How to write an AI acceptable use policy

Why you need an AI policy now

Employees are already pasting company data into ChatGPT and other tools, whether or not you allow it. An AI acceptable use policy sets clear rules so you capture the productivity of generative AI without leaking confidential data, breaching GDPR or shipping unreviewed AI output. It is fast becoming the first thing auditors and customers ask about.

What to include

Scope — which tools and use cases are covered (chatbots, coding assistants, embedded AI features).
Approved tools — a sanctioned list, and how to request additions; default-deny for everything else.
Data rules — what may never be entered into public AI tools (personal data, secrets, source code, client data), and what is acceptable.
Confidentiality and IP — caution on training-data reuse and ownership of generated content.
Human oversight — AI output must be reviewed before use; staff remain accountable for decisions.
Bias, accuracy and transparency — verify facts; disclose AI use where required.
Alignment with ISO 42001 — for organisations building an AI management system.

Common mistakes

Banning AI outright, which only drives shadow usage.
No data rules, so confidential information flows into public models.
Treating AI output as authoritative without human review.

Framework alignment

Complements ISO 27001:2022 Annex A 5.10 (acceptable use) and 8.10–8.12 (data handling), aligns with ISO/IEC 42001 (AI management), and supports GDPR accountability.

Primary sources

EU AI Act — Regulation (EU) 2024/1689, full text on EUR-Lex (eur-lex.europa.eu/eli/reg/2024/1689/oj).
ISO/IEC 42001:2023 — Artificial intelligence management systems (iso.org/standard/42001).
NIST — AI Risk Management Framework (AI RMF) (nist.gov/itl/ai-risk-management-framework).

Generate it in minutes

See a sample AI acceptable use policy or generate yours free.

Frequently asked questions

What should an AI acceptable use policy actually cover?

It should set rules for which AI tools are approved, what data may and may not be entered into them, how to handle AI output before relying on it, and who is accountable for misuse. The aim is to let staff use AI productively without leaking confidential data or shipping unverified output.

Can employees paste confidential data into public AI tools?

By default, no. Public AI tools may retain or train on submitted text, so confidential, personal, or regulated data should never be pasted in unless the tool is on an approved list with contractual protections. The policy should name the approved tools and the data classes allowed in each.

How does this relate to ISO 42001?

ISO/IEC 42001 is the management system standard for AI. An acceptable use policy is one operational control within that wider framework: 42001 also expects AI risk assessment, governance roles, and lifecycle oversight. The policy is the day-to-day rulebook; 42001 is the governing system around it.