AI Acceptable Use Policy Template

[Organisation Name] AI Acceptable Use Policy

Version: [1.0] · Effective date: [DD.MM.YYYY] · Policy owner: [Responsible Unit] · Approved by: [Approving Body]

1. Purpose and scope

The purpose of this policy is to ensure that [Organisation Name] employees use AI tools productively, safely and in compliance with applicable law.

The policy applies to all employees, interns, and consultants and suppliers working on behalf of [Organisation Name]. It covers tools provided by the organisation as well as personal accounts and browser extensions used for work.

2. Definitions

• AI tool: any software or service that generates or analyses text, images, audio or code (including chat assistants, assistants embedded in office software, translation and transcription tools and coding assistants).
• Approved tool: a tool assessed by [Responsible Unit], made available for internal use and listed in Section 3.
• Personal data: any information relating to an identified or identifiable natural person.
• Confidential information: [Organisation Name]'s trade secrets, customer and contract information, financial data, source code and any other non-public information.

3. Approved tools

Only the following tools may be used for work. To use a tool not on this list, follow the approval process in Section 8.

Tool	Purpose	Highest data class allowed	Access
[Corporate chat assistant]	Drafting, summarising, analysis	[Internal]	[All employees]
[Coding assistant]	Code suggestions and review	[Internal, excluding source code]	[Software teams]
[Internal assistant / RAG]	Q&A over company documents	[Confidential]	[Authorised units]

4. Data classification: which data, which tool?

Data class	Examples	Approved tools	Unapproved tools / personal accounts
Public	Website content, published reports	Allowed	Allowed
Internal	General procedures, templates, meeting notes (no personal data)	Allowed	Prohibited
Confidential	Customer, contract and financial data, source code	Only tools approved for [Confidential]	Prohibited
Personal data	Names, ID numbers, contact details, employee and customer records	Only in use cases approved by [Responsible Unit]	Prohibited
Special category personal data	Health, biometric data, trade union membership, etc.	Prohibited (exceptions require written approval)	Prohibited

If in doubt, treat the data as belonging to the higher class or consult [Responsible Unit]. Where possible, anonymise data or remove identifiers such as names and numbers.

5. Prohibited uses

The following are prohibited even when the tool is approved:

• Making significant decisions about people, such as hiring, performance or credit, based solely on AI output
• Entering personal or confidential data into unapproved tools or personal accounts
• Creating fake content, impersonation or audio/video forgeries intended to mislead
• Copying copyrighted content without permission, or publishing AI output on behalf of the organisation without checking it
• Using AI to bypass information security controls, gain unauthorised access or create malicious code
• Producing discriminatory, defamatory or otherwise inappropriate content

6. Verifying outputs and accountability

• AI outputs are drafts. The employee using them is responsible for their accuracy and use.
• Figures, names, dates, sources and legal references must be checked against primary sources.
• Content going to customers, the public or senior management is reviewed by a person before release.
• AI-generated code goes through the same review and testing processes as any other code.

7. Transparency

• In AI systems that interact directly with customers (such as chatbots), people are told they are interacting with AI.
• [Labelling rule] applies to external communications substantially generated with AI.

8. Approval of new tools and use cases

Requests to approve a new tool or use case are submitted through [request channel]. The assessment answers at least the following questions:

• What business need does the tool meet, and what data will be entered?
• Where is the data processed and stored, and is it transferred abroad?
• Does the provider use entered data for model training, and can this be switched off?
• Does the use case produce decisions about people, and how will human oversight be ensured?

[Responsible Unit] concludes requests within [time frame] and adds approved tools to the list in Section 3.

9. Training

• All employees complete [awareness and safe use training] before getting access to AI tools.
• Additional role-based training is planned for teams that use AI intensively.
• Employees are informed when the policy changes.

10. Breaches and incident reporting

If personal or confidential data is accidentally entered into an unapproved tool, or an AI output causes harm, the employee reports it immediately via [reporting channel]. Timely reporting is critical to limit any damage.

Breaches of this policy are handled under [Organisation Name]'s disciplinary procedures.

11. Roles and responsibilities

Role	Responsibility
[Policy owner]	Keeping the policy current, approved tools list, exception decisions
Information security	Security assessment of tools, access controls, incident management
Legal / data protection officer	Personal data, contract and regulatory assessment
Managers	Applying the policy in their teams and raising needs
All employees	Following the policy, verifying outputs, reporting incidents

12. Review

This policy is reviewed at least once a year and after any significant regulatory change, new tool or serious incident.

Annex: Employee acknowledgement

I have read, understood and agree to comply with the [Organisation Name] AI Acceptable Use Policy.

Name: ____ · Unit: ___ · Date: ___ · Signature: ______