AI Acceptable Use Policy Template (Free, Copy and Adapt)
Most companies know they need an AI policy. Few have one their employees have actually read.
The problem is usually length. A twelve-page policy written for auditors doesn't change what someone does at 4:55pm when they paste a customer email into ChatGPT to draft a reply. A one-page policy written for the people using AI every day can.
Below is a short template you can copy and adapt. It's written to be read in under five minutes, and it focuses on the decisions that actually prevent data leaks.
What a good AI policy needs to do
Before the template, a few principles that make the difference between a policy that works and one that sits in a shared drive:
- Say yes before you say no. If the policy reads as a ban, people will route around it with personal accounts. Lead with what's approved.
- Be specific about data, not just tools. "Don't share confidential information" is too vague to act on. Name the data types.
- Make it easy to ask. Give one named contact or channel for questions. Uncertainty is where most mistakes happen.
- Back it with a control. A policy without enforcement relies on everyone remembering it every time. Pair it with a technical check at the point where data is shared.
The template
Copy everything below, replace the text in [brackets], and remove anything that doesn't apply.
[Company name] AI Acceptable Use Policy
Version: [1.0] · Owner: [Name, role] · Last reviewed: [Date]
1. Why this policy exists
AI tools like ChatGPT, Claude, Gemini and Copilot can make our work faster and better. We want you to use them. This policy explains how to do that without putting our customers, colleagues or company at risk.
2. Who it applies to
Everyone who works for or with [Company name], including employees, contractors and temporary staff, on any device used for work.
3. Approved tools
You may use these AI tools for work:
- [Tool name, plan, e.g. "ChatGPT Business, company account only"]
- [Tool name, plan]
Use your company account, not a personal one. Business plans typically come with contractual data protections that personal accounts don't.
To request a new tool, contact [name or channel]. We aim to respond within [5 working days].
4. Data you must never put into any AI tool
Do not enter, paste or upload any of the following into an AI tool, even an approved one, unless [security contact] has approved a specific use:
- Payment card numbers, bank account details or other financial account data
- Passwords, API keys, access tokens, private keys or other credentials
- Government ID numbers (such as passport, national ID or social security numbers)
- Health or medical information about any person
- [Other categories specific to your business, e.g. "unreleased financial results", "client legal matters"]
5. Data you may use with care
The following may be used in approved tools only, and only when the task genuinely needs it. Where possible, replace real details with placeholders first (for example, "[Customer name]" instead of a real name):
- Customer names, email addresses and contact details
- Internal documents, plans and strategy
- Source code (never including credentials)
- Employee information
6. Your responsibilities
- Check the output. AI tools can be confidently wrong. You are responsible for anything you send, publish or act on.
- Don't present AI output as verified fact without checking it against a reliable source.
- Respect other people's rights. Don't use AI to create content that copies others' work or misrepresents real people.
- Follow our other policies. This policy sits alongside our [information security, data protection and acceptable use] policies.
7. Monitoring
To protect our customers and our company, we use tools that check prompts sent to AI services for sensitive data and may warn, mask or block them. [Describe what is logged, who can see it and how long it is kept.]
8. If something goes wrong
If you think you've shared data you shouldn't have, tell [name or channel] straight away. Reporting quickly matters far more than the mistake itself, and you won't be penalised for reporting an honest error.
9. Questions
Not sure whether something is allowed? Ask [name or channel] before you share it.
How to roll it out
A policy only works if people know it exists. A simple rollout:
- Get sign-off from leadership and whoever owns data protection or legal in your organization.
- Announce it in plain words. A short message from a senior leader explaining why lands better than a link to a document.
- Ask for acknowledgement. A one-click "I've read this" in your HR or learning system creates a record.
- Put a control behind it. Training fades. A warning that appears at the moment someone is about to paste sensitive data reinforces the policy exactly when it matters.
- Review it every six months. AI tools change quickly. Add new tools as you approve them and adjust the data rules based on what you actually see.
Turning the policy into a control
Sections 4 and 5 of the template map directly onto data categories and actions. That's how Nura works: you choose, for each type of sensitive data, whether to allow, warn, mask or block it, per team and per AI tool. When someone tries to send something your policy forbids, they see the reason at that moment, and the event is logged for your records.
The policy tells people what to do. The control makes sure it happens.
This template is a starting point, not legal advice. Have it reviewed against the laws and regulations that apply to your organization.