AI acceptable-use policy: a starter template

[Organisation name]: AI acceptable-use policy

Version: [1.0]
Owner: [role, for example Head of IT or Data Protection Officer]
Approved by: [name or role]
Date: [date]
Next review: [date]

1. Purpose and scope

This policy explains how people at [Organisation name] may use artificial intelligence (AI) tools in their work. It applies to employees, contractors and anyone else using our systems or data. It covers chatbots and writing assistants, AI features built into other software, coding assistants, image, audio and video generators, and AI agents that can take actions on someone's behalf.

2. The short version

• Use only the AI tools on the approved list, with your work account.
• Never put confidential, personal or secret information into a tool that is not approved for it.
• Check what AI gives you before you rely on it. You are responsible for the work you submit.
• Do not let an AI tool take actions (send, buy, delete, publish, change settings) unless it has been approved to do so and a person checks the important ones.
• If something goes wrong, or you are not sure, tell [contact] straight away. You will not be blamed for reporting in good faith.

3. Approved tools

The approved list is kept at [link or location]. It shows, for each tool, who may use it, what kinds of information may go into it, and any conditions. If a tool is not on the list, it is not approved.

To ask for a new tool, contact [owner]. Before approving a tool we check [for example: who runs it, where our data goes, whether our data is used to train models, how access is controlled, what is logged, and whether it can take actions]. We aim to answer requests within [number] working days.

4. What you may do

With an approved tool you may [for example: draft and edit text, summarise public or internal documents the tool is approved for, brainstorm, write and review code, analyse data you are allowed to use]. Keep a note of important decisions where AI materially influenced the outcome.

5. What must never go into an AI tool that is not approved for it

Our data is grouped into [three] levels. The data classification policy at [link] gives examples.

When you are unsure which level something is, treat it as the higher level and ask.

6. Accounts and access

• Sign in with your work account, using multi-factor authentication where offered. Do not use a personal account for work information.
• Do not share accounts, and do not paste API keys or tokens into any AI tool.
• Do not install AI browser extensions, plug-ins, connectors or agents without approval. They can be given broad access to your accounts.

7. Checking AI output

AI tools can be wrong and can sound certain when they are. Before you use output:

• check facts, figures, quotations and references against a reliable source;
• review code before it is run or shipped, including any packages or commands it suggests;
• do not use AI as the sole basis for a decision about a person (for example hiring, discipline, credit or access to a service);
• tell [clients or colleagues, as relevant] when AI was used if [contract, law or our policy] requires it.

8. AI agents and automation

An AI agent is a tool that can use other tools and take actions. Agents need extra care because they can be misled by the content they read.

• Use only approved agents, with the least access needed for the task.
• Do not start an agent in a folder, repository or mailbox you do not trust. Content in files, web pages, emails and documents can contain instructions aimed at the agent.
• Approve high-impact actions yourself (sending, paying, deleting, publishing, changing permissions, installing software). Do not switch off approval prompts.
• If an agent does something unexpected, stop it and report it.

9. Personal data

Do not enter personal data into an AI tool unless the tool is approved for it and there is a lawful reason to do so. If you want to use AI on a new process involving personal data, speak to [Data Protection Officer or privacy lead] first, because a data protection impact assessment may be needed.

10. Intellectual property and confidentiality

Do not enter material you do not have the right to use, and do not enter our confidential information into unapproved tools. Check [our policy or contracts] before using AI-generated material in client work or publishing it.

11. Reporting a concern or incident

Report these to [contact, for example a security mailbox or phone number] immediately:

• you put something into an AI tool that you should not have;
• an AI tool or agent acted in a way you did not expect;
• you think a key, token or account connected to an AI tool may have been exposed;
• you receive a message, call or video that may be an AI-generated impersonation.

12. Breaking this policy

Breaches may lead to action under [disciplinary or contractor terms]. Reporting a mistake promptly counts in your favour.

13. Review

[Owner] reviews this policy at least every [12] months and after any significant AI-related incident.