What is an AI acceptable use policy?
An AI acceptable use policy is a written document that tells employees which AI tools are approved, what kinds of data may and may not be entered, which tasks require human review, and how to request new tools or report problems.
It is the practical, everyday layer of AI governance. Where governance covers ownership and oversight, the acceptable use policy answers the questions staff actually have: can I use this tool, can I paste this file, do I need to tell the client, who checks the output. A good one is short enough that people will read it and specific enough to settle real situations.
Typical sections include approved tools and account types, data categories that are off-limits, tasks that always need a person's review, disclosure expectations, rules for client-facing content, and who owns the policy. Include concrete examples from your own work, such as which documents may be summarized and which may not, because abstract rules get interpreted differently by each person.
Rolling it out matters as much as writing it. Walk teams through the policy with examples, collect questions, and update it when tools or regulations change. Pair it with an approved tool that is actually useful, otherwise people will drift back to unapproved ones. Have staff acknowledge it, include it in new-hire onboarding, and revisit it at least once a year.
Example
For example, an engineering consultancy's policy might allow its business Microsoft 365 Copilot for drafting internal reports, forbid uploading client drawings into any public AI tool, and require a licensed engineer to review any AI-assisted text that appears in a stamped deliverable. New tools go through the operations director, who keeps the approved list current.