Your employees are already using generative AI at work. The question is whether they're following a generative AI acceptable use policy, or making up their own rules.
Someone pastes a client contract into a chatbot to get a quick summary. Someone else uploads last quarter's customer list to draft personalized emails. A third person installs a browser extension that promises to "write better emails with AI" and grants it access to their inbox. None of them meant any harm. Most of them were just trying to get their work done faster.
This is exactly why every organization needs a generative AI acceptable use policy. Not a 40-page document nobody reads, but a clear, practical set of rules that tells people which tools they can use, what data they can put into them, and what they're still accountable for.
In this article, I'll walk you through what a generative AI acceptable use policy is, why you need one now, what it should include, and how to roll it out so people actually follow it.
Spoiler: I'm offering a free Acceptable Use of Generative AI Policy template at the end of this article.
What is a generative AI acceptable use policy?
A generative AI acceptable use policy is a document that sets the rules for how employees, contractors, and partners may use generative AI tools at work. It defines which tools are approved, what data can and can't be entered into them, which uses are allowed or prohibited, and who is accountable for the output.
Think of it as the "rules of the road" for tools like ChatGPT, Claude, Gemini, Microsoft Copilot, and the AI features now built into almost every business application.
It doesn't replace your AI governance framework. It's one of the most visible pieces of it. While the framework guides how the organization governs AI, the acceptable use policy speaks directly to the people using AI every day.
Why you need a generative AI acceptable use policy now
If you're still on the fence, here are three reasons I wouldn't wait any longer.
1. Your employees are already bringing their own AI. In the 2024 Work Trend Index by Microsoft and LinkedIn, 75% of knowledge workers said they use generative AI at work, and 78% of AI users said they bring their own AI tools to work. Only 39% of users had received AI training from their company. In other words, most people are figuring out the rules on their own.
2. One copy-paste can become a data leak. In 2023, Samsung engineers accidentally leaked internal source code by uploading it to ChatGPT. The company's response was to ban generative AI tools on company devices while it worked on a secure alternative for its staff. A ban is a blunt instrument, though. Clear rules about which tools are approved and what data can go into them prevent the leak in the first place, without taking away the productivity gains.
3. Regulators expect AI literacy. Under Article 4 of the EU AI Act, organizations that provide or use AI systems have had to take measures to ensure their staff have a sufficient level of AI literacy since 2 February 2025. It applies to deployers, meaning organizations that simply use AI, not only those that build it, and national authorities begin supervising and enforcing it from 2 August 2026. An acceptable use policy, paired with training, is one of the most practical ways to show you've taken those measures. Even if the EU AI Act doesn't apply to you, the same logic holds.
The key point: the risk isn't that people use generative AI. It's that they use it without knowing where the lines are.
What to include in a generative AI acceptable use policy
Here's how I recommend structuring the policy. These are the same sections you'll find in the free template at the end of this article.
Document history
I start every policy document with its version history: what changed, when, and who approved it. Yes, most document management tools track versions, but having it in the document itself makes sure everyone knows they're reading the current version.
Purpose and scope
Explain why the policy exists in two or three sentences. Then define who it applies to (employees, contractors, volunteers, partners) and which tools it covers. Be specific here. It should cover standalone tools like ChatGPT or Claude, AI features embedded in software you already use, browser extensions, and AI agents that act on someone's behalf.
Definitions
Define the handful of terms people will trip over: generative AI, prompt, output, approved tool, AI agent, and your data classification levels. Keep the definitions short and in plain language.
Guiding principles
A few principles set the tone for everything else. Ex: we use AI to help people, not replace their judgment; we protect the data entrusted to us; we're transparent about how we use AI; and every output has a human owner.
Approved tools and how to request new ones
List the approved tools, what each one is approved for, and the most sensitive data classification it can handle. Then explain how to request a new tool. If the approval process is slow or unclear, people will simply use whatever they want, so make the request path easy.
Data rules
This is the heart of the policy, so I'm giving it its own section below.
Acceptable and prohibited uses
Give concrete examples on both sides. Acceptable: drafting and editing text, summarizing non-confidential documents, brainstorming, writing and reviewing code in approved tools. Prohibited: entering restricted data, making automated decisions about people without approval, impersonating real people, creating deceptive content, and getting around security controls.
Human review and accountability
The person who uses the output owns the output. Spell out that AI-generated content must be reviewed for accuracy, bias, and appropriateness before it's used, especially anything shared externally or used to make decisions about people.
Transparency and disclosure
State when people need to disclose that content was created with AI. Ex: always for external publications and anything presented as original research, and never presenting AI output as a real person's words.
Intellectual property, privacy, and security
Cover ownership of outputs, respect for copyright and licenses, never entering passwords or credentials, and the privacy laws that apply to personal information.
AI agents and automated workflows
This is the section most policies are missing. If a tool can take actions on someone's behalf, such as sending emails, updating records, or calling other systems, it needs to be approved and recorded in your AI agent register before it's connected to anything.
Training, incidents, and roles
Describe the training people must complete, how to report an AI-related incident or concern (and that reporting in good faith won't be punished), and who is responsible for what: the policy owner, managers, IT and security, privacy, and every user.
Compliance, exceptions, and review
Explain how exceptions are requested and approved, what happens when the policy isn't followed, and how often the policy is reviewed. With how fast this space is moving, I recommend at least once a year, or whenever a major new tool is introduced.
Acknowledgement
Finish with a short acknowledgement that people sign, confirming they've read and understood the policy.
The data rule: what can go into which AI tool
If people remember only one thing from your policy, make it this: what data they can and can't put into a generative AI tool.
The easiest way to do that is to connect the policy to the data classification scheme you already have. If you don't have one yet, this is a great reason to create it, because it's a core data governance building block.
Data classification | Example | Public AI tools (personal or free accounts) | Approved enterprise AI tools |
|---|---|---|---|
Public | Published reports, website content | Allowed | Allowed |
Internal | Internal procedures, meeting notes without sensitive details | Not allowed | Allowed |
Confidential | Contracts, financials, customer or employee personal information | Not allowed | Only in tools approved for confidential data, for an approved purpose |
Restricted | Health information, government ID numbers, credentials, legally privileged material | Not allowed | Not allowed unless an exception is formally approved |
The distinction between public and enterprise tools matters. Enterprise versions typically come with contractual commitments about how your data is stored, whether it's used to train models, and who can access it. Personal and free accounts usually don't give you those same assurances, so check each tool's terms before approving it.
The key point: your acceptable use policy is only as strong as your data classification. If people don't know whether something is confidential, they can't follow the rule.
How to roll out your policy so people actually follow it
A policy that sits on the intranet unread doesn't change anyone's behavior. Here's the approach I recommend.
- Write it with the people who'll use it. Involve privacy, security, legal, HR, and a few enthusiastic AI users from the business. The users will tell you very quickly which rules are unrealistic.
- Provide an approved tool before you restrict the others. If you tell people what they can't use without giving them something they can use, shadow AI will win.
- Make the data rule impossible to miss. Turn the table above into a one-page quick reference. The template includes one in Appendix A.
- Pair it with training. Short, practical, role-based sessions with real examples beat a long slide deck. Track completion, as it's also evidence of your AI literacy efforts.
- Make it easy to ask. Set up a single place to ask questions and request new tools, and answer quickly.
- Collect acknowledgements. Ask people to confirm they've read the policy, ideally as part of onboarding and the training.
- Review it regularly. Tools, features, and regulations are changing fast. Put the next review date in the document and stick to it.
Common mistakes to avoid
Some common traps I'd watch out for:
- Banning everything. It feels safe, but it pushes usage onto personal devices and accounts where you have no visibility at all.
- Naming only one or two tools. AI is now built into email, documents, CRMs, and design tools. Your policy needs to cover embedded AI features too, not just chatbots.
- Vague data rules. "Don't share sensitive data" is not a rule people can follow. Tie it to your data classification levels and give examples.
- Forgetting about AI agents. Tools that act on someone's behalf carry different risks than tools that only generate text.
- No owner and no review date. A policy written for the tools of 2024 won't fit the tools of 2026.
- Publishing it without training. People can't follow rules they don't understand.
Free generative AI acceptable use policy template
To help you get started, I've put together an Acceptable Use of Generative AI Policy template in Word. It includes:
- All the sections described above, ready for you to adapt
- Sample wording for each section, with the parts to customize highlighted in [brackets]
- The data classification table, so the data rule is clear from day one
- A section on AI agents and automated workflows
- Appendix A: a one-page do's and don'ts quick reference you can share with staff
- Appendix B: a checklist for reviewing requests for new AI tools
- An acknowledgement form
The template is a starting point, not legal advice. Have your legal, privacy, and security teams review it against the laws and regulations that apply to your organization.
If you're building out your AI governance program, you might also find these useful: the free AI Agent Register template and the AI Governance Self-Assessment in my 6 layers of AI governance article.
Frequently Asked Questions
What is a generative AI acceptable use policy?
It's a policy that sets the rules for how employees and other workers may use generative AI tools at work, including which tools are approved, what data can be entered into them, which uses are allowed or prohibited, and who is accountable for the output.
What should a generative AI acceptable use policy include?
At a minimum: purpose and scope, approved tools, data rules tied to your data classification, acceptable and prohibited uses, human review and accountability, disclosure requirements, incident reporting, roles and responsibilities, and a review cycle.
Should we ban ChatGPT and other generative AI tools?
A blanket ban is rarely effective. People tend to keep using AI on personal devices and accounts, where you have even less visibility. Providing approved tools with clear data rules is usually the better approach.
How often should a generative AI policy be reviewed?
At least once a year, and whenever a significant new tool, feature, or regulation is introduced.
Can employees enter personal information into generative AI tools?
Only if the tool has been approved for that classification of data and for that specific purpose. Personal information should never be entered into personal or free AI accounts.
Final thought
Generative AI is already part of how your people work. An acceptable use policy doesn't slow that down. It gives people the confidence to use AI well, because they know where the lines are.
Keep it short, tie it to your data, give people tools they're allowed to use, and update it as often as the technology changes. And as with any good governance document, communicate it more than you think you need to.
