An AI acceptable use policy tells employees which AI tools they may use for work, what they must never share with them, and what happens when they need an exception. The template below follows the structure ProctoredAI generates for every client, in eight short sections written for employees rather than lawyers. Replace each highlighted part with the client's details.
This template is a starting point, not legal advice. Have the client's counsel review it, especially for regulated industries.
1. Why This Policy Exists
AI tools help us work faster, and we want you to use them. This policy exists so that what we share with AI services never includes what our clients, our employees and the law require us to protect. It applies to everyone who works for [Company], on company devices and on any device used for company work.
2. Approved AI Tools
These tools are approved for work. Use them for what your role requires; they are still subject to the data rules below.
- [Approved tool, for example the company's chat assistant]
- [Approved tool]
3. Everything Else: Ask First
AI tools not on the approved list may not be used for company work until [IT provider or role] approves them. If a tool would help your work, ask for it to be reviewed. These are not allowed at all: [blocked categories, for example companion chat apps and AI tools hosted in jurisdictions we do not accept].
4. Work Accounts, Not Personal Ones
Sign in to AI tools with your work account (@company.com). Company content in a personal AI account leaves with you, outside the company's control and records.
5. What Must Never Be Shared With AI
- Credentials and secrets: passwords, API keys, private keys and connection strings.
- Payment card numbers and bank account details.
- Government ID numbers, such as Social Security, passport and driver's license numbers.
- Patient health information, except in tools approved under a business associate agreement. [Healthcare clients only]
- Confidential documents: contracts, financial statements, HR and medical records, and customer lists, except in approved tools.
- Anything marked CUI or export-controlled. [Defense contractors only]
Never paste instructions meant to make an AI tool ignore its own rules, and be careful with files and pages that may contain hidden instructions.
6. When You Need an Exception
If a rule stops something your work genuinely requires, ask [IT provider or role] for an exception with a business reason and how long you need it. Exceptions are time-limited and recorded. Rules about credentials and controlled information allow no exceptions.
7. What Is Monitored, and What Is Not
On company devices, use of AI services is monitored to enforce this policy. [Describe what is recorded, for example: ordinary AI use is counted, not captured; when a data rule matches, a short excerpt is kept with the sensitive parts masked.] Other websites are not inspected. Records are kept for [retention period].
8. Acknowledgment
By acknowledging this policy, you confirm that you have read it and will use AI tools within it. Acknowledgments are recorded as compliance evidence. Questions go to [contact].
A Policy Nobody Enforces Is a Wish
A written policy tells an auditor what the client intended. It does not show what happened. ProctoredAI closes that gap: it generates each client's AI Use Policy from the rules actually enforced on its devices, so the paper policy and the real one cannot drift apart. Employees read and acknowledge it on their device, every acknowledgment is recorded with its version, and block and warning screens link back to it.
- Section 2 and 3 come from each app's status for the client: approved, unapproved or blocked.
- Section 4 comes from the client's work domains and the apps set to work accounts only.
- Section 5 lists the data rules in force, each with the plain-language line an employee sees when it applies.
- Section 7 states the client's real capture setting and retention.
Publishing freezes the document with a version number and a SHA-256 digest, so the version an employee acknowledged can always be shown. See how this supports EU AI Act AI literacy, ISO/IEC 42001 and HIPAA.
Questions
Does every business need an AI acceptable use policy?
Any business whose staff use AI tools for work benefits from one: it tells people what is allowed, and it is the first document an auditor or insurer asks for when AI comes up.
How long should an AI use policy be?
Short enough that people read it. Two pages in plain language, like the template above, is usually enough. Detail belongs in the enforced rules, not the document.
Should the policy name specific AI tools?
Yes for approved tools, so people know what they can use. For everything else, a category rule and "ask first" ages better than a list of banned products.
How often should it be updated?
Whenever the approved tools or data rules change. A generated policy updates with the configuration; a hand-written one should be reviewed at least every six months.