What an AI acceptable use policy is
An AI acceptable use policy is a short set of rules that tells your people which AI tools they can use for work, what they can and cannot put into them, and who checks the results. It sits alongside your IT, data protection and information security policies.
It is not a strategy document. Its job is simple: let people get the benefit of AI without leaking client data, breaking contracts or putting unchecked work in front of customers.
Who needs one
Any business where staff can open ChatGPT, Claude, Gemini or Microsoft Copilot in a browser. In practice, that is every business. The risk is highest where people handle:
- personal data about customers, patients, pupils or staff
- client confidential information under NDA or contract
- unpublished financials, pricing, bids or deal information
- regulated work, such as financial advice, legal work or health care
The quick test: if you asked your team tomorrow which AI tools they used last week and what they put into them, would you know the answer? If not, you need a policy.
The 10 clauses to include
Keep each clause short and practical. The free template below has wording for all ten, with brackets to fill in.
- Purpose and scope. Why the policy exists and who it covers: staff, contractors and anyone using company systems or data.
- Approved tools. A named list of AI tools people can use for work, on business accounts only. Everything else needs approval first.
- Data you must never enter. Personal data, client confidential information, passwords and access keys, unpublished financials, and anything covered by an NDA, unless the tool is approved for that data.
- Human review. A person checks every AI output before it is used, sent or published. They own the result, not the tool.
- Being open about AI. When to tell clients or colleagues that AI helped produce something, and when it must be disclosed by contract or regulation.
- Intellectual property. Who owns AI-assisted work, and a rule against using AI to copy other people's protected work.
- Security. Business accounts with single sign-on, no personal accounts for work, and settings that stop your data being used to train public models where the tool allows it.
- New tools and use cases. A simple route to request a new tool or a new use, with a named person who decides.
- Training. Short training before people use AI for work, and a refresher when the policy changes.
- Breaches and review. How to report a mistake quickly without blame, what happens next, who owns the policy and when it is reviewed.
Data rules to reflect, wherever you are
Your policy should point to the data protection law that applies to you. The main ones for UK and GCC businesses are:
| Where | Rules to check |
|---|---|
| United Kingdom | UK GDPR and the Data Protection Act 2018, the Information Commissioner's Office guidance on AI and data protection, and your sector regulator if you have one (for example the FCA). |
| Saudi Arabia | The Personal Data Protection Law (PDPL), enforced by SDAIA, and SDAIA's AI ethics principles. SDAIA has also consulted on draft responsible AI rules, so check the latest version. |
| United Arab Emirates | The federal Personal Data Protection Law, plus the separate data protection rules in the DIFC and ADGM free zones if you operate there. |
| Selling into the EU | The EU AI Act can apply to firms anywhere whose AI systems or outputs are used in the EU. |
| Anywhere else | Your country's data protection law, plus international references such as ISO/IEC 42001 and the NIST AI Risk Management Framework. |
The practical point is the same everywhere: know what personal data goes into which tool, where it is processed, and on what basis.
Roll it out in 30 days
- Week 1: find out what is happening. Run a short, no-blame survey: which tools, for what, with what data.
- Week 2: choose your approved tools. Pick one or two, set up business accounts and switch on the right privacy settings.
- Week 3: adapt the template. Fill in the brackets, get sign-off from a director, and write a one-page summary.
- Week 4: launch and train. A 30-minute session per team, with real examples from their own work. Then put the review date in the diary.
Mistakes to avoid
- Banning AI outright. It pushes use onto personal phones where you cannot see it.
- Writing it like a contract. If people need a lawyer to read it, they won't.
- No approved tools. Rules without a safe option just create guilt.
- No owner. A policy nobody owns is out of date within months.
- Stopping at the policy. A policy is one part of AI governance. The rest is a register of tools, risk checks and reporting. See the AI governance framework guide.
Questions about AI policies
Do we need an AI acceptable use policy if we haven't bought any AI tools?
Yes. Your staff are almost certainly using free AI tools already, often on personal accounts. A policy is how you find out what is happening and set safe rules before something goes wrong.
Should we just ban ChatGPT and other AI tools?
Bans rarely work. People switch to their phones and personal accounts, which is riskier. Approve one or two tools on business accounts, set clear rules, and make the safe route the easy route.
How long should an AI policy for employees be?
Short enough that people read it. Two to four pages for the policy itself, with a one-page summary of do's and don'ts that you share with every team.
Who should own the AI policy?
One named senior person, usually the person responsible for AI, operations or risk, with a board member who signs it off. Review it at least every six months, because the tools change quickly.
Is this template legal advice?
No. It is a practical starting point. Check it against your contracts, your sector rules and local data protection law, and take legal advice where the stakes are high.
This guide is general information, not legal advice. Laws and regulator guidance change, so check the current position for your business and sector.