AI Acceptable Use Policy Template: What to Include in 2026

AI acceptable use policy template: section by section

The outline below follows the order most readers expect. For each section you get what it must cover and, for the sections people struggle with most, sample clause text you can adapt. Replace the bracketed placeholders with your own details.

1. Purpose and scope

State why the policy exists and who it covers: employees, contractors, temporary staff and anyone using AI on the organisation's behalf. Cover all AI tools, not only chatbots: coding assistants, transcription tools, image generators and AI features inside existing software.

Sample clause: "This policy applies to all employees, contractors and third parties who use AI tools for [Company] business, on any device, whether the tool is provided by [Company], embedded in software we license, or accessed through a personal account."

2. Definitions

Define the terms the rest of the policy depends on: AI tool, generative AI, approved tool, personal data, confidential information, output. Keep the AI definition broad and practical rather than copying the legal text word for word.

3. Approved tools

List the tools staff may use and for which data classes, or point to a maintained list on the intranet. Name the enterprise versions explicitly (for example, the company Microsoft 365 Copilot tenant, not consumer Copilot). Explain how to request a new tool and who approves it. The approved list should be fed by your AI inventory and system register, so the two never drift apart.

Sample clause: "Only tools on the Approved AI Tools list may be used for [Company] work. Requests for new tools go to [AI governance lead] via [form]. Tools are approved only after security, privacy and vendor review."

4. Data classification: what must never be entered

This is the section that prevents most incidents. Map your existing data classes to AI rules, and list the categories that are banned outright from any AI tool not specifically approved for them.

Sample clause: "Never enter the following into any AI tool unless the tool is approved for that data class in writing: passwords, API keys or other credentials; customer or employee personal data; special-category data such as health, biometric or trade union data; payment card data; unreleased financial results; source code marked confidential; legal advice or material under privilege; information covered by a client confidentiality agreement."

Where staff genuinely need to use AI on personal data, a technical control is more reliable than a rule. An EU-hosted gateway such as Opsio Vault AI pseudonymises personal data before it reaches the model, blocks secrets and logs every call.

5. Output review and accountability

Make clear that the person using the AI owns the result. AI output must be checked for accuracy, bias, copyright issues and fit for purpose before it is relied on or shared. Decisions about people need extra care.

Sample clause: "You are accountable for any work you produce with AI assistance. Verify facts, figures, citations and code before use. AI output must not be the sole basis for decisions that affect an individual's employment, credit, access to services or legal position; a qualified person must review and be able to override the outcome."

6. Prohibited uses

List what is never allowed. Start with the practices banned by Article 5 of the EU AI Act that could realistically occur in a company, then add your own red lines.

• Using AI to infer the emotions of employees or students, for example sentiment analysis of staff video calls, except for medical or safety reasons (Art. 5(1)(f)).
• Biometric categorisation that deduces sensitive traits such as ethnicity, political opinions or sexual orientation (Art. 5(1)(g)).
• Manipulative or deceptive techniques that materially distort someone's behaviour and are likely to cause significant harm, or exploitation of vulnerabilities linked to age, disability or social or economic situation (Art. 5(1)(a) and (b)).
• Social scoring that leads to unjustified detrimental treatment (Art. 5(1)(c)).
• Creating non-consensual intimate imagery of identifiable people or child sexual abuse material (new Art. 5 bans from 2 December 2026, and already illegal in most member states).
• Company red lines, for example: impersonating a real person, generating content that harasses or discriminates, circumventing security controls, or using AI to make final hiring or dismissal decisions.

7. Transparency and disclosure

Tell staff when they must disclose AI involvement. Under Article 50, people interacting with an AI system must be told so unless it is obvious, and deployers must disclose deepfake image, audio or video content and AI-generated text published to inform the public on matters of public interest (unless it has had human review and someone holds editorial responsibility). Our article on Article 50 transparency obligations explains the exceptions.

Sample clause: "Any customer-facing chatbot or voice agent must state that it is an AI system at the start of the interaction. Images, video or audio that are generated or substantially manipulated by AI and depict real people, places or events must be labelled as AI-generated before publication."

8. Intellectual property and confidentiality

Address who owns outputs, the risk of reproducing protected material, and client confidentiality. Require staff to check licence terms for generated code and images, and forbid uploading third-party material the company has no right to process.

9. Security: shadow AI and personal accounts

Ban the use of personal AI accounts for company work and unapproved browser extensions or plug-ins that read page content. Require company single sign-on where available. Explain why: consumer terms may allow the vendor to use inputs for training, and there is no audit trail.

Sample clause: "Do not use personal accounts on AI services for [Company] work, and do not install AI browser extensions, plug-ins or meeting bots that are not on the Approved AI Tools list. IT may block or remove unapproved tools."

10. Incident reporting

Define what counts as an AI incident (confidential data entered into an unapproved tool, a harmful or discriminatory output, a chatbot giving wrong information to a customer) and how to report it, ideally through the existing security incident route. Make reporting blame-free for honest mistakes so people actually do it.

11. Training and AI literacy

Require role-based training before access to AI tools and refresh it regularly. Higher-risk roles, such as recruiters using a screening tool or staff overseeing a credit model, need deeper training. Keep attendance records: that is your evidence of AI literacy measures.

12. Roles and responsibilities

Name who owns the policy (often the CISO or an AI governance lead), who approves tools, who handles privacy questions (the DPO), and what managers must do. Without names, the policy has no one to enforce it.

13. Review cycle and enforcement

Set a review date, at least annually and more often while the technology and regulation move quickly. State that breaches are handled under the normal disciplinary process, and record version history.

A policy is one layer of a wider governance set. For how an AUP sits next to a governance framework, risk assessments and vendor controls, see what AI governance policies should include.

Do's and don'ts for employees

Many organisations attach a one-page summary to the policy. A table like this is easy to put in onboarding material.

How to roll out your AI acceptable use policy

1. Start from what is already in use. Your approved-tools list must reflect reality, or people will ignore it. Run a quick discovery of AI tools first.
2. Check vendors before approving. Each approved tool should have passed a review of data use, retention, location, security and model changes. An AI vendor due diligence checklist keeps that consistent.
3. Draft, then test with real users. Ask a few people from sales, HR, engineering and finance whether the rules fit how they work. Rewrite anything they misread.
4. Consult where required. In many EU countries, rules that monitor or restrict employees need works council or union consultation. Involve HR and legal early.
5. Launch with training, not just an email. A 30-minute session with real examples does more than a PDF. Record attendance.
6. Back it with controls. Single sign-on for approved tools, blocking of unapproved domains or extensions where proportionate, and logging of AI usage.
7. Review on a schedule. Revisit the policy at least annually, and when a significant new tool arrives or the law changes.

Frequently asked questions

What is an AI acceptable use policy?

It is an internal policy that tells employees and contractors how they may and may not use AI tools at work. It typically lists approved tools, data that must never be entered, rules for checking outputs, prohibited uses, disclosure requirements, security rules and how to report incidents. It turns abstract AI governance into everyday instructions.

Does the EU AI Act require an AI acceptable use policy?

Not by name. The Act requires specific outcomes, such as measures to promote AI literacy (Article 4), avoiding prohibited practices (Article 5) and transparency for certain AI uses (Article 50). An acceptable use policy, combined with training, is the most practical way for most organisations to show they have put those measures in place.

What should an AI policy template include?

At minimum: purpose and scope, definitions, approved tools, data classification rules, output review and accountability, prohibited uses, transparency and disclosure, intellectual property and confidentiality, security, incident reporting, training, roles and a review cycle. The data rules and prohibited uses sections carry the most risk reduction, so make those the most specific.

Should we ban ChatGPT and other generative AI tools?

Blanket bans rarely work. Staff move to personal accounts and phones, which creates shadow AI with no controls at all. A better approach is to approve enterprise versions with suitable contract terms, set clear data rules, and block only the tools you cannot make safe. That gives people a sanctioned route and you an audit trail.

How often should an AI acceptable use policy be reviewed?

At least once a year, and whenever something significant changes: a new class of tool, a major vendor change, new guidance from the European Commission or a supervisory authority, or an incident that exposed a gap. Many organisations review every six months while AI adoption is moving quickly.

Get your AI acceptable use policy written for you

The outline above gives you everything you need to draft the policy yourself. If you would rather start from a draft that already reflects your tools, data and risk appetite, take Opsio's free AI governance assessment. About 40 minutes of questions across 14 steps, and the moment you submit you receive four editable Word documents written from your answers: an AI Acceptable Use Policy, an AI Governance Framework, an AI Vendor Due Diligence Checklist and an AI Risk Assessment Template, plus a maturity score across ten governance areas. Free, no card, no obligation.

This article is general information, not legal advice. Check the consolidated text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Dates and obligations are stated as of October 2026.