AI Acceptable Use Policy Template: Free, Copy-Ready Policy for Employee AI Use

Last updated: September 22, 2026

An AI acceptable use policy (AI AUP) is the document that tells employees which AI tools they may use, what data they may put into them, what they must do with the outputs, and who to ask when they are unsure. The full policy template below is free to copy, needs no form to access, and is written to satisfy the “AI policy” and “acceptable use” expectations in ISO 42001 (clause 5.2 and Annex A control A.2.2), the workforce-facing parts of the NIST AI RMF Govern function, and the AI literacy duty in Article 4 of the EU AI Act. Replace the bracketed placeholders, cut the sections that do not apply, and publish it as a one-page rule set rather than a legal treatise.

This template is part of our AI governance guide. It is the employee-facing companion to the AI governance policy template, which sets the organization-wide program; the acceptable use policy is the short version everyone actually reads.

Key takeaways

• An AI acceptable use policy governs people, not systems. It answers the questions employees ask every day: can I paste this into ChatGPT, can I use the AI feature in our CRM, can I send AI-written text to a customer.
• The most effective policies sort tools into three lists (approved, approved with conditions, prohibited) and sort data into tiers that map to those lists. Everything else is commentary.
• Output rules matter as much as input rules. Most real incidents come from unreviewed AI output reaching a customer, a regulator, or production code, not from a leaked prompt.
• The EU AI Act’s Article 4 AI literacy obligation has applied since February 2, 2025, and it applies to deployers of any AI system, not just high-risk ones. Your acceptable use policy plus a short training is the simplest evidence of compliance.
• Keep it to two pages, review it every six months, and version it. AI tools change faster than any other category of software your policy covers.

Why do you need an AI acceptable use policy separate from your general AUP?

Your existing IT acceptable use policy was written for email, web browsing, and company devices. It says nothing about whether a support agent may paste a customer’s ticket into a public chatbot, whether a developer may accept code suggestions trained on unknown licenses, or whether a recruiter may ask a language model to rank candidates. These are the questions that generate real exposure: confidential data flowing to a third-party model, copyrighted or hallucinated content shipped under your name, and automated decisions about people made without the oversight your regulators expect.

The frameworks now expect a written answer. ISO 42001 requires top management to establish an AI policy (clause 5.2) and, through Annex A control A.2.2, to document the organization’s policy for the development and use of AI systems. The NIST AI RMF’s Govern function calls for policies, processes, and training so that the workforce understands AI risk. The EU AI Act’s Article 4 requires providers and deployers to ensure a sufficient level of AI literacy among staff who operate or use AI systems, and that obligation is already in force. A clear acceptable use policy, backed by a 30-minute training, is the cheapest way to produce evidence for all three at once. Where your organization also needs an AI system inventory, the approved tool list in this policy is the seed for it.

What should an AI acceptable use policy include?

A usable policy has seven parts: purpose and scope, definitions, the tool lists, the data rules, the output rules, the prohibited uses, and the procedures for requesting a new tool and reporting a problem. The template below follows that order. Everything in brackets is a placeholder or an instruction to the drafter.

AI acceptable use policy template

1. Purpose

This policy defines how [Company Name] personnel may use artificial intelligence tools, including generative AI, in the course of their work. Its goal is to let people benefit from AI while protecting confidential information, customers, intellectual property, and the people affected by our decisions. It supports the [Company Name] AI Governance Policy and applies alongside the Information Security Policy, the Data Classification Policy, and the Code of Conduct.

2. Scope

This policy applies to all employees, contractors, interns, and temporary staff of [Company Name] and to any AI tool used for company work, regardless of whether the tool is provided by the company, accessed through a personal account, or embedded as a feature inside another product (for example, AI assistants inside office suites, CRMs, meeting tools, and developer environments). It covers use on company devices and on personal devices used for work.

3. Definitions

AI tool: any software or service that uses machine learning or generative models to produce text, code, images, audio, video, predictions, recommendations, or decisions. Generative AI: AI tools that create new content in response to prompts. Confidential information: any information classified as Internal, Confidential, or Restricted under the Data Classification Policy, including customer data, personal data, source code, financial information, and unreleased plans. Approved AI tool: a tool listed in Appendix A that has completed [Company Name]’s security and AI review. AI output: anything an AI tool produces.

4. Approved, conditional, and prohibited tools

[Company Name] maintains three lists in Appendix A, owned by [the AI Governance Lead / IT Security] and reviewed at least every six months.

Approved tools have an enterprise agreement in place that prohibits training on our data, have passed security review, and are configured with company single sign-on. They may be used with data up to the classification level stated next to each tool. [Example: Company-licensed enterprise LLM assistant, approved up to Confidential. Company-licensed coding assistant, approved for source code in repositories the user already has access to.]

Conditionally approved tools may be used only for the purposes and data types listed, typically Public or Internal data only. [Example: Free-tier or consumer AI assistants, approved for public information and general research only, never for confidential information or personal data.]

Prohibited tools may not be used for company work under any circumstances. [Example: tools that have failed security review, tools that claim rights over user inputs, browser extensions that read page content and send it to an AI service without an enterprise agreement.]

If a tool is not on any list, treat it as conditionally approved for Public data only and submit a request under Section 9 before using it with anything else. AI features that appear inside already-approved software are covered by that software’s approval only if Appendix A says so; otherwise the same request process applies.

5. Data you may and may not enter into AI tools

The rules follow the Data Classification Policy. Never enter the following into any AI tool unless Appendix A explicitly approves that tool for that data: personal data about customers, employees, or candidates; customer confidential information or anything covered by a customer NDA; source code, credentials, API keys, or infrastructure details; financial results, forecasts, or material non-public information; health, biometric, or other special-category data; and anything marked Restricted. Before pasting anything into an AI tool, remove or replace identifying details where the task allows it. When a tool offers a setting to disable training or data retention, it must be turned on. Personal accounts on AI services may not be used for company work involving anything above Public data.

6. Rules for using AI output

You are responsible for anything you use, send, or publish, regardless of whether an AI tool helped produce it. AI output must be reviewed by a person before it is relied on. In particular: content sent to customers, regulators, the public, or the press must be reviewed for accuracy and approved under the normal review process for that content; code suggested by an AI tool must go through the same code review, testing, and license checks as human-written code; factual claims, citations, statistics, and legal or regulatory statements produced by AI must be verified against a primary source before use; AI output must not be presented as the original work of a person where that would be misleading, and must be disclosed where a customer contract, a regulator, or Section 7 requires it; and AI-generated images, audio, or video of real people may not be created or used without written approval from [Legal / Communications].

7. Prohibited uses

Personnel may not use AI tools to make or materially inform decisions about individuals (hiring, promotion, discipline, credit, pricing, eligibility, or access to services) unless the use case has been assessed and approved under the AI Governance Policy and a human with authority reviews each decision; to monitor, profile, or infer sensitive characteristics of employees or customers; to generate content that is discriminatory, harassing, deceptive, or that impersonates a real person or organization; to create or modify malware, bypass security controls, or probe systems without authorization; to circumvent licensing, copyright, or terms of service; or to process any data in a way that would violate the Privacy Policy or our obligations to customers. Where the EU AI Act applies, uses that would fall within its prohibited practices (for example, emotion recognition in the workplace or social scoring) are banned outright, and uses that would be high-risk under Annex III require the approval and oversight described in the AI Governance Policy before deployment.

8. Transparency and disclosure

When people interact with an AI system provided by [Company Name] (such as a chatbot), they must be told they are interacting with AI unless it is obvious from context. AI-generated or manipulated audio, image, video, or text that could be mistaken for authentic must be labeled where the law or our customer commitments require it. The EU AI Act’s Article 50 transparency obligations apply from August 2, 2026, and [Legal] maintains the current disclosure wording.

9. Requesting a new AI tool or use case

To request a new tool or a new use of an existing tool, submit the AI Tool Request form to [the AI Governance Lead / IT Security] with the tool name, the intended purpose, the data classification involved, and whether any decisions about people are involved. Requests are reviewed within [10 business days]. Approved tools are added to Appendix A with any conditions. Vendors supplying AI tools are assessed with the company vendor AI questionnaire.

10. Reporting problems

Report any of the following to [security@company.com] as soon as you become aware: confidential or personal data entered into an unapproved tool; AI output that was sent or published and later found to be wrong, harmful, or infringing; suspected bias or unfair outcomes from an AI tool; a security event involving an AI tool; or any AI tool behavior you believe violates this policy. Good-faith reports will not result in disciplinary action for the reporter.

11. Training

All personnel in scope complete AI acceptable use training within [30 days] of joining and annually thereafter. Personnel who operate or oversee AI systems used in decisions about people complete additional role-specific training. Training completion records are retained as evidence of AI literacy.

12. Enforcement and exceptions

Violations of this policy are handled under the Code of Conduct and may result in loss of access to AI tools or disciplinary action. Exceptions require written approval from [the AI Governance Lead] and are logged with an expiry date.

13. Policy ownership and review

Owner: [AI Governance Lead]. Approved by: [Executive Sponsor]. Effective date: [date]. Version: [1.0]. This policy is reviewed at least every six months and whenever a material change occurs in the tools we use or the laws that apply to us.

Appendix A: AI tool register (template)

How do you roll out an AI acceptable use policy?

Start with the tool register, not the prose. Survey teams or pull SSO and expense data to find what people already use, then decide which tools to bring under an enterprise agreement, which to tolerate for public data, and which to block. Publishing a policy that prohibits the tool half the sales team relies on, without offering an approved alternative, produces workarounds rather than compliance. Once the register is settled, publish the policy, run a short training that walks through three or four realistic scenarios, and put the request form somewhere people can find it in under a minute. Pair the rollout with the vendor AI questionnaire so that new tools can be approved quickly rather than accumulating in a queue.

How does the policy map to ISO 42001, NIST AI RMF, and the EU AI Act?

For ISO 42001, the policy is direct evidence for clause 5.2 (AI policy), clause 7.2 and 7.3 (competence and awareness), and Annex A controls A.2.2 (AI policy), A.4.5 (personnel AI competence and awareness), and A.8.2 (system documentation and information for users). For the NIST AI RMF, it supports GOVERN 1 (policies and procedures), GOVERN 2 (roles, responsibilities, and training), and MANAGE 4 (post-deployment monitoring, through the reporting process). Under the EU AI Act, the training requirement in Section 11 and the policy itself are your Article 4 AI literacy evidence, Section 8 covers the Article 50 transparency duties that applied from August 2, 2026, and Section 7 keeps prohibited and high-risk uses out of everyday deployment; see the EU AI Act compliance overview for the deployer obligations that follow.

Frequently asked questions

How long should an AI acceptable use policy be?

Two pages of rules plus an appendix. If the policy is longer than the tool register, people will read the register and skip the policy. Put detailed program requirements in the AI governance policy instead.

Should we ban consumer AI tools entirely?

Usually not. Bans without alternatives drive use underground. Most organizations allow consumer tools for public data, license an enterprise assistant for confidential work, and block only the tools that failed review or claim rights over inputs.

Does this policy cover AI features inside software we already use?

Only if Appendix A says so. Embedded AI features arrive through product updates rather than procurement, so the policy treats them as new tools until they are reviewed and listed.

Is an AI acceptable use policy required for ISO 42001 certification?

The standard requires an AI policy (clause 5.2 and control A.2.2) and awareness measures; it does not prescribe the document’s title. In practice, auditors expect to see both a program-level AI policy and rules that reach the workforce, and an acceptable use policy is the usual way to meet the second part.

Who should approve it?

An executive sponsor (often the CISO, general counsel, or COO) signs it, and the AI governance lead owns it. HR should review the enforcement and training sections, and legal should review the disclosure and prohibited-use sections.

How often should we update it?

Review the tool register at least every six months and the policy annually, or sooner when a major tool changes its terms, a new law applies to you, or an incident reveals a gap.

Turning the policy into evidence

A policy on a wiki page proves intent; a policy with a maintained tool register, tracked training completions, and a working request and reporting process proves control. That distinction is what an ISO 42001 auditor, an enterprise customer, or a regulator will test. Compyl keeps the AI tool register tied to your AI system inventory, assigns policy attestations and training to the right people, tracks tool requests and exceptions as tasks with owners and expiry dates, and maps the resulting evidence to ISO 42001, the NIST AI RMF, and the EU AI Act. Request a demo to see how the acceptable use policy becomes a living control rather than a document.