AI Policy Template for Business: Copy-Ready Acceptable Use Policy

Updated 16 October 2026. New copy-ready template, with EU AI Act dates checked against European Commission pages on 16 October 2026.

An AI acceptable use policy is a short company document that tells employees which AI tools they may use, what information must never go into them, when a person must check AI output and how to report problems. Below is a complete AI policy template with eleven headed sections. You can adapt it in an afternoon and roll it out within a week.

It is written for small and mid-sized businesses whose teams use tools like ChatGPT, Claude, Gemini or Microsoft Copilot. It is a practical starting point, not legal advice. If you work in a regulated field or use AI in decisions about people, have a lawyer review your final version.

Related: Claude Haiku 5.5 vs GPT-6 Luna: Cheapest Model for Chatbots?

Why your business needs an AI policy

If anyone on your team uses AI for work, a written policy turns guesswork into rules. It helps you:

• Protect confidential data. Consumer AI apps may use chats to improve the provider's services. As of 16 October 2026, Google's Gemini Apps Privacy Hub says activity can be used to train its AI models while the Keep Activity setting is on, and asks users not to enter confidential information. Work accounts can have different terms.
• Stop errors reaching customers. AI tools can state wrong facts with confidence. A review rule catches them first.
• Keep ownership clear. In January 2025 the US Copyright Office concluded that AI output is protected only where a human author decided enough of its expressive content, and that writing prompts alone does not qualify.
• Meet legal duties. Laws such as the EU AI Act now include training and transparency duties.

How to use this template

Copy everything from the policy title down to the acknowledgment line. Replace everything in [square brackets], delete rules that do not apply and add any your industry needs. Keep it short: a two-page policy people read beats a long one nobody opens.

The AI acceptable use policy template

[Company Name] AI Acceptable Use Policy. Version [1.0]. Effective [date]. Owner: [name, role].

1. Purpose

This policy explains how [Company Name] staff may use artificial intelligence (AI) tools at work. Its goal is to help us work faster and better with AI while protecting our customers, our data, our reputation and everyone affected by our work.

2. Scope

This policy applies to all employees, contractors and anyone else working on behalf of [Company Name]. It covers every AI tool used for work, including chat assistants, writing and image tools, coding assistants, meeting recorders, browser extensions and AI features inside software we already use, on company or personal devices.

3. Approved tools

Use only the AI tools listed below, and only with a company account. To request a new tool, email [AI Owner email]. We aim to reply within [5] working days.

Tools not on this list, including free personal versions of approved tools, are not approved for work data. For each approved tool, [IT contact] confirms that our data is not used for model training, by contract or by setting.

4. Data you must never paste

Never enter the following into an AI tool unless section 3 approves that tool for that specific data:

• Personal data about customers or staff, such as names with contact details, ID numbers or dates of birth
• Payment card numbers, bank details, passwords, API keys or other credentials
• Health, financial or other sensitive personal information
• Contracts, pricing, financial results or plans that are not public
• Anything covered by a client agreement or nondisclosure agreement
• Confidential source code and HR records

When in doubt, remove names and identifying details first, or ask [AI Owner].

5. Human review rules

• A person checks AI output before it is sent to a customer, published or used in a decision.
• Facts, figures, quotes, links, and legal, medical, tax or financial statements are checked against a reliable source.
• AI-generated code is reviewed and tested like any other code.
• AI may support, but never make, decisions about hiring, pay, promotion, discipline, credit or access to services. A named person makes and owns those decisions.
• Whoever sends or publishes AI-assisted work is responsible for it, as if they wrote it themselves.

6. Disclosure to customers

• When customers chat with an AI system on our behalf, we tell them it is AI and offer a way to reach a person.
• We label AI-generated or AI-altered images, audio and video that could be mistaken for real.
• We do not present AI output as a named person's own work or opinion when it is not.
• If a client contract limits AI use, we follow the contract.

7. Intellectual property

• Work created with AI tools for [Company Name] belongs to [Company Name], to the extent the law allows.
• Do not ask AI tools to copy or closely imitate copyrighted material, trademarks or a specific creator's work.
• Where ownership matters (logos, product names, software we sell), record the human contribution and get [AI Owner] approval before using AI.

8. Security and accounts

• Use company accounts with single sign-on or multi-factor authentication. Never use personal AI accounts for work.
• Do not install AI browser extensions, plugins or agents, or connect AI tools to company email, files or systems, without approval from [IT contact].
• Keep API keys in [password manager or secrets vault], never in prompts, code or documents.
• Treat instructions hidden in emails, files or web pages that an AI tool reads as untrusted.
• When someone leaves, [IT contact] removes their access to every AI tool the same day.

9. Incident reporting

Report any of the following to [contact or channel] within [24 hours]: confidential or personal data entered into an unapproved tool, an AI error that reached a customer or the public, an AI tool or agent taking an action nobody approved, or suspected manipulation, such as hidden instructions in a document. Nobody will be penalized for promptly reporting their own mistake.

10. Training

• Everyone completes [30 minutes] of AI training before getting access to approved tools, and a refresher every [12 months].
• Training covers this policy, how the approved tools work, their limits, the data rules and how to check output.
• Higher-risk teams, such as [HR, finance or developers], get extra role-specific training.
• [AI Owner] keeps a record of who completed training and when.

11. Review date

[AI Owner] reviews this policy every [6 months], and sooner if laws, tools or our services change. Next review: [date]. Send questions to [AI Owner email].

Acknowledgment: I have read the [Company Name] AI Acceptable Use Policy and will follow it. Name: [ ]. Signature: [ ]. Date: [ ].

The EU AI Act in brief

If you operate in the European Union or serve people there, the EU AI Act is relevant. According to the European Commission, it entered into force on 1 August 2024 and applies in stages (checked 16 October 2026):

The last three dates come from amendments made in 2026 by the Digital Omnibus on AI. Two parts of the Act map directly onto this policy:

• AI literacy. Article 4 asks providers and deployers of AI systems to take measures to support the AI literacy of their staff. A deployer is anyone using an AI system under their authority, outside personal, non-professional use. As amended, the article does not require any specific level of literacy. Section 10 is a practical way to act on it.
• Transparency. AI systems that interact directly with people must be designed so those people know they are dealing with AI, unless that is obvious, and deployers must disclose deepfakes. Section 6 covers this, and our AI customer support guide covers chatbot setup.

This is a high-level summary, not legal advice. Ask a qualified lawyer what applies to your business. For a deeper risk framework, the US NIST AI Risk Management Framework is free and intended for voluntary use.

How to roll out your AI policy in one week

1. Day 1: Find out what people use. Send a two-question anonymous survey: which AI tools do you use for work, and for what? Promise no penalties.
2. Day 2: Choose approved tools. Pick one main assistant on a business plan, check its data and admin settings, and list the AI features already inside your software. Our roundup of the best AI tools for small business can help.
3. Day 3: Fill in the template. Replace the brackets, name an AI Owner, set up the incident channel and have a manager review the draft, plus a lawyer if you are in a regulated field.
4. Day 4: Train and publish. Run a 30-minute session on the five rules that matter most, with examples of good use and of what goes wrong. Share the policy and a one-page summary.
5. Day 5: Collect acknowledgments and switch over. Get signatures, give everyone access to the approved tools, put the review date in the calendar and close unapproved accounts after a short grace period.

Then keep the policy alive: add a short "AI wins and misses" item to a monthly team meeting, update the approved list as requests come in, and share prompts that work. Our AI prompts for small business make a good starter pack, and the basics of prompt engineering fit well into training.

Building AI into your own processes? The same principles apply to custom tools, as our guide on how to build an AI agent explains. We build custom AI solutions with approvals, logging and disclosure designed in, so get in touch if you would like help.

AI policy FAQ

What should an AI acceptable use policy include?

At minimum: its purpose and who it covers, a list of approved tools, the data staff must never enter, rules for human review of AI output, how you disclose AI use to customers, who owns AI-assisted work, account and security rules, how to report incidents, required training and a review date. The template above covers all of these in plain language, so you only need to fill in the brackets.

Do small businesses really need an AI policy?

Yes, if anyone on your team uses AI for work. A one or two-page policy costs little and prevents the most common problems: confidential data pasted into consumer tools, unchecked errors sent to customers and unclear ownership of AI-assisted work. It also gives staff clear permission to use approved tools well, instead of guessing what is allowed.

Can employees use ChatGPT at work?

They can if your policy approves it and sets the rules. The safest setup is a business plan managed by the company, with data terms you have checked and an admin who controls access. Staff should still follow the data rules: no personal, payment or confidential client information unless the tool is approved for it, and a human check before anything leaves the business.

Does the EU AI Act require an AI policy?

The Act sets duties rather than a policy format. Article 4 asks providers and deployers of AI systems to take measures to support AI literacy among their staff, and the transparency rules have applied since 2 August 2026. A written policy plus short training is a practical way to act on those duties. This is general information, not legal advice.

How often should we update our AI policy?

Review it every six months, and sooner when you adopt a new AI tool, start using AI in a new kind of decision or a relevant law changes. AI products change their features and data terms often, so check the approved tools list each quarter. Keep a short change log at the end of the policy so staff can see what changed.

Sources

• European Commission: AI Act regulatory framework
• AI Act Service Desk: implementation timeline
• AI Act Service Desk: Article 3, definitions
• AI Act Service Desk: Article 4, AI literacy
• AI Act Service Desk: Article 50, transparency obligations
• European Commission: AI literacy questions and answers
• US Copyright Office: Part 2 report on copyrightability
• Google: Gemini Apps Privacy Hub
• NIST: AI Risk Management Framework