Your employees are almost certainly using AI already: to write emails, summarise documents, translate, or analyse spreadsheets. Often with personal accounts and without anyone knowing. This is sometimes called shadow AI.
Banning AI rarely works and wastes a big productivity opportunity (see how much time AI really saves). A clear, practical AI policy is the better answer: it tells people what they can do, with which tools, and where the limits are.
Why you need an AI policy
- Protect confidential data: customer data, contracts, source code and financial information should not end up in tools without proper agreements
- Legal compliance: GDPR, confidentiality agreements and sector rules still apply when using AI. The EU AI Act also requires organisations deploying AI systems to take measures to ensure sufficient AI literacy of their staff
- Quality and accountability: AI output can be wrong; someone must stay responsible
- Clarity for employees: people want to use AI but are unsure what is allowed
What to include
1. Purpose and scope
Who the policy applies to (employees, contractors), and which AI uses it covers (chat assistants, AI features in existing software, coding tools, image generators, meeting assistants).
2. Approved tools
A list of approved tools and accounts, for example company business accounts with data protection terms. Explain how employees can request a new tool.
3. Data classification rules
The most important part. A simple traffic light works well:
| Category | Examples | AI use |
|---|---|---|
| Public | Website content, published marketing | Any approved tool |
| Internal | Internal processes, non-sensitive notes | Approved business tools only |
| Confidential | Customer data, contracts, financials, source code | Only tools approved for confidential data |
| Strictly confidential | Health data, passwords, payment data, HR files | Never, unless explicitly approved |
4. Human review and accountability
- AI output is a draft, not a final answer
- The employee who uses it is responsible for the result
- Facts, numbers, legal statements and code must be checked
5. Transparency
When to tell customers or colleagues that AI was used. For example: AI chat assistants must say they are AI; AI-generated images in marketing may need labelling.
6. Prohibited uses
Examples: making automated decisions about people (hiring, firing, credit) without human review; creating misleading content; uploading other people’s personal data without a legal basis; bypassing security controls.
7. Intellectual property
Rules on using copyrighted material as input, and checking AI output before publishing.
8. Security
- Use company accounts with two-factor authentication
- No API keys or passwords in prompts
- Be careful with AI tools that can take actions (browsing, sending email, accessing files)
9. Meetings and recordings
Consent and retention rules for AI meeting assistants (see AI meeting assistants).
10. Training
Basic AI training for everyone: how to prompt, how to verify, what the risks are.
11. Reporting and review
Who to contact with questions or incidents, and how often the policy is reviewed (at least yearly, AI changes fast).
Free AI acceptable use policy template
Adapt this to your company. Have it reviewed by your legal advisor.
[Company name] AI Acceptable Use Policy
1. Purpose. This policy explains how employees may use artificial intelligence (AI) tools to work more efficiently while protecting our customers, our data and our reputation.
2. Scope. This policy applies to all employees and contractors who use AI tools for work, including AI chat assistants, AI features in existing software, coding assistants, meeting assistants and image generators.
3. Approved tools. Only use the AI tools listed in [location of approved tool list], with your company account. To request a new tool, contact [name/team].
4. Data rules. Public information may be used in any approved tool. Internal information may only be used in approved business tools. Confidential information (customer data, contracts, financial data, source code) may only be used in tools approved for confidential data. Strictly confidential information (passwords, payment data, health data, HR files) may never be entered into AI tools unless explicitly approved by [role].
5. Human responsibility. AI output is a draft. You are responsible for checking facts, numbers, legal statements and code before using or sharing it.
6. Transparency. Customers must know when they are interacting with an AI system. Follow [marketing guideline] for AI-generated content.
7. Prohibited uses. Do not use AI to make decisions about people without human review, to create misleading content, to process personal data without a legal basis, or to bypass security controls.
8. Security. Use company accounts with two-factor authentication. Never put passwords, API keys or access tokens in prompts.
9. Recordings. Only record or transcribe meetings with the knowledge of all participants and in line with [recording guideline].
10. Training. All employees complete the basic AI training within [period] of starting.
11. Questions and incidents. Contact [name/team] with questions, or immediately if confidential data may have been shared with an unapproved tool.
12. Review. This policy is reviewed at least once a year. Last updated: [date].
How to roll it out
- Inventory current use: ask teams which tools they already use (anonymously if needed)
- Choose approved tools that cover the main needs, so people do not need workarounds
- Publish the policy with a short, clear explanation
- Train with practical examples from your own work
- Review after a few months based on questions and incidents
A policy that only says “no” pushes AI use into the shadows. A policy that gives good tools and clear rules brings it into the open. See also how to introduce AI in your team.
Frequently asked questions
Do small companies need an AI policy?
Yes, but it can be short. One page with approved tools, data rules and human review covers most of the risk.
Should we block public AI tools?
Blocking without offering a good alternative usually leads to workarounds. Offering approved business tools is more effective.
Who should own the AI policy?
Often a combination of management, IT/security and legal/privacy, with one clear owner.
Need help with AI governance?
I help companies choose AI tools, write practical policies and train teams to use AI safely and productively. See my AI integration service or request a consultation.