AI Acceptable Use Policy for Employees (Free Template)

An AI acceptable use policy tells employees which AI tools they may use, what information they must never put into them, and who is accountable for what the AI produces. Most organizations need one now. Employees are already pasting work into chatbots whether or not a policy exists, so the real choice is between rules you have set and habits nobody has reviewed.

Below: the seven sections every policy needs, a copy-and-adapt template, and how to roll it out so people actually follow it.

Employees are already using AI. A policy chooses the rules instead of leaving the habit unreviewed.

Why You Need One Now

The risk is rarely dramatic. More often, a well-meaning employee pastes a customer list into a free chatbot to “clean up the formatting,” or drops a draft contract in to get a summary. On many consumer AI tools, what you type can be kept and, depending on the plan’s settings, used to improve future models. Once that information leaves your environment, you can’t get it back.

A policy does three things:

• Protects data by drawing a clear line around what can never go into an AI tool.
• Lets people use AI with confidence. Without approved tools, employees either avoid AI entirely or use it quietly. Neither helps the business.
• Sets accountability. The person who sends the email or ships the code owns it, whoever drafted it.

For the data-protection side in more depth, see our guide on keeping sensitive data out of public AI tools.

The 7 Sections Every AI Policy Needs

#	Section	The question it answers
1	Purpose and scope	Who does this cover, and which tools count as “AI”?
2	Approved tools	Which tools may I use, on which accounts?
3	Data classification rules	What can I never put into an AI tool?
4	Acceptable and prohibited uses	What is AI fine for, and what is off-limits?
5	Human review and accountability	Who is responsible for AI output?
6	Transparency and disclosure	When must I say AI was involved?
7	Training, reporting and review	How do I learn the rules, report a mistake, and how often do the rules change?

Restricted data stays out of every tool unless a named process says otherwise.

The Data Rule That Matters Most

If employees remember one thing, it should be a simple traffic light:

Category	Examples	Approved enterprise AI tool	Personal or free AI tool
Public	Published marketing copy, public documentation	Yes	Yes
Internal	Internal process docs, non-sensitive meeting notes	Yes	No
Confidential	Customer data, financials, contracts, unreleased product plans, source code	Only if the tool is approved for this class	Never
Restricted	Personal data (PII), health data, payment card data, credentials, API keys	Never, unless a specific approved process exists	Never

This works because it reuses the data classification most companies already have. If yours doesn’t have one, these four levels are a sensible default.

AI Acceptable Use Policy Template

Copy this, replace the bracketed text, and have legal and HR review it before you publish.

1. Purpose and scope. This policy governs the use of generative AI tools (any tool that produces text, code, images, audio or analysis from a prompt) by all employees, contractors and temporary staff of [Company], on any device, when the work relates to [Company] business.

2. Approved tools. You may use only the AI tools listed on [link to approved tools list], signed in with your [Company] account. Personal accounts on any AI tool must not be used for [Company] work. To request a new tool, contact [IT / security contact].

3. Data rules. Never enter Restricted information (personal data, health data, payment data, passwords, API keys or credentials) into any AI tool. Confidential information may be entered only into tools approved for Confidential data on the list above. When in doubt, treat it as Restricted.

4. Acceptable uses. Drafting and editing, summarizing non-sensitive material, brainstorming, research starting points, coding assistance in approved tools, and learning. Prohibited uses: making or materially influencing decisions about hiring, firing, pay, credit or legal outcomes without human review; creating content that impersonates a real person; generating material that is discriminatory, harassing or infringes intellectual property; and getting around security controls.

5. Human review and accountability. You are responsible for anything you publish, send, ship or act on, whether or not AI helped produce it. Check facts, figures, citations and code before use. AI output may be inaccurate, outdated or invented.

6. Disclosure. Tell recipients that AI was used where [Company] or a client requires it, where a reasonable person would expect to know, or where content is presented as original human work in a regulated, legal or academic context.

7. Training, reporting and review. All staff must complete AI acceptable use training within [30] days of this policy’s effective date and annually after that. If you think confidential or restricted data has been entered into an unapproved tool, report it to [security contact] immediately. You will not be penalized for prompt self-reporting. This policy is reviewed every [6] months by [policy owner].

The no-penalty self-report is the clause that surfaces incidents.

How to Roll It Out So It Sticks

1. Publish the approved tools list first. A policy that only says no drives AI use underground. Give people a sanctioned option on day one.
2. Train with examples, not definitions. “Can I paste this customer email into the chatbot to draft a reply?” teaches more than a paragraph on data classification.
3. Make reporting safe. The no-penalty self-reporting clause is the one that actually surfaces incidents. Keep it.
4. Back it with technical controls. Data loss prevention, browser controls and audit logging in your Microsoft 365 or Google environment catch what training misses.
5. Review every six months. Tools, vendor terms and regulations are all changing fast. An AI policy from last year is already out of date.

If you are building a broader program around the policy, our guide to AI governance with Microsoft Purview covers the technical controls side.

How StormWind Studios Approaches AI Policy and Training

A policy only works if people understand it. StormWind’s AI in the Workplace: Acceptable Use of Generative AI Tools course turns the rules above into practical, scenario-based training for every employee. Leaders building the framework behind it can take How to Build an AI Governance Framework, and IT teams putting technical controls in place can take Introduction to AI Governance with Microsoft Purview.

Frequently Asked Questions

What is an AI acceptable use policy?
A document that sets out which AI tools employees may use, what data they may and may not enter, what uses are prohibited, and who is accountable for AI-generated output.

What should an AI policy for employees include?
At minimum: scope, approved tools, data classification rules, acceptable and prohibited uses, human review requirements, disclosure rules, and a training and incident-reporting process.

Can employees use Copilot, ChatGPT, or Claude at work?
That is a decision for each organization. Many allow free tools for public information only, and require approved enterprise accounts for anything internal or confidential.

Why shouldn’t employees put confidential information into public AI tools?
Depending on the provider and plan, what you enter may be stored, reviewed or used to train future models. That puts it outside your control and can breach contracts or data-protection law.

How often should an AI policy be updated?
At least every six months, and whenever you approve a new tool or a relevant regulation changes.

Who should own the AI policy?
Usually a joint owner from IT or security and legal or compliance, with HR responsible for training and enforcement.