AI Acceptable Use Policy: What to Include (With Template)

What is an AI acceptable use policy?

An AI acceptable use policy is an internal document that defines which AI tools employees and contractors may use, what data may be entered into them, how AI-generated output must be reviewed before use, and what happens when the rules are broken. It is the foundational artifact of an AI governance program — the piece everything else builds on.

Before you build a complex AI risk registry or tackle EU AI Act compliance, you need basic alignment on employee behavior. If your engineers are pasting customer code or sensitive API payloads into unvetted public LLM helpers, your company faces immediate data leakage risk — and an awkward silence when an enterprise buyer's AI security questionnaire asks "Do you have a documented policy governing employee use of AI tools?"

A good policy is short enough to be read (2–3 pages), specific enough to be followed (named tools, concrete data categories), and maintained enough to be trusted (a named owner and a review cadence). The template later in this article gives you all three.

Why do you need an AI acceptable use policy now?

Three forces converge in 2026: Article 4 AI literacy obligations already apply, Article 50 transparency obligations apply from August 2, 2026, enterprise buyers routinely ask for an employee AI policy, and unmanaged "shadow AI" usage keeps growing. A written policy is the cheapest, fastest response. Under the May 2026 political agreement, high-risk rules are scheduled later; the revised dates are not yet part of the original Regulation text. (Source: European Commission AI Act overview)

In more detail:

• EU AI Act — AI literacy (Article 4): Since February 2, 2025, providers and deployers must ensure a sufficient level of AI literacy among staff dealing with AI systems. An acceptable use policy plus training and acknowledgment records is the standard way to evidence this.
• EU AI Act — deployer obligations (Article 26): If any tool your team uses qualifies as a high-risk system under Annex III (e.g., AI-assisted candidate screening), deployer duties include use per instructions, competent human oversight, and operation monitoring. Under the May 7, 2026 political agreement, rules for systems in certain high-risk areas are scheduled for December 2, 2027, while product-integrated high-risk rules are scheduled for August 2, 2028; final legal adoption is not yet complete. Your policy is where those duties get assigned to real people. Non-compliance with high-risk obligations can draw fines of up to EUR 15 million or 3% of global annual turnover (Article 99(4)). (Source: European Commission high-risk guidance)
• Buyer due diligence: AI sections in vendor security questionnaires increasingly ask for the employee AI policy by name. Having a versioned, approved PDF ready shortens security review cycles; scrambling to write one mid-deal extends them.
• Shadow AI: Without an approval path, employees adopt AI tools on personal accounts where you have no visibility, no data processing agreement, and no retention guarantees. A policy with a fast Tier system channels that demand into vetted tools.
• Framework alignment: ISO/IEC 42001 requires a documented AI policy as part of the management system, and the NIST AI RMF GOVERN function starts with exactly this artifact. Writing it now gives you a head start on both.

What should an AI acceptable use policy include?

A complete AI acceptable use policy contains nine sections: purpose and scope, a tiered catalog of approved tools, data isolation rules, code generation review requirements, an approval workflow for new tools, incident reporting procedures, training and acknowledgment, a periodic review cadence, and enforcement consequences. The table below explains what each section does and the mistake teams most often make with it.

Corporate AI Acceptable Use Policy Template (MIT-Licensed)

Copy and adapt the template below. Replace all bracketed items [like this] with your company details, then have qualified legal counsel review before adoption.

How do you roll out an AI acceptable use policy?

Rollout is a seven-step process: inventory current AI usage, customize the template, get legal and executive sign-off, announce it with training, collect acknowledgments, wire the approval workflow into an existing channel, and calendar the first review. Most mid-size teams complete this in two to three weeks.

1. Inventory current AI usage first. Before writing tier lists, survey the team (anonymously if needed) about which AI tools they actually use. Policies written against imagined usage miss the real risks; you will almost certainly discover tools you didn't know about.
2. Customize every placeholder. Name the exact tools in each tier, the real security contact, and concrete deadlines. A policy that still says [COMPANY] in paragraph three tells employees nobody read it — including you.
3. Get formal sign-off. Have legal counsel review the customized text, then have an executive sponsor approve it. Record both approvals with dates; buyers and auditors ask who approved the policy and when.
4. Announce with training, not just a link.A 20–30 minute session covering the tier system, the data isolation rules, and — critically — the approval path for new tools. This session doubles as your EU AI Act Article 4 AI literacy evidence.
5. Collect signed acknowledgments. Use your HR system or document tool to track who has acknowledged the policy. Chase stragglers. An acknowledgment log is one of the first artifacts requested in enterprise security reviews.
6. Make the approval workflow real. Create the actual request channel (a form, a Slack workflow, an email alias) and honor the response deadline in Section 6. If requests take a month, employees stop asking and shadow AI returns.
7. Calendar the first review now. Put the 6- or 12-month review date in the Policy Owner's calendar before you publish. Then store the approved PDF in your evidence vault so it can be attached to questionnaire responses immediately.

How does this policy fit into your broader AI governance program?

The acceptable use policy is the first of several governance artifacts; it governs employee behavior, while an AI inventory, risk classifications, and framework mappings govern the systems themselves. Each major framework expects the policy and builds outward from it:

• EU AI Act: The policy operationalizes Article 4 (AI literacy) and assigns the human oversight and monitoring duties in Article 26 for any high-risk systems you deploy. Next, classify every AI system you use against Annex III — our free deployer assessment walks through that in about 2 minutes — then work the full EU AI Act compliance checklist.
• ISO/IEC 42001: The standard requires a documented AI policy as part of the AI management system, and several of the 38 Annex A controls (covering areas like resources for AI systems, impact assessment, and use of AI systems) assume one exists. See our ISO 42001 compliance guide.
• NIST AI RMF: The GOVERN function calls for policies, processes, and accountability structures for AI risk — this policy is the natural first deliverable. Our practical NIST AI RMF guide shows where it slots in.
• Sales enablement: Once approved, the policy becomes a reusable answer for the employee-AI-use section of every security questionnaire you receive.

Frequently Asked Questions

Is an AI acceptable use policy required by the EU AI Act?

Not by that name — the Act never mandates a document called an "acceptable use policy." But Article 4 (AI literacy) and, for deployers of high-risk systems, Article 26 (use per instructions, competent oversight, monitoring) are difficult to evidence without one. Regulators and auditors expect to see how obligations are assigned to people, and this policy is the standard vehicle.

Who should own the policy?

One named person — typically the security lead or CISO, or the CTO in smaller companies. The owner maintains the tool catalog, handles Section 6 approval requests, and runs the periodic review. Ownerless policies decay fast because nobody re-tiers new tools as they appear.

Can we just ban public AI tools entirely?

You can, but it rarely works. Employees who find AI genuinely useful will route around a ban with personal accounts and devices, and you lose all visibility. A tiered policy with a fast approval path converts that demand into vetted usage you can actually see and govern — and gives you a stronger questionnaire answer than "we prohibit it" (which sophisticated buyers read as "we don't know what our employees do").

Does this policy cover AI features we build into our product?

No — this template governs employee use of AI tools. AI features you ship to customers need separate treatment: risk classification under the EU AI Act, model documentation, Article 50 transparency where applicable from August 2, 2026, and the relevant provider or deployer obligations if high-risk. Under the May 2026 political agreement, rules for systems in certain high-risk areas are scheduled for December 2, 2027 and product-integrated high-risk rules for August 2, 2028. Start with the Annex III classification guide.

How often should we review it?

Every 6–12 months on schedule, plus after trigger events: a new tool category enters use, an approved vendor changes its data terms, an incident occurs, or regulation changes. Record every review with date, reviewer, and version number.