An AI acceptable use policy is a short internal document that tells employees which AI tools they may use for work, which kinds of data must never be entered into them, how AI output has to be checked before anyone relies on it, and what to do when something goes wrong. It matters because the same chatbot can keep, review or train on your data under one account type and not under another, and staff cannot be expected to know the difference. A usable policy fits on two pages, names the approved tools and account types, and is backed by short training.
What is an AI acceptable use policy?
It is the AI section of your rules for staff, written as plain instructions. It is not an AI strategy, a list of projects, or a legal opinion. Its job is to let people use AI tools productively while keeping customer data, confidential information and your company's reputation out of harm's way. Some companies call it an AI usage policy or a generative AI policy; the content is the same.
A good policy answers six questions an employee would ask: Which tools can I use? With which account? What can I put in? What must I check before I use the output? When do I have to say AI was involved? Who do I tell if something goes wrong?
Do you need an AI acceptable use policy?
If anyone in your company uses AI tools for work, yes, and they almost certainly do. Without a policy, people use whatever account they already have, which is usually a personal one.
There is also a legal reason in the EU. Article 4 of the AI Act says providers and deployers of AI systems "shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf". The European Commission's guidance answers the obvious question directly: asked whether a company whose employees use ChatGPT for advertising text or translation must comply, it says "Yes, they should be informed about the specific risks, for example hallucination."
The duty has applied since 2 February 2025, and national market surveillance authorities supervise and enforce it from August 2026. The 2026 AI Omnibus amended the article so that it does not require providers or deployers to guarantee any specific level of AI literacy of any individual, and the Commission confirms "There is no need for a certificate." Organizations can keep an internal record of trainings instead. A written policy plus a logged training session is the simplest record there is.
What should an AI acceptable use policy cover?
| Section | What it settles |
|---|---|
| Scope | Who it applies to (staff, contractors) and which tools count as AI |
| Approved tools and accounts | The exact products and account types allowed, and who approves new ones |
| Data rules | Which data classes may go into which tool, and which never may |
| Output review | Who checks AI output, and what must be verified before use |
| Disclosure | When customers, readers or colleagues must be told AI was used |
| Intellectual property | Who owns output, and what not to paste in (third party content you have no rights to) |
| Automated actions | Which actions AI may take on its own, and which need approval |
| Incidents | What counts as an incident, who to tell, and how fast |
| Training and review | How people learn the policy, and when it is updated |
The approval point matters more as staff move from chat tools to agents that send emails or change records. Our guide to human in the loop AI covers which actions should always wait for a person.
Which AI accounts keep your data, and for how long?
This is the part most templates leave vague, and it is the reason the policy must name account types. As of October 2026, the vendors' own pages say:
| Product and account | Used to train models? | Retention notes |
|---|---|---|
| ChatGPT Free, Plus, Pro | OpenAI "may use your content to train our models"; users can opt out under Settings > Data controls | Temporary chats are not used to improve models |
| ChatGPT Business, Enterprise, Edu, and the API | Not used by default | API abuse monitoring logs retained for up to 30 days by default; Enterprise admins control how long your data is retained |
| Claude Free, Pro, Max | Used if the user chooses to allow it, or if a chat is flagged for safety review | If allowed, kept in a de-identified format for up to 5 years; deleted chats leave back-end storage within 30 days |
| Claude for Work and the Anthropic API | Not used by default | Feedback sent with the thumbs buttons is stored for up to 5 years |
| Gemini Apps, personal Google account | A subset of chats is reviewed by human reviewers to improve Google services | Default auto-delete is 18 months; reviewed chats are kept for up to three years |
| Microsoft 365 Copilot | Prompts, responses and Microsoft Graph data aren't used to train foundation LLMs | Stored under your organization's Microsoft 365 commitments |
Two details are easy to miss. Feedback overrides settings on consumer accounts: OpenAI says that if a user on an individual plan clicks thumbs up or down, it "may use the entire conversation associated with that feedback to improve our models, even if you have opted out of model training." And Google's advice on Gemini Apps is blunt: "Please don't enter confidential information that you wouldn't want a reviewer to see or Google to use to improve our services". Google notes that work and school accounts may be subject to different data handling terms, so check yours.
The practical rule for the policy: company data goes only into business accounts that the company administers, never into personal accounts.
AI acceptable use policy template
Copy this, replace the bracketed fields, and cut what does not apply. It is written for a company of up to a few hundred people.
[Company name] AI acceptable use policy Version [1.0], effective [date], owner [name, role]. Review every six months.
1. Purpose and scope. This policy covers every employee and contractor who uses AI tools for [Company name] work, including chat assistants, writing and coding assistants, meeting note takers, image tools and AI features inside other software.
2. Approved tools. You may use only these tools for work, and only through the company account: [ChatGPT Business / Claude Team / Microsoft 365 Copilot / other]. Personal accounts must not be used for company work. To request a new tool, email [owner]; it may be used once it is approved and added here.
3. Data you must never enter into any AI tool unless the tool is approved for it in writing: 1. Personal data about customers, employees or applicants (names with contact details, ID numbers, health or financial information). 2. Passwords, API keys, access tokens and other credentials. 3. Confidential contracts, pricing, financial results not yet published, and legal matters. 4. Content a client or partner gave us under a confidentiality agreement. 5. Source code that is not ours to share.
If you are unsure which class something falls into, ask [owner] before you paste it.
4. Checking output. You are responsible for anything you use, send or publish, whoever drafted it. Check facts, figures, names, quotes, links and code before use. AI tools can produce confident, wrong answers. Never send AI output to a customer, regulator or the public without reading it in full.
5. Disclosure. Tell the recipient when a customer is talking to an AI system rather than a person, and label AI generated images, audio or video that show real people or events. Follow [client or publisher] rules where they are stricter.
6. Intellectual property. Do not upload third party material you have no right to use. Treat AI output as needing human creative input before we claim ownership of it.
7. Automated actions. AI tools and agents may draft, summarize and suggest. A named person must approve any payment, refund, contract, deletion, or message to an external party before it happens.
8. Incidents. Report to [owner, email] within [24 hours] if you entered restricted data into an AI tool, if an AI tool acted without approval, or if AI output caused a mistake that reached a customer. Reporting quickly is never punished; hiding an incident is.
9. Training. Everyone completes the [company] AI training before using approved tools, and again when this policy changes. [Owner] keeps a record of who completed it.
10. Breaches. Breaches of this policy are handled under [disciplinary policy reference].
Signed: [name] Date: [date]
How do you roll out an AI usage policy for employees?
- Buy the business accounts first. A policy that bans personal accounts without offering an approved alternative will be ignored.
- Set the admin controls before inviting users. Retention, feedback and connector settings live in the admin console of each product; OpenAI notes that admins of business workspaces can enable or disable response feedback, for example.
- Run a 30 minute training. Cover the data rules with examples from your own work, hallucination with a real wrong answer, and the incident route. The Commission says AI literacy measures should take into account technical knowledge, experience, education and training and the context of use, so tailor it by role.
- Record who completed it. One spreadsheet is enough.
- Explain prompt injection to anyone using agents or browser assistants. Text inside an email or web page can instruct an AI tool to do something its user never asked for; our article on prompt injection attacks has the examples to show.
- Review every six months. Vendor terms change often, as the table above shows.
The policy is also the starting point for anything you build. When we design AI systems for a company, the data classes and approval rules in this policy become requirements for the build, and the same rules apply in our guide to AI implementation.
Frequently asked questions
Can employees use their personal ChatGPT or Claude accounts for work?
They should not use them for company data.
Consumer accounts follow the individual's own training and retention settings, which the company cannot see or enforce.
Business accounts are not used for training by default and give admins control over retention and feedback.
Do we have to tell customers when we use AI?
Sometimes.
Under Article 50 of the EU AI Act, whose transparency rules the Commission says come into effect in August 2026, deployers must disclose deep fakes, and text published to inform the public on matters of public interest must be disclosed as AI generated unless it has undergone a process of human review or editorial control with someone holding editorial responsibility.
Providers must also design AI systems that talk to people so those people are informed they are interacting with an AI, unless that is obvious.
Contracts and sector rules can require more.
Who owns content created with AI?
In the United States, the Copyright Office concluded in January 2025 that AI outputs can be protected by copyright only where a human author has determined sufficient expressive elements, and that "the mere provision of prompts" is not enough.
Other countries differ.
That is why the template asks for human creative input before claiming ownership.
Is this template legal advice?
No.
It is a practical starting point based on the vendor documentation and EU guidance linked above.
Have it reviewed against your employment contracts, data protection obligations and sector rules before you adopt it.