How to Write an AI Acceptable Use Policy for Your Business
Most businesses already have rules for email, passwords and company laptops. Very few have rules for AI. That gap matters, because employees started using AI tools long before anyone wrote down what's allowed.
An AI acceptable use policy closes that gap. It tells employees which tools they can use, what data stays out and who checks the work. It doesn't need to be long or full of legal language. Honestly, the shorter versions tend to work better.
The hard part is knowing what to put in it. A policy that's too strict pushes people toward shadow AI. A policy that's too vague doesn't protect anything. The goal is somewhere in the middle, written for the way people actually work.
What Is an AI Acceptable Use Policy?
An AI acceptable use policy is a written set of rules for how employees use artificial intelligence tools at work. It works a lot like the computer use policy most businesses already have. The difference is the focus. A standard policy covers devices and internet access, and an AI acceptable use policy covers what employees type into AI tools and what they do with the results.
It's one piece of a larger plan for AI in the workplace. Some businesses call it a generative AI policy or simply an AI policy. The name matters less than what's inside. A one-page document that every employee has read beats a 20-page document sitting in a shared drive.
One thing to keep in mind. The policy isn't a technical control. It won't block a website or stop a file upload on its own. It sets expectations, and the IT side enforces them.
Why Every Business Needs an AI Policy for Employees
Most businesses still don't have an AI acceptable use policy. An EisnerAmper survey of U.S. desk workers found that only 36% said their company had a formal AI policy. The same research found that 28% would use AI at work even if it were banned. That second number is the one owners should pay attention to.
There's also a communication problem. Research from Reward Gateway and Edenred found that 37% of employees said their workplace had AI guidance, compared with 68% of HR teams. So in many companies, a policy exists and most staff don't know about it. That's almost as risky as having nothing at all.
An AI policy for employees protects the business in a few ways. It reduces the chance that client or patient data ends up in a free chatbot. It gives managers something concrete to point to. And it shows auditors and insurers that the business took the risk seriously, which may matter more every year.
What to Include in Your AI Acceptable Use Policy
SHRM, the national HR association, recommends that AI policies clearly define permitted and prohibited uses and require employees to verify AI output. Those two ideas anchor most good policies. Here's what a practical AI acceptable use policy should cover.
Approved and Prohibited Tools
List the AI tools employees can use by name. Business-grade tools like Microsoft 365 Copilot usually belong on the approved list once they're set up correctly. Free consumer chatbots, AI browser extensions and unvetted meeting notetakers often belong on the prohibited list, at least for client work. Be specific. "Use approved tools only" means nothing if nobody knows which tools are approved.
Data That Never Goes Into an AI Tool
This section of an AI acceptable use policy probably matters most. Spell out the data types that stay out of AI tools no matter what:
- Patient records and health information
- Social Security numbers, tax returns and bank details
- Client financial statements and contracts
- Passwords, network details and internal security information
- Employee personnel files
A simple rule of thumb helps here. If the information would cause a problem on a public website, it doesn't go into an unapproved AI tool.
Human Review of AI Output
AI makes mistakes. It invents numbers, cites things that don't exist and misreads context. The policy should require a person to review anything AI-generated before it goes to a client, a patient or the public. Name who's responsible. "Someone should check it" usually means nobody does.
Ownership and Accountability
Pick one person to own the AI acceptable use policy. In a small business, that might be the office manager working with an outside IT partner. That person answers questions, reviews tool requests and updates the document when things change.
How Employees Request New Tools
New AI tools launch constantly. Give employees a simple way to request one, such as an email to the policy owner with the tool name and what it's for. A clear request process is one of the best ways to keep shadow AI from creeping back in.
Writing AI Usage Guidelines Employees Will Actually Follow
An AI acceptable use policy only works if people read it. Clear AI usage guidelines help a lot. Write in plain language and skip the legal jargon where possible. Use real examples from the business, like "Don't paste client tax documents into ChatGPT," instead of abstract rules about "sensitive information."
Keep the core rules to a page or two. Put the details in an appendix for anyone who wants them. Then walk through the policy with the team in a short meeting. Twenty minutes with real examples and a few questions probably does more than any document by itself. Have each employee sign off that they read it, too.
Expect some pushback. A few employees will see the policy as the company taking away a tool they like. Explaining why the rules exist, and offering approved alternatives, usually softens that.
Industry Rules That Shape a Generative AI Policy
Regulated businesses need an AI acceptable use policy that reflects their existing obligations. Those rules apply to every tool, AI or not.
Medical practices must protect electronic health information under the HIPAA Security Rule, so the policy should ban patient data from any AI tool without a business associate agreement. CPA firms and financial offices covered by the FTC Safeguards Rule should list approved AI tools in their written information security program. Municipal offices should address whether AI chat histories and drafts count as public records in their state.
For businesses that want a broader framework, the NIST AI Risk Management Framework offers useful structure. Most small offices will only need a small slice of it.
Keeping Your AI Acceptable Use Policy Current
An AI acceptable use policy goes stale fast. Review it at least twice a year, and any time the business adopts a major new tool. Check what employees are actually using against what the policy allows. If those two lists don't match, the policy needs an update, or the training does.
Many small businesses don't have the time or technical background to write and enforce a policy alone. AGJ Systems helps businesses across the Gulf Coast align AI use with their IT compliance requirements. A free 15-minute discovery consultation is a simple way to start.
Frequently Asked Questions
What is an AI acceptable use policy?
An AI acceptable use policy is a written set of rules for how employees use artificial intelligence tools at work. It typically lists approved and prohibited tools, defines data that can never be entered into AI tools and requires human review of AI-generated work.
What should an AI policy for employees include?
A practical AI policy should include approved and prohibited tools, restricted data types, human review requirements, a named policy owner and a process for requesting new tools. Many businesses also add industry-specific rules for regulated data such as health or financial information.
Should a business ban AI tools entirely?
Outright bans rarely work. Research from EisnerAmper found that 28% of employees would use AI at work even if it were banned. Approving safe, business-grade tools and setting clear rules usually reduces risk more than a ban.
How long should an AI acceptable use policy be?
The core rules should fit on one or two pages so employees actually read them. Additional detail, such as a full list of approved tools or industry-specific requirements, can go in an appendix.
How often should an AI policy be updated?
Review an AI acceptable use policy at least twice a year and whenever the business adopts a major new AI tool. AI tools and their data practices change quickly, so an outdated policy can leave gaps.
