AI acceptable-use policy: what to include

Principles of a policy people follow

• Name the approved tools. Abstract rules without a sanctioned option push use to personal accounts.
• Be specific about data. "Don't share sensitive data" is unenforceable. List categories with examples.
• Keep it short. Two to four pages for the core policy; put detail in standards and procedures.
• Say what to do when something goes wrong. Mistakes will happen; reporting should be easy and blameless.

Recommended sections

1. Purpose and scope

Who the policy applies to (employees, contractors, interns), and what it covers: AI assistants, coding tools, AI features in other software, AI agents, and custom AI integrations.

2. Approved tools and accounts

List approved tools and the account type required (for example, "the company workspace, signed in through SSO"). State that personal accounts must not be used for company work, and explain how to request a new tool.

3. Data rules

4. AI agents and automation

Agents that can take actions — send, delete, deploy, pay, change access — require registration and approval before connection to company systems, a named owner, least-privilege credentials, human approval for high-impact actions, and logging.

5. Output review and accountability

People remain responsible for work they submit. Require review of AI output for accuracy, confidentiality, and bias before it is relied on or shared; name higher-stakes uses (legal filings, clinical documentation, financial reporting, public statements) that need expert review.

6. Transparency and disclosure

When AI use must be disclosed — to clients, customers, patients, or regulators — and how. Requirements vary by industry and jurisdiction.

7. Intellectual property

Rules on entering third-party copyrighted or licensed material, and on using AI-generated code or content in products.

8. Prohibited uses

For example: decisions with legal or similarly significant effects about individuals without human review; attempts to bypass tool safeguards; generating deceptive content; monitoring employees in ways not covered by existing policy.

9. Reporting incidents

How to report sensitive data entered into the wrong tool, suspicious AI behavior, or harmful output — with a named channel and a no-blame commitment for prompt reporting.

10. Ownership, exceptions, and review

Who owns the policy, how exceptions are approved and recorded, and when the policy is reviewed (at least annually).

Rolling it out

1. Have legal, security, HR, and a representative business user review the draft.
2. Approve it formally and record the approver and date.
3. Publish it where employees work and announce it with the approved tool in the same message.
4. Collect acknowledgement from all staff, and at onboarding.
5. Add a short training module with concrete examples for your industry.
6. Review usage and exceptions after 90 days and adjust.

To get a first draft quickly, the free AI Policy Generator builds an AI acceptable use policy from your choices in the browser — no account needed. FlashTower's Policy Center includes an editable AI acceptable-use template with a Draft → Reviewed → Approved → Archived workflow. Generated policies and templates are starting points and should be reviewed by counsel before adoption.

Example clauses

Concrete language is easier to follow than principles. Examples of the kind of clause that works (adapt before use):

• "Use only [Approved Tool], signed in with your company account. Do not use personal AI accounts for company work, including on personal devices."
• "Never enter passwords, API keys, access tokens, or other credentials into any AI tool."
• "Patient information may be entered only into tools listed as approved for PHI on the intranet page, and only the minimum necessary for the task."
• "You are responsible for reviewing AI output before relying on it or sharing it. Verify facts, figures, citations, and code."
• "If you think you shared information with an AI tool that you should not have, tell [channel] right away. Prompt reporting will not result in disciplinary action."

Common mistakes

• Banning AI outright while leadership and staff use it anyway — the policy loses credibility.
• Copying a long template that names tools the organization does not use.
• No process to request new tools, so employees route around the policy.
• No owner or review date, so the policy is outdated within a year.
• Not covering AI features inside existing software, where much AI use actually happens.

Measuring whether the policy works

Track acknowledgement rate, the share of AI usage going through approved tools (from OAuth and SSO data), the number of new-tool requests and their turnaround time, and the number of self-reported incidents. A rising self-report count early on is usually a good sign: it means people trust the process.