What is an AI acceptable use policy?

An AI acceptable use policy sets out which AI tools staff may use, what data may be entered into them, how AI output must be checked, and who approves exceptions. Its practical job is to stop confidential and personal data from leaking into AI services the organization does not control, and to make sure a person stays accountable for anything AI produces. A workable policy names permitted tools explicitly rather than describing categories, and it now has to cover AI agents that act, not just chatbots that answer. It sits underneath the governance structures described in ISO/IEC 42001 and supports the obligations of the EU AI Act.

AI acceptable use policy: definition and scope

An AI acceptable use policy (AUP), sometimes called a generative AI use policy, is the staff-facing rule set for using AI at work. It applies to employees, contractors and anyone else acting for the organization, on any device, whenever organizational data or work product is involved.

It is narrower than an AI governance policy. The governance policy sets principles, roles, risk classification and approval processes for every AI system the organization builds or buys. The AUP translates that into what an individual may and may not do in daily work. See what is AI governance for how the two fit.

A good AUP is short (four to eight pages), concrete (names tools and data types), and backed by technical controls.

What counts as AI under the policy

The definition needs to be broad enough to catch what staff actually use. The most defensible definition is the OECD wording adopted in Article 3(1) of the EU AI Act: a machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions. Ontario's public sector law uses almost the same words.

The policy then lists the forms AI takes, because staff do not think of all of these as "AI":

• Standalone assistants. ChatGPT, Claude, Gemini, Copilot, Perplexity and similar, on the web, desktop or mobile.
• AI embedded in licensed software. Copilot in Microsoft 365, Gemini in Google Workspace, AI features in CRM, HR, design and ticketing tools. These are often switched on by vendor update.
• Meeting and note-taking bots that join calls, record and summarize.
• Browser extensions and AI browsers that read every page the user visits.
• Coding assistants in the IDE or terminal.
• AI agents and automations that take actions: send email, update records, run code, call APIs, often through connectors or Model Context Protocol (MCP) servers.
• Custom models and API use built by internal teams. These usually fall under development standards, but the AUP should point to them.

Why an AI acceptable use policy matters

Usage is ahead of control. Netskope's Cloud and Threat Report 2026 found generative AI users tripled and prompts grew sixfold in a year. 47% of users still access these tools through personal, unmanaged accounts. The average organization recorded 223 incidents a month of users sending sensitive data to AI apps. The data most often involved was source code (42%), regulated data such as personal, financial or health information (32%) and intellectual property (16%).

Use is often hidden. KPMG and the University of Melbourne's 2025 global study of more than 48,000 people found 48% of employees had uploaded company information into public AI tools, 57% had hidden their use of AI or presented AI work as their own, and 66% relied on AI output without checking its accuracy.

Shadow AI has a measurable cost. In IBM's 2025 Cost of a Data Breach study, one in five organizations reported a breach due to shadow AI. Organizations with high levels of shadow AI had breach costs about US$670,000 higher, and only 37% had policies to manage AI or detect shadow AI.

Consumer terms are not enterprise terms. Several providers train on consumer-tier inputs unless the user opts out. Anthropic's 2025 consumer terms, for example, apply training and up to five-year retention to Free, Pro and Max accounts by default, while its commercial and API terms exclude training.

Prompts are records. In 2025 a US federal court ordered OpenAI to preserve ChatGPT output logs in the New York Times copyright case (summary). Anything typed into an AI tool can be retained, subpoenaed or breached. See AI lawsuits.

The organization owns the output. In Moffatt v. Air Canada, 2024 BCCRT 149, the airline was held responsible for wrong information its chatbot gave a customer. The same logic applies to an employee who sends AI-drafted advice to a client.

Specific laws now reach everyday use. The EU AI Act's AI literacy duty and Article 50 labelling rules, Ontario's job posting disclosure, and US state rules on AI in hiring and consequential decisions all depend on staff behaviour that only an AUP and training can shape. They are covered under compliance below.

The key elements of an AI acceptable use policy

Definition of AI and its scope

State who the policy covers (employees, contractors, temporary staff, third parties with system access), what AI it covers (use the definition and list above), and where (any device, including personal ones, when work data is involved). Exclude what is governed elsewhere, such as model development, and point to that standard.

Approved tools and tiers

This is the core of the policy. Keep the tool list in a register linked from the policy so it can change without re-approval. Use three tiers:

• Approved. Enterprise-licensed, SSO-enforced, with contractual no-training, defined retention and data residency terms, and a security review on file.
• Limited. Allowed for public or low-sensitivity internal information only, such as a public-web research tool.
• Prohibited. Everything not listed, plus named tools that failed review. Personal accounts on any AI service are prohibited for work data.

Tiers are then mapped to the organization's data classification:

Data class	Approved tools	Limited tools	Personal / unapproved
Public	Yes	Yes	No work use
Internal	Yes	No	No
Confidential (client, financial, source code)	Yes, if the tool's approval covers this class	No	No
Restricted (personal health, payment card, credentials, legal privilege, regulated personal information)	Only tools specifically approved for that data, with a documented assessment	No	No

Ethical principles and values

Keep this short and operational. Three or four commitments that staff can apply: people remain accountable for decisions; AI is not used to deceive; AI is not used to discriminate or make consequential decisions about people outside an approved process; human dignity and privacy are respected. Link to the organization's broader responsible AI principles rather than restating them.

Data collection and usage

• Minimize. Enter only the data the task needs. Remove names and identifiers where the task does not require them.
• Respect lawful basis and purpose. Using personal information in a new AI tool may be a new purpose under PIPEDA, Quebec's Law 25 or the GDPR. Consent is one basis, not the only one; check with privacy before using personal information in a new way. See AI privacy.
• No uploads of others' confidential material (client documents, third-party data under NDA) unless the contract permits it.
• Retention. Turn off chat history or memory where the approved tool allows it for sensitive work, and do not store AI outputs containing personal information outside approved systems.

Transparency and explainability

• Understand the tool. Staff using AI for a decision about a person must be able to explain the decision without saying "the AI said so".
• Tell people when they deal with AI. Customer-facing chatbots and AI-generated communications must be disclosed. This is a legal duty in the EU under Article 50 from 2 August 2026.
• Automated decisions. Where AI materially influences a decision about an individual, follow the notice and explanation process. Quebec's Law 25 requires notice for exclusively automated decisions now; Colorado SB 26-189 requires pre-use notice and adverse-outcome explanations from 1 January 2027.

More on AI transparency.

Output verification

This element is often missing from templates, and unchecked output is a frequent cause of incidents.

• Users own what they send. Any AI output used in work is the user's responsibility as if they had written it.
• Verify before reliance. Check facts, figures, citations, code and legal or financial statements against a reliable source. Fabricated citations have led to sanctions against lawyers in several jurisdictions.
• Higher stakes, more review. Client advice, regulatory filings, public statements and code merged to production require a second human review.
• No AI-only decisions about people outside an approved, assessed process with meaningful human oversight.

Disclosure and labelling

• Synthetic media. Do not create or share deepfakes of real people without consent and approval. Label AI-generated or manipulated images, audio and video. EU AI Act Article 50(4) requires deployers to disclose deepfakes, and the Commission's 2026 Code of Practice and guidelines set out how.
• Public-interest text. AI-generated text published to inform the public on matters of public interest must be labelled under Article 50(4) unless a person has reviewed it and taken editorial responsibility.
• Hiring. Where AI screens, assesses or selects applicants, follow the disclosure rules. Ontario employers with 25 or more employees must disclose this in publicly advertised job postings from 1 January 2026.
• Internal honesty. Disclose material AI assistance to the manager or client where the work product is represented as expert human work, or where a contract requires it.

AI agents and automation

Agents move the risk from "what did it say" to "what did it do". Typical rules:

• Approved platforms only. Agents, AI browsers and connectors (including MCP servers) must be approved like any other tool.
• Own credentials, least privilege. Agents run on their own scoped service identities, never on an employee's personal credentials or broad admin tokens.
• Human approval for consequential actions. Payments, external emails, contract or price changes, deleting data, changing access rights and merging code always require a person to approve.
• Untrusted input. Treat any content an agent reads (web pages, email, shared files) as potentially hostile. Indirect prompt injection can hijack an agent through a document it was asked to summarize. See AI attacks.
• Owner, inventory, logs and an off switch. Every agent has a named owner, appears in the AI inventory, logs its actions and can be stopped.

These align with the OWASP Top 10 for Agentic Applications and Singapore's Model AI Governance Framework for Agentic AI, which both centre on bounding an agent's authority and keeping a human meaningfully accountable.

Prohibited uses

List them plainly. Typical entries:

• Any practice prohibited by EU AI Act Article 5, including manipulative or exploitative techniques, social scoring, emotion recognition in the workplace (except for medical or safety reasons), and untargeted scraping of facial images.
• Making or materially influencing hiring, promotion, termination, credit, insurance or similar decisions outside an approved, assessed process.
• Covert monitoring or profiling of employees or customers.
• Creating deceptive content, impersonating real people, or generating sexual or harassing content.
• Uploading credentials, secrets, encryption keys or source code to non-approved tools.
• Using AI to bypass security controls, licensing terms or other policies.

Accountability and oversight

Name the policy owner (one executive), the approving body for exceptions (the AI governance committee), and the responsibilities of managers, IT and security, privacy, legal, HR and every user. A RACI in an appendix is enough. More on AI accountability.

Security and privacy

• Access only through SSO for approved tools, with MFA.
• No sharing of accounts or API keys.
• Report suspicious behaviour such as a tool asking for credentials, unexpected agent actions, or outputs that reveal other users' data.
• Vendor review of new AI tools before use: data use and training terms, retention, sub-processors, residency, security certifications (including ISO/IEC 42001 where offered) and incident notification.

More on AI security and the OWASP Top 10 for LLMs.

Compliance with laws and regulations

The regimes that commonly apply, and what each means for users (status as of October 2026):

• EU AI Act. AI literacy (Article 4) since 2 February 2025; transparency and labelling (Article 50) since 2 August 2026; high-risk deployer duties, including human oversight by competent staff, from 2 December 2027 for Annex III systems. The Digital Omnibus (Regulation (EU) 2026/1744) changed Article 4 from ensuring "a sufficient level of AI literacy" to taking "measures to support the development of AI literacy", and states that no specific level must be guaranteed for any individual. The duty is softer, but it still applies to deployers.
• Privacy law. PIPEDA (and Bill C-36 if enacted; tabled June 2026, not law as of October 2026, with a long transition expected), Quebec's Law 25, the GDPR and US state privacy laws, including California's CPPA rules on automated decision-making technology from 1 January 2027.
• Employment law. Ontario's job posting disclosure; the California Civil Rights Council's automated decision system rules (since 1 October 2025); Illinois Public Act 103-0804 (since 1 January 2026); New York City Local Law 144 bias audits; Colorado SB 26-189 notices and human review from 1 January 2027.
• Sector rules. For example OSFI Guideline E-23 for federally regulated financial institutions from 1 May 2027, and the Treasury Board Directive on Automated Decision-Making and its Guide on the use of generative AI for federal institutions.
• Intellectual property and confidentiality. Contract terms, copyright and trade secret law. Do not enter third-party content without the rights to do so, and check licence terms before using AI output commercially.

Sample AI acceptable use policy clauses

The clauses below are written to be enforceable rather than aspirational, and are adapted to each organization.

1. Approved tools. You may use AI tools for work only if they are listed in the AI Tool Register. Using personal accounts on any AI service for organizational data is prohibited.

2. Data. You may enter information into an AI tool only up to the data classification the Register approves for that tool. Restricted data may be entered only into tools specifically approved for it.

3. Responsibility. You are responsible for any AI output you use, share or act on. You must check it for accuracy, completeness, bias and confidentiality before relying on it.

4. Decisions about people. You must not use AI to make or materially influence decisions about an individual's employment, credit, insurance, access to services or legal rights, except through a process the AI Governance Committee has approved.

5. Disclosure. You must disclose AI use where the law, a contract or this policy requires it, and you must label AI-generated or manipulated images, audio and video depicting real people or events.

6. Agents. You may connect an AI agent to organizational systems only through an approved platform, using credentials issued for that agent. Payments, external communications, deletions, access changes and production code changes require human approval.

7. Exceptions. Requests to use an unlisted tool or to go beyond these rules go to the AI Governance Committee through the intake form. Exceptions are time-limited and recorded.

8. Monitoring. The organization monitors use of AI services on its systems and networks to enforce this policy, in line with the employee privacy notice.

9. Reporting. Report suspected misuse, data exposure or harmful AI output to [security/privacy contact] immediately. Good-faith reports will not result in retaliation.

10. Breach. Breaches of this policy are handled under the disciplinary policy and may also be reported to regulators where the law requires.

What are the risks of not having an AI acceptable use policy?

• Data leakage of personal information, client confidential information, source code and trade secrets into services with training and retention terms the organization never agreed to.
• Regulatory exposure under privacy law, the EU AI Act's literacy and labelling duties, and employment and consumer protection rules, with no evidence that the organization took reasonable steps.
• Liability for wrong output sent to customers or relied on in decisions, as Moffatt v. Air Canada shows.
• Discrimination when AI screens candidates or customers without assessment or oversight. See bias in AI systems.
• Security incidents through malicious extensions, prompt injection and over-permissioned agents.
• No basis for discipline. Without a clear rule, it is hard to act fairly against misuse.
• Lost value. When staff are unsure what is allowed, the careful ones stop using AI and the careless ones carry on in secret.

How to develop an AI acceptable use policy

Identify stakeholders and experts

• Policy owner. One accountable executive.
• Drafting group. IT and security, privacy, legal, HR, risk and compliance, procurement, and two or three heavy AI users from the business. The heavy users add the most value because they know what is already happening.
• RACI. Define who is Responsible, Accountable, Consulted and Informed for drafting, approval, tool approvals, exceptions, training and enforcement.
• Consultation. Where a union or works council exists, or where employee monitoring is involved, consult early. Several jurisdictions require it.

Conduct a risk assessment

1. Discover actual use. Survey staff, and review SSO logs, expense claims, browser extension inventories, network or SSE logs and SaaS admin consoles for AI features.
2. List use cases such as drafting, summarizing, coding, research, customer service, hiring and analytics, and rate each by data sensitivity and impact on people.
3. Assess the tools in use against data terms, security and legal requirements.
4. Identify AI-specific risks for each use case: data leakage, inaccuracy, bias, IP, security and agent misuse. The NIST AI RMF Map function and its Generative AI Profile (NIST AI 600-1) give a structured list.
5. Decide treatment. Approve, approve with conditions, or prohibit. The results become the tool register and the rules.

Write the policy

• Lead with the rules, not the background. Staff should find what they may do on page one.
• Use the element list above as the outline, and keep principles to a paragraph.
• Separate stable from volatile. The policy holds the rules; the tool register, data matrix and approved use cases sit in linked documents.
• Write for the reader. Plain language, examples, and a one-page summary.
• Align with the information security, privacy, records retention, code of conduct and disciplinary policies, and resolve conflicts.

Approve, publish and attest

Approve through the normal governance route (executive committee or board, depending on the organization's policy framework). Publish it where people work, require acknowledgement at onboarding and on material change, and brief managers first so they can answer questions.

How to implement and monitor the AI acceptable use policy

Training, education and AI literacy

Training is now a compliance control as well as an adoption tool. Under the EU AI Act as amended in 2026, deployers must take measures to support AI literacy suited to staff roles, experience and the context of use. A practical design:

• Everyone: a 20–30 minute module on the policy, data rules, verification and reporting.
• Role-based: deeper modules for HR (hiring AI), customer service (chatbots and disclosure), developers (coding assistants, secrets, agents), and anyone overseeing AI decisions.
• Records: completion, content version and date, kept as evidence.
• Refresh: when tools or rules change, and at least annually.

Technical enforcement

Common controls:

• SSO and tenant restrictions so approved tools are used with organizational accounts.
• Secure web gateway, CASB or SSE to block, warn or coach on unapproved AI sites and personal-account logins.
• DLP on prompts and uploads for source code, credentials and regulated data.
• Browser and extension management to control AI extensions and AI browsers.
• Admin settings on approved tools: training off, retention set, connectors restricted.
• Agent controls: scoped service identities, connector allow-lists, approval gates and action logs.

IBM's 2025 data illustrates the gap: of the organizations that had AI governance policies, only 34% audited for unsanctioned AI.

Regular audits and assessments

• Quarterly: review shadow AI telemetry, DLP events and exception logs; update the tool register.
• Annually: internal audit tests design and operating effectiveness. See AI audit.
• On change: reassess a tool when the vendor changes its terms, adds agentic features or suffers an incident.
• Metrics: share of AI traffic to approved tools, personal-account use, DLP blocks, training completion, exceptions open past expiry, incidents.

Reporting and accountability mechanisms

• One channel for reporting AI misuse, data exposure, harmful output or agent misbehaviour, connected to the incident response process.
• No retaliation for good-faith reports and self-reports of mistakes. Staff who fear punishment for pasting the wrong file tend to hide it.
• Escalation of material incidents to the AI governance committee and, where required, to regulators under breach notification rules.
• Board reporting of the key metrics. See AI oversight at board level.

Continuous improvement and adaptation

Review the policy at least every six months, and immediately when a major tool is approved or retired, a vendor changes data terms, a law takes effect (as of October 2026, the next two are the end of the EU Article 50(2) grace period on 2 December 2026 and Colorado SB 26-189 on 1 January 2027), or an incident exposes a gap. Track what staff ask for through the exception process: repeated requests are a signal to approve a tool, not to keep saying no.

Common mistakes

• Principles without a tool list. Staff cannot comply with "use AI responsibly".
• A ban with no alternative. Use moves to phones and personal accounts.
• Ignoring embedded AI. The biggest exposure often arrives by vendor update to software already licensed.
• Treating agents like chatbots. An agent with a user's credentials can do anything that user can.
• No verification rule. Many reputational incidents come from unchecked output rather than data leaks.
• Writing it once. A 2023 policy does not cover 2026 tools, terms or laws.

The AISGRC AI governance scorecard checks a program's current position against these points.

Related references

• What is AI governance?
• What is AI privacy?
• Human-in-the-loop: oversight as a governance control
• What is AI accountability?
• What is an AI audit?
• OWASP Top 10 for LLMs · EU AI Act · ISO/IEC 42001

Sources and references

• Regulation (EU) 2024/1689 (Artificial Intelligence Act), EUR-Lex
• Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex
• Law & Technology, "AI literacy: the Digital Omnibus rewrites Article 4"
• Faegre Drinker, Commission final Article 50 guidelines and transparency Code of Practice (July 2026)
• Cloud Security Alliance, Article 50 watermarking grace period note
• Netskope, Cloud and Threat Report 2026
• IBM, 2025 Cost of a Data Breach press release
• KPMG and University of Melbourne, Trust, attitudes and use of AI: a global study 2025
• Anthropic, Updates to consumer terms and privacy policy
• Simon Willison, on the OpenAI log preservation order (June 2025)
• Moffatt v. Air Canada, 2024 BCCRT 149
• Colorado SB26-189
• Illinois Public Act 103-0804
• Data Protection Report, Ontario AI job posting requirements
• Government of Canada, Guide on the use of generative AI
• Treasury Board Directive on Automated Decision-Making
• Bill C-36 (45-1), first reading
• OSFI Guideline E-23
• NIST AI 600-1, Generative AI Profile
• OWASP Top 10 for Agentic Applications 2026
• Baker McKenzie, Singapore Model AI Governance Framework for Agentic AI