By the Shadow AI Policy team
Most AI policies fail not because they're too short, but because the language is too vague to enforce — "employees should use AI responsibly" means nothing when a contractor uploads a client contract to an unapproved tool.
This post gives you paste-ready policy language for the five scenarios that come up in almost every workplace AI policy: approved tool lists, data classification, incident reporting, employee acknowledgment, and vendor requirements. Each sample clause is written to be specific enough to act on, but plain enough that employees will actually understand it.
Vague policy language creates enforcement gaps, not flexibility. The moment you need to discipline an employee or notify a client about a data exposure, you'll wish your policy said exactly what was and wasn't allowed — not what employees were "encouraged" to do. Write it like it will be read by a judge, not a motivational poster.
The language below is written for companies with 50–500 employees. It assumes you have a basic HR infrastructure — an employee handbook, an onboarding acknowledgment process, and at least one person responsible for IT or compliance decisions. You don't need a dedicated legal team to use these clauses, but you should have any final policy reviewed by your employment counsel before publishing, particularly if you operate in California, the EU, or a regulated industry like healthcare or financial services.
Each clause is formatted as a ready-to-use block. Adapt the specifics — tool names, data categories, reporting timelines — to your actual environment. If you want a full policy structure rather than individual clauses, see our guide to the AI acceptable use policy template.
An approved tool list clause needs to do three things: define what "approved" means, establish a process for requesting new tools, and make clear that unapproved tools are prohibited — not just discouraged. The most common mistake is listing approved tools without saying anything about everything else. Employees will assume the list is illustrative, not exhaustive.
Sample clause — Approved AI Tools
"The company maintains an Approved AI Tool List, updated quarterly and accessible on the company intranet. Employees may only use AI tools on the Approved List for work-related tasks. Use of any AI tool not on the Approved List for work purposes — including personal accounts of approved tools, free-tier versions of approved tools, or any tool accessed through a web browser or mobile app — is prohibited without prior written approval from [IT/Operations Lead title].
To request approval for a new tool, submit a Tool Review Request using the form on the intranet. Requests will be reviewed within 10 business days. Do not use a tool while a review is pending.
The current Approved List includes, but is not limited to: [list tools here — e.g., Microsoft 365 Copilot, ChatGPT Enterprise, Grammarly Business]. Tools are approved for specific data types as defined in Section [X] of this policy. Approval for one data type does not grant approval for all data types."
Note the last sentence. A tool like Microsoft 365 Copilot may be approved for internal drafting but not for entering patient records or client financial data. Your approved list should be a matrix, not just a list of names. The visual below shows what a tiered approval structure looks like in practice.
| AI Tool | Internal / Non-Sensitive Data | Confidential Business Data | Regulated Data (PHI / PII / Financial) |
|---|---|---|---|
| Microsoft 365 Copilot | ✅ Approved | ✅ Approved | ⚠️ BAA required — verify before use |
| ChatGPT Enterprise | ✅ Approved | ✅ Approved | ❌ Not approved without signed BAA |
| ChatGPT (free / Plus) | ⚠️ Non-sensitive only | ❌ Not approved | ❌ Not approved |
| Grammarly Business | ✅ Approved | ✅ Approved | ❌ Not approved |
| DeepSeek (any tier) | ❌ Not approved | ❌ Not approved | ❌ Not approved |
For more on why tools like DeepSeek require extra scrutiny, see their tool risk profile. For regulated-data contexts specifically, our HIPAA-compliant AI tools comparison covers BAA status across major platforms.
Your policy can't restrict what data goes into AI tools if employees don't know how to classify their data. Most SMB policies skip a classification framework entirely, which means every employee is making their own judgment call about what's "sensitive." That's not a policy — it's a guessing game.
Use three tiers. Don't invent more categories than you need:
Add this sentence to your data classification section: "When in doubt, treat data as Tier 3 until confirmed otherwise by your manager or the compliance lead." Default-up, not default-down.
An AI incident for policy purposes is any situation where an employee suspects that regulated, confidential, or client data was entered into an unapproved tool, or that an approved tool behaved in an unexpected way that may have exposed data. Your policy needs a clause that tells employees exactly what to do and how fast.
Most breach notification laws — including HIPAA's Breach Notification Rule (45 CFR §§ 164.400–414) and GDPR Article 33 — require you to notify regulators within 60–72 hours of discovering a breach, not of confirming one. If your employees sit on an incident for three days before reporting it internally, you may already be out of compliance before your legal team knows anything happened.
Here's sample incident reporting language that builds in the urgency regulators expect:
Sample clause — AI Incident Reporting
"If you believe you have entered Tier 2 or Tier 3 data into an unapproved AI tool, or that an approved AI tool has transmitted, exposed, or incorrectly processed protected data, you must report the incident to [HR/IT/Compliance contact title] within two (2) business hours of discovery. Do not wait until you are certain a breach occurred — report the suspicion and let the compliance team assess it.
To report, send an email to [designated reporting email] with the subject line 'AI Incident Report' and include: (1) the tool used, (2) the type of data involved, (3) the approximate date and time, and (4) what you did after discovering the issue. Do not delete messages, logs, or browser history related to the incident."
Two-business-hours is intentionally tight. It gives your legal and IT team time to assess before any external notification clock runs out.
An acknowledgment clause serves two purposes: it creates a record that the employee received and understood the policy, and it establishes that non-compliance is a disciplinary matter, not an oversight. Without a signed acknowledgment, enforcement conversations get complicated.
Keep the acknowledgment short. Employees who see a page-long acknowledgment form often skim and sign. Employees who see three sentences read them.
Sample clause — Employee Acknowledgment
"I confirm that I have read and understand the company's AI Acceptable Use Policy, effective [date]. I understand that using AI tools in ways not permitted by this policy — including using unapproved tools, entering restricted data into AI systems, or failing to report an AI-related incident — may result in disciplinary action up to and including termination of employment. I agree to complete any required AI policy training assigned to my role within 30 days of this acknowledgment and annually thereafter."
Collect this signature digitally through your HRIS or onboarding platform so you have a timestamped record. For existing employees, roll the acknowledgment out as part of your next all-staff policy cycle — don't wait for annual review season if the policy is new.
Contractors and vendors are one of the most common gaps in AI policies written for employee workforces. If a contractor is doing work that involves your client data, your internal systems, or your regulated information — and they're using their own AI tools to do it — your exposure is the same as if an employee did it. Your client contracts and data processing agreements don't care whose laptop the data was on.
For any vendor or contractor with access to Tier 2 or Tier 3 data, your policy should require:
Sample contract language — Vendor AI Use:
"Vendor shall not use any AI-assisted tool to process, summarize, generate, or analyze Client Data without prior written approval from Client's [IT/Operations/Legal] lead. Vendor shall maintain an accurate list of all AI tools used in connection with this engagement and provide it to Client upon request. Any change to the list of approved AI tools requires 5 business days' written notice and Client's written approval before use."
For background on why unmanaged AI tool use by third parties is a growing risk category, see our overview of what shadow AI is and why it matters. If you want all of these clauses assembled into a complete policy document, you can generate a tailored policy kit built around your industry and data types.
About Shadow AI Policy: We build AI acceptable use policy tools for HR and operations teams at 50–500 person companies. We publish guides on shadow AI, acceptable use policies, and AI governance, updated as regulations and AI tools change.
You can, and for many smaller organizations it's the right call — one fewer document for employees to track. The risk is that IT AUPs are usually written around device and network use, not data classification by tool tier or AI-specific incident reporting. If you go the addition route, make sure you add explicit sections on approved tool lists, data classification, and incident timelines. Don't just append "employees should use AI responsibly" to the end of an existing document — that adds no enforceable content.
For most companies, yes — at minimum have employment counsel do a quick review before you publish. This is especially true if you operate in California (CCPA obligations), the EU (GDPR and EU AI Act requirements), or a regulated industry like healthcare or financial services. The sample clauses in this post are starting points written in plain language, not legal advice. A one-hour attorney review is worth it to catch jurisdiction-specific gaps.
Only if it's in the contract. A policy document alone doesn't bind a third party — the AI use requirements need to appear in the vendor agreement, statement of work, or a separate data processing addendum that the contractor has signed. If you're working with contractors who predate your AI policy, you'll need to issue contract amendments or addenda to bring them under the new requirements. For contractors with access to regulated data, prioritize those amendments first.
Quarterly is a reasonable minimum, but realistically you'll need to update it whenever a major tool changes its data handling terms, a new tool gets widely adopted by your team, or a regulatory development changes what's permissible. Assign one person — not a committee — ownership of the list. Committees slow down approvals, and a slow approval process is exactly what pushes employees toward unapproved tools. Set a standing 30-minute quarterly review and keep the list on a shared intranet page with a visible "last updated" date.
Free tool: Check your policy for missing sections → Paste your AI policy and see which of the 9 essential sections it covers.
Tailored to your industry and the AI tools your team uses. Free preview, then $149/mo to keep it current as the rules and vendor terms change — or $79 for a one-time snapshot.
Generate my policy kit →Writing policies for several clients? MSPs, IT consultancies and fractional CISOs keep a roster of client kits that refresh monthly, under their own branding. See partner plans →