The short answer
An AI acceptable use policy should fit on a few pages and answer five questions: which tools are approved, what data may and may not go in, who reviews output, what agents and connectors may do, and what to do when something goes wrong. Write it in plain language, train on it with scenarios, and have legal and security approve it.
Why do you need an AI acceptable use policy?
People are already using AI at work, whether you approved it or not. A policy turns that from an invisible risk into a managed practice. It also gives employees permission to use approved tools confidently, which is half the point.
A good policy does two jobs: it protects the organization, and it lets people move faster because they know where the lines are. Policies that only say "no" push use underground.
What are the sections of a good policy?
Keep it short and specific. A workable outline:
- Purpose and scope. Who and what it covers, including contractors.
- Approved tools and accounts. Name them. Prohibit personal accounts for work material.
- Data rules. Categories that may never be entered, categories that are fine, and a rule for anything unclear.
- Review and accountability. The person who sends or files output owns it. Define what needs a named reviewer.
- Agents and automation. Permission modes, scheduled tasks, owners, and approval before external sends.
- Connectors, plugins, and integrations. An approved list, with owners and least-privilege access.
- Code and development. Review of agent-authored changes, secret handling, and dependency rules.
- Disclosure. When to tell customers, partners, or regulators that AI was used.
- Incident reporting. What to do if something goes wrong and who to tell.
- Training and review. Required training, and a date to revisit the policy.
What data rules should it state?
State them as concrete categories, not principles. People cannot apply "be careful with sensitive data." They can apply a list.
- Never enter: whatever your regulators, contracts, or customers prohibit. Examples include regulated technical data, credentials, and personal data you are not permitted to share.
- Allowed with the approved account: internal drafts, public information, and de-identified material.
- Ask first: anything in between, with a named person to ask.
Your legal and security teams must set these. A template cannot know your obligations. Our acceptable use policy template is a starting point, not legal advice.
How should the policy handle AI agents?
Agents need their own section because they act. Cover which permission modes are acceptable for which work, which folders, apps, and accounts are in bounds, who owns each scheduled automation, and when a human must approve before anything leaves the organization.
Both Anthropic and OpenAI describe permission controls for their agents. Claude Cowork documents permission modes, and OpenAI’s documentation covers sandboxing and agent approvals for Codex. See our guides on Cowork security and permissions and Codex team safety.
How do you make people actually follow it?
Train on it with scenarios. Give participants five realistic situations and ask what they would do: pasting a customer contract, connecting a shared drive, scheduling a weekly report that emails a client, accepting a code change they did not write.
Then keep it alive. Name an owner, publish an FAQ, review the policy on a schedule, and update it when the tools change. Our governance kit includes supporting materials, and the Team Kickstart program helps organizations set this up with leadership alignment.
What should an AI policy template include?
A short policy people can follow beats a long one they cannot. A workable template has nine parts:
- Purpose and scope. Who and what it covers.
- Approved tools. A named list, and how to request additions.
- Data rules. What may never be entered, what needs approval, and what is fine.
- Human review. Which outputs need a named reviewer before use.
- Disclosure. When to tell customers or colleagues AI was used.
- Intellectual property and confidentiality. Reminders tied to your contracts.
- Prohibited uses. A short, specific list.
- Reporting. How to report a mistake or incident without blame.
- Ownership and review. Who maintains it and when it is revisited.
We publish a free AI acceptable use policy template you can adapt. It is a starting point, not legal advice; have your counsel review it against your contracts, industry rules, and jurisdiction.
How do you roll out an AI policy so people follow it?
A policy changes behavior only when it is taught and made easy. Introduce it in a short session with real examples, list approved tools in one place, give people a named person to ask, and review it after the first 60 to 90 days based on what actually happened. Pair it with role-based training so the rules show up inside daily tasks.
Frequently asked questions
How long should an AI acceptable use policy be?
Short enough that people read it. Two to four pages with a one-page summary is common. Put details in appendices.
Do we need a separate policy for AI agents?
A dedicated section within your AI policy is usually enough. Agents add concerns, such as permissions and automation ownership, that chat policies do not cover.
Who should approve the policy?
Legal, security, HR, and an executive sponsor. This guide is educational and not legal advice.
How often should we update it?
Review at least twice a year, and whenever you adopt a new tool or a vendor changes a major capability.
Do small businesses need an AI policy?
Yes, a short one. If employees use AI tools at all, they need clear rules on approved tools and what data may be entered.
Is your AI policy template legal advice?
No. It is a starting point. Have counsel review any policy against your contracts, regulations, and jurisdiction.
Sources and further reading
Product features, plans, and limits change often. This guide reflects the vendor documentation listed above as of November 2026. Check the vendor’s current documentation before you make purchasing or policy decisions. TechStack Consulting is an independent training firm and is not affiliated with Anthropic or OpenAI.