both states define a synthetic performer as one “not recognizable as any identifiable natural person”.
[Optional] Signing the EU Code of Practice on Transparency of AI-generated Content — voluntary, with roughly 190 signatories as of end-July 2026, deployers as well as model providers — is one way to evidence good-faith compliance. It is not required.
Encouraged uses, with non-confidential data and human review, include: drafting and editing, brainstorming, summarizing public material, writing and debugging code, research starting points, and learning.
Do not use AI tools to: enter prohibited data (Section 6); generate content that is unlawful, harassing, discriminatory, or infringing; present AI output as independently verified when it is not; attempt to bypass security or access controls; or make prohibited automated decisions (Section 7).
EU AI Act — prohibited generation. From 2 December 2026, if [Company Name] has operations, staff, or customers in the EU, it is prohibited to use any AI system for the purpose of generating intimate imagery of an identifiable real person without that person’s explicit consent, or child sexual abuse material. This is a prohibition on use and it falls on the employer as deployer, not only on the AI vendor. It applies whatever tool is used, including a personal account on a tool [Company Name] has not approved, and any such use is grounds for immediate action under Section 12.
Emotion recognition of staff. Do not use, or switch on, any AI feature that recognizes, infers, or predicts an employee’s emotional state — for example mood, sentiment, or stress scoring of agents in call-center, sales-coaching, or meeting tools — or that collects neural data. If [Company Name] has staff in the EU, this has been prohibited in the workplace since 2 February 2025 (AI Act Article 5(1)(f), except for medical or safety reasons). For staff in California it is prohibited from 1 January 2027 (Labor Code § 1581, except to ensure safety; up to $500 per violation). Check vendor settings: these features can be on by default. [Name the role who confirms they are off in every tool we license.]
If you accidentally share confidential data with an AI tool, act on harmful or incorrect AI output, or notice a possible policy violation, report it to [role / contact] promptly. Reporting is non-punitive; reporting early limits harm.
Violations may result in [graduated consequences: a coaching conversation, a formal warning, up to termination] depending on severity and intent, consistent with [Company Name]'s [disciplinary / HR] policies.
This policy is reviewed at least every [six months] and is updated when major AI tools change their data practices, when a new tool category becomes widely used, or when relevant regulations change. Policy owner: [name / role].
By signing below, I confirm that I have read and understood [Company Name]'s AI Acceptable Use Policy and agree to follow it.
Employee name: ____________________________
Signature: ____________________________
Date: ____________________________
This guide is written for HR managers, operations directors, and compliance leads at companies between 50 and 500 employees. You probably don't have a dedicated AI governance team. You may not have a CISO. What you do have is employees who are using ChatGPT, Copilot, Claude, and a dozen other tools to do their jobs — and no documented rules about how.
Enterprise guides for this topic are written for IT departments with six-figure tooling budgets. This one isn't. The goal is a policy you can actually draft, communicate, and enforce with the team you have.
These are the same obligations as the eight-point checklist above, grouped into the seven sections a finished document is actually written in — the checklist is what the policy must cover, this is how it is laid out on the page.
This section answers: why does this policy exist, and who does it apply to? Be specific about scope — does it cover contractors and vendors, or only direct employees? Does it apply to personal AI use on company devices, or only AI used for work tasks?
This is the heart of the policy. Employees need to know which tools they can use without asking, which require approval or have specific restrictions, and which are off-limits entirely. The three-tier structure works better than a binary approved/banned list because it prevents the policy from being so restrictive that people ignore it.
A basic tier structure looks like this:
| Tier | What it means | Example tools |
|---|---|---|
| Tier 1 — Approved | Use freely for work tasks with standard data handling | ChatGPT Enterprise, Microsoft Copilot (enterprise), Claude Teams |
| Tier 2 — Limited | Approved with specific restrictions on data types | ChatGPT Free, Gemini (personal), Perplexity |
| Tier 3 — Prohibited | Not approved for any work use | Unknown/unvetted AI tools, tools with no data processing agreements |
This is the section that prevents the actual expensive mistakes. Employees need to know which categories of information should never be entered into an AI tool, and why. The rule of thumb that works well in plain language: if you wouldn't post it publicly on the internet, don't put it in a free AI tool.
Categories to address:
If you operate in Canada, the data-handling section carries an extra obligation that has nothing to do with AI law — Canada has no AI statute in force. Under PIPEDA you stay responsible for personal information handed to a third party for processing and must use contractual or other means to give it comparable protection, which is an argument for an approved-tool list rather than a general warning. If you have any Quebec footprint, Law 25 goes further: a privacy impact assessment is required before personal information is communicated outside Quebec, and it has to conclude the data will be adequately protected. Ontario employers with 25 or more staff also have to disclose AI screening in publicly advertised job postings. Full detail in our guide to AI policy for Canadian employers.
AI output is the responsibility of the person who used it. This section makes that explicit. Every AI-generated output — whether it's a contract summary, a customer email, a performance review, or a code commit — must be reviewed by a qualified human before it's used or sent.
For higher-stakes decisions, go further: AI should not make final decisions on hiring, promotions, disciplinary action, or lending/credit at all — a person makes those. Say what the review behind them involves, because "a manager signed off" is the part that fails under scrutiny: the reviewer should be someone other than whoever made the original call, should look at the underlying evidence rather than just the score, and should have real authority to overturn it. Colorado will require close to this of employers from 1 January 2027, and other states are moving the same way.
When does your company require disclosure that AI was used? This varies by use case and industry. A marketing team using AI to draft a first-pass blog post may have different disclosure requirements than a legal team using AI to summarize a contract.
Common disclosure requirements to consider:
Employees need a simple, non-punitive way to report when something goes wrong — when they realize they pasted customer data into the wrong tool, when they notice a colleague doing something the policy doesn't allow, or when an AI output caused a problem with a client or partner.
The goal is to surface issues early before they become expensive. A culture where mistakes get reported quickly is worth far more than the threat of discipline that ensures mistakes get hidden.
A policy with no enforcement mechanism is a suggestion. Outline consequences for policy violations — typically a graduated scale from coaching conversation to formal warning to termination for serious or repeat violations.
More importantly: commit to a review schedule. AI tools, regulations, and best practices are moving fast in 2026. A policy that made sense when you wrote it in Q1 may need meaningful updates by Q3. Quarterly or biannual review is appropriate for most companies.
If you're drafting an AI acceptable use policy from scratch, work through it in this order. It mirrors the seven sections above and keeps the drafting process from stalling on the hard calls:
Drafting from the template above collapses this from a multi-week project into an afternoon. If you'd rather not draft it by hand at all, the AI policy generator produces a completed draft — tool tier list included — in about ten minutes.
The bracketed template above is the skeleton. Here is a short AI policy example with the blanks filled in, so you can see the level of specificity that makes a policy enforceable rather than aspirational:
Do not enter client names, engagement details, financial figures, or any document marked "Confidential" into any AI tool that is not on the Tier 1 approved list. When in doubt, ask the Head of Operations before pasting.
In practice, no. "AI tool usage policy," "AI use policy," "generative AI policy," and "AI acceptable use policy" all describe the same document: the written rules for which AI tools employees may use and how. The template on this page works under any of those titles — pick whichever name your team recognizes and change the heading to match.
The worst AI policies are either so restrictive that everyone ignores them, or so vague that they provide no real guidance. Both failures are expensive.
A blanket "no AI tools" policy is effectively unenforceable at most companies. Research consistently shows that employees continue using personal AI accounts even after organizational bans — they just become less likely to tell anyone when something goes wrong. Driving shadow AI further underground is worse than the alternatives.
"Only 15% of organizations have updated their acceptable use policies to address AI tools — despite the behavior being near-universal." — ISACA, 2025
A good policy doesn't try to ban innovation. It creates a clear structure that lets employees use AI productively while protecting the company from the specific risks that actually matter: data leakage, compliance violations, and unreviewed AI output making its way to clients or regulators.
Most free AI policy templates are static documents — a Word file with a date at the top. They're missing two things that are essential for the policy to actually work:
A tool tier list. Telling employees what categories of data they can share with AI tools is half the job. Telling them specifically which tools fall into which tier — so they can look up whether the tool they just found is approved before using it — is the other half. Without a tier list, the data handling rules have no anchor.
An employee acknowledgment form. Distributing a policy document by email and assuming people read it is not the same as having employees formally acknowledge it. An acknowledgment form creates a documented record that the policy was communicated and understood — relevant if an enforcement conversation happens later, and increasingly relevant as cyber liability insurers and enterprise customers ask for evidence of AI governance programs.
Written from scratch by HR or legal, drafting an AI acceptable use policy typically takes two to four weeks — including stakeholder review cycles, legal sign-off, and rollout communication. That timeline is compressible if you start from a well-structured template rather than a blank page.
The rollout matters as much as the document itself. A policy communicated well — with a team walkthrough, a Q&A session, and a designated point of contact for questions — produces materially better employee behavior than the same policy distributed as a PDF attachment to an all-hands email.
Shadow AI Policy generates a tailored 4-document kit for your company — the policy plus a tier list that sorts 26 named AI tools for your industry and data, a 12-question manager FAQ, and an e-signature-ready acknowledgment form. Add monthly updates and it stays current as tools and regulations change.
Generate my policy kit →Writing this for several clients rather than one company? MSPs, IT consultancies and fractional CISOs keep a roster of client kits that refresh monthly, under their own branding — see partner plans →
AI regulation is moving fast in 2026. Texas and Illinois both enacted AI-related employer regulations that took effect in January. Colorado repealed and replaced its original AI Act (SB 24-205) with SB 26-189, signed 14 May 2026, which drops the risk-management and impact-assessment duties but requires pre-use notice and an adverse-action explanation from 1 January 2027 — see our AI policy news hub for the current status. California's CCPA rules around automated decision-making require employer compliance by January 2027. In the EU, the AI Act's Article 50 transparency duties became enforceable on 2 August 2026 and apply to employers as deployers; its high-risk obligations were deferred by the finalised Digital Omnibus to 2 December 2027 and 2 August 2028.
None of these require a 50-page enterprise compliance program for a 100-person company. But they do mean that an AI policy written in early 2026 will likely need at least one meaningful update before the end of the year. Build the review cycle into the policy from day one so it actually happens.
All employees who use company devices, systems, or data — which is effectively all employees in most organizations — should sign an AI policy acknowledgment form. This includes contractors and freelancers with access to company data. The acknowledgment creates a documented record that each person has read and understood the policy, which is essential for enforcement and increasingly required by cyber liability insurers.
AI tools and their data practices change rapidly. A policy should be reviewed at minimum every six months and updated whenever a major AI tool changes its data retention or training policies, when a new tool category becomes widely used by employees, or when relevant regulations change for your industry. The tool tier list in particular becomes outdated quickly and needs the most frequent attention.
An effective AI acceptable use policy for a 50–500 person company does not need to be long. A policy that employees will actually read and follow is typically 2–4 pages covering the core sections clearly. Overly long policies lead to non-compliance because employees don't read them. Pair a concise policy document with a separate tool tier list that employees can reference quickly.
Free templates from organizations like AIHR, SHRM, and Deel are useful starting points but are typically generic — they lack a tool tier list specific to your industry, industry-specific data handling rules, and acknowledgment forms. A custom policy based on your actual tools, company size, and industry is significantly more enforceable and takes about 10 minutes to generate with the right tool.
An AI acceptable use policy should cover eight things at minimum: purpose and scope (who it applies to, including contractors and personal devices); tool classification into approved, limited and prohibited tiers; data handling rules stating what may never be entered into a non-approved AI tool; human oversight, requiring a person to review AI output before it is used or sent; disclosure, covering when AI use must be declared internally or to clients; incident reporting, so mistakes surface quickly; enforcement and review, with a named policy owner and a review schedule; and an employee acknowledgment signature. The tool tier list and the acknowledgment form are the two components most free templates omit.
Work in this order: inventory the AI tools your team already uses, classify each one as approved, limited or prohibited, write the data handling rules that say what may never be pasted into a non-approved tool, then add oversight, disclosure, incident reporting and enforcement around them. Drafting from a blank page is the slow part, and the tool tier list is the section that dates fastest. You can copy the full template on this page and edit it, or generate a version that classifies your actual tools for your industry and company size in about 10 minutes — free preview, no account.
In practice, yes. "AI tool usage policy," "AI use policy," "generative AI policy," and "AI acceptable use policy" all describe the same document: the written rules for which AI tools employees may use and how. The template on this page works under any of those titles — pick whichever name your team recognizes and change the heading to match.