An AI acceptable-use policy for employees: a practical template

Your employees are already using AI, with or without your blessing. Someone summarizes contracts in a personal chatbot, someone drafts proposals with customer data, someone pastes internal code into a free tool. Banning everything does not work, because people simply hide it. Leaving it unmanaged does not work either, because the risk is yours. The answer is a short, clear policy that people can actually follow.

Three principles to anchor the policy

• AI assists; people are accountable. Whoever uses the tool owns the output they deliver.
• Sensitive data stays inside approved boundaries.
• Transparency beats punishment. People ask when unsure and report mistakes quickly.

The template: essential sections

Two to three pages is usually enough for a small or mid-sized company. Use this structure and adapt it.

1. Purpose and scope

State who it covers (employees, contractors, interns, freelancers) and which tools (chatbots, AI features inside existing software, image generators, agents and automations).

2. Approved tools

List sanctioned tools, the plan tier you pay for (company accounts, never personal ones) and an owner for each. Provide a simple path to request a new tool, with an answer in days, not months. If approval is slow, people route around it.

3. Data classification

Three levels are easy to remember:

• Public: fine in any approved tool.
• Internal: only in approved tools under a business agreement.
• Restricted: customer personal information, health or financial records, credentials, trade secrets and confidential contracts. Only with explicit sign-off from the data owner and, wherever possible, anonymized.

4. Prohibited uses

• Entering passwords, API keys, tokens or payment card data into any prompt.
• Using personal accounts or unapproved tools with company or customer data.
• Making decisions about people (hiring, firing, credit, performance reviews) based solely on AI output. Several US jurisdictions already regulate automated employment decision tools, so check the rules where you operate.
• Impersonating real people or producing deceptive content.
• Disabling security controls to make an AI tool work.

5. Accountability for output

Anything AI-generated must be reviewed by a person before it reaches a customer, partner or the public. Verify numbers, quotes, legal references and code, because models are wrong with confidence. Decide also when you will disclose AI use, for instance in client deliverables.

6. Intellectual property and confidentiality

Do not feed third-party protected material into tools without the right to do so, and check licenses on generated code and text. Remind staff that work produced with AI on company time follows the same IP and confidentiality terms as any other work, as set out in their agreements.

7. Incidents and questions

If someone pasted something they should not have, they report it right away, with no penalty for reporting. The sooner security knows, the easier it is to contain, and some state breach laws carry strict notification clocks. Name one channel, such as a dedicated email address or Slack channel.

Rolling it out so it is not forgotten

1. Name an owner with real authority: IT lead, operations head or a founder.
2. Write in plain English with examples from each department showing what is and is not okay.
3. Offer an approved alternative before you ban. If the sales team needs meeting summaries, give them a safe tool for it.
4. Train for 45 minutes using real company scenarios, and record each person’s acknowledgment.
5. Review quarterly. Tools and risks move fast, and a policy written last year is already stale.

Hypothetical example

A 60-person distributor approves a company-managed assistant for its sales team to draft proposals and summarize calls, bans uploads of spreadsheets containing customer financials or Social Security numbers, and opens a questions channel. Within two months personal-account usage drops, because the official tool is better and easier. The numbers are illustrative, but the mechanism is real: security that makes work easier is the security that sticks.

Finally, align the policy with your customer contracts, your cyber insurance requirements and your AI vendors’ terms. Treat this template as a starting point and have counsel review it before you make it official.

One last point: a policy does not replace conversation. Set aside five minutes in team meetings to share uses that worked and mistakes that were caught. That exchange teaches more than any document, and it signals that the company wants AI used, just used carefully. It also surfaces new tools people are trying, so you can approve or redirect them early instead of discovering them after a problem. Add a short note to your onboarding checklist so new hires read and acknowledge the policy in their first week.

Want to put this to work? Convertty’s senior team runs an AI assessment of your workflows and delivers an implementation plan with 30-day quick wins. Book a call.