What belongs in an AI acceptable-use policy

If your business has more than two people, someone is already using an AI tool at work. The question isn't whether to allow it. It's whether the rules are written down, understood and followed. An AI acceptable-use policy is how you get there.

A good one fits on two or three pages, uses plain language and answers the questions people actually have. Here are the eight sections it needs.

1. Purpose and scope

One paragraph on why the policy exists: to let people use AI tools confidently, protect customers and the business, and meet your obligations. Say who it covers (employees, contractors, anyone using company accounts or data) and which tools count (any software that generates text, images, code or decisions, including features built into tools you already use).

2. Approved tools

List the tools people may use for work, by name, and how to get access. Include the business versions of the major assistants your company has chosen, and the AI features inside your productivity suite and CRM. Say plainly that personal accounts on consumer AI tools are not approved for work involving company or customer information. People follow a list. They don't follow "use good judgment."

3. Information that never goes in

This is the section people will read. Make it a clear list. For most businesses:

• Customer and client personal information, including anything financial or health-related
• Employee records, pay and performance information
• Passwords, keys and access credentials
• Anything covered by a confidentiality or non-disclosure agreement
• Unreleased financial results, pricing strategy and other material business secrets
• Any information a law or contract says must stay in a specific system

If your industry has specific rules about protected information, name them here and say that the policy follows them. Where a tool has been approved and configured for sensitive information, say which one and for what.

4. Review before use

AI output is a draft. State that a person reviews anything produced with AI before it is sent to a customer, published, filed as a record or used to make a decision about a person. Say who that person is for the common cases: the author for routine work, a manager for external communications, a named owner for anything that touches money, legal matters or people's employment.

5. Accuracy and sources

Tell people that AI tools can produce confident, wrong answers, and that any fact, figure, quotation, citation or legal or regulatory statement must be confirmed against a trusted source before it is used. A one-line rule works: "If it's a fact, find the source."

6. Disclosure

Decide when AI use is disclosed and write it down. Common choices: no disclosure needed for internal drafts and routine edits; disclosure when AI-generated content is published under the company's name in a context where readers would expect a person; always disclose when a customer asks. Whatever you choose, make it consistent.

7. Ownership and records

Clarify that work produced with AI tools on company time or accounts belongs to the company, that people may not use AI to reproduce others' copyrighted material, and how AI-assisted work is stored. If prompts and outputs may be reviewed for quality or compliance, say so.

8. Questions, problems and changes

Name the person or role who answers questions and approves new tools. Describe what to do when something goes wrong: a sensitive detail pasted by mistake, an AI-generated error that reached a customer. People report problems faster when the path is clear and the first response isn't blame. Commit to reviewing the policy on a schedule, since the tools change every few months.

Making it real

A policy nobody has read is a PDF. Three things turn it into practice:

Train on it. A short session where people see the approved tools, work through the "never goes in" list with real examples from their own jobs, and practice the review habit. This is where the policy becomes muscle memory.

Make the right way the easy way. If the approved tool is harder to reach than a personal account, people will use the personal account. Set up access, single sign-on and shortcuts before you publish the rules.

Have counsel look at it. Especially if you handle regulated information or operate in a licensed industry. We write policies in plain English for teams to follow; your attorney makes sure they meet your specific obligations.

Start with these eight sections, keep it short, and update it as you learn. A clear policy doesn't slow AI adoption down. It's what lets you speed it up.