AI Acceptable Use Policy Template

1. Purpose

This policy explains how staff at [Company name] may use artificial intelligence (AI) tools, such as ChatGPT, Microsoft Copilot, Google Gemini and Claude, safely and responsibly. AI can save time, but it can also expose confidential information, produce inaccurate results and create legal risk if used carelessly.

2. Who this policy applies to

This policy applies to all employees, contractors, temporary staff and anyone else who uses AI tools for [Company name] work, on company or personal devices.

3. Approved AI tools

Only use the AI tools listed below for work, signed in with your work account. Do not use personal or free accounts for company work, as these may keep or learn from what you type.

• [Tool name, e.g. Microsoft 365 Copilot] for [purpose]
• [Tool name, e.g. ChatGPT Team or Enterprise] for [purpose]
• To request a new AI tool, contact [name or role]. Do not install AI browser extensions, plug-ins or apps without approval.

4. What you can use AI for

• Drafting and improving emails, documents and marketing copy
• Summarising long documents, meetings or research you are allowed to access
• Brainstorming ideas, outlines and first drafts
• Analysing data that does not identify people or contain confidential information

5. What you must never put into AI tools

Unless a tool has been specifically approved for it in section 3, never enter:

• Personal data about clients, customers or staff, such as names with contact details, addresses, dates of birth, ID numbers or health information
• Client confidential information, including anything covered by a contract or non-disclosure agreement
• Financial information, such as bank details, card numbers or unpublished financial results
• Passwords, security codes, access keys or details of our IT systems
• Commercially sensitive information, such as pricing strategy, legal matters or plans that have not been made public

6. Checking what AI produces

AI tools can be confidently wrong. You are responsible for any AI-assisted work you use or send.

• Check facts, figures, names and references before relying on them
• Have a person review anything sent to clients or published
• Watch for biased, inappropriate or out-of-date content
• Do not present AI output as professional advice without checking it yourself
• Make sure AI-generated content does not copy other people's work

7. Being open about AI use

Tell clients when AI has played a significant part in work we deliver to them, if they would reasonably expect to know or if our contract with them requires it. Do not use AI to impersonate a real person.

8. Meetings and recordings

Do not use AI note-takers or recording tools in meetings unless everyone attending has been told and agrees. Store transcripts in the same way as other confidential documents.

9. Security

• Use multi-factor authentication on every AI account
• Do not connect AI tools to company email, files or systems without approval from [name or role]
• Treat links, files and instructions produced by AI with the same caution as any other content

10. Mistakes and incidents

If you think personal or confidential information has been entered into an AI tool by mistake, tell [name or role] straight away. Early reporting matters: some data breaches must be reported to the Information Commissioner's Office within 72 hours. You will not be blamed for reporting honestly.

11. Policy owner and review

This policy is owned by [name or role] and will be reviewed every [6 or 12] months, or sooner if our tools or the law change. Breaches of this policy may be handled under our disciplinary procedure.

Policy version: [1.0]. Last reviewed: [date].