What should an AI acceptable use policy include?
By Nick Jang, founder of MINERVA Studio ·
The short answer
An AI acceptable use policy tells employees which AI tools they may use, what they may use them for, and what data must never go into them. A good one fits on two pages: the approved tools, the banned uses, the data rules, who checks the output, how to ask for a new tool, and what happens when something goes wrong. It works best when it points to a list of approved tools that someone keeps current, rather than naming products in the policy itself.
Why you need one now
Most people at work have already tried a chatbot. Some paste in a customer email to draft a reply, some feed it a spreadsheet to summarise, some ask it to check a contract clause. Without a policy, every one of those choices is made alone, by someone who may not know that the free version of a tool can keep what they typed.
A policy doesn’t stop people using AI. It tells them how to use it without leaking data, breaking a law or putting an unchecked answer in front of a customer. It also gives you something to point to when a regulator or auditor asks how staff use of AI is controlled.
The sections every policy needs
| Section | What it says |
|---|---|
| Purpose and scope | Who it applies to (staff, contractors, temps) and which AI it covers: chat assistants, coding tools, AI features inside other software, agents. |
| Approved tools | A pointer to the current list of approved tools and the versions or plans that are allowed, usually the enterprise plan, not the free one. |
| Allowed uses | Plain examples of what’s fine: drafting, summarising public material, brainstorming, code suggestions that get reviewed. |
| Prohibited uses | What’s never allowed: decisions about customers or staff without review, anything illegal or deceptive, impersonation, getting around security controls. |
| Data rules | Which data classes may go into which tools. Customer personal data, confidential and restricted data usually only into approved tools, never into public ones. |
| Human review | Who checks AI output before it’s used, and that the person using it stays responsible for it. |
| Disclosure | When to tell a customer or colleague that AI was used. |
| Requesting a new tool | How to ask, who assesses it (security, privacy, legal, risk) and how long it takes. |
| Incidents | What to report (a data leak, a harmful output, a tool misbehaving) and to whom. |
| Ownership and review | Who owns the policy and when it is next reviewed. Six or twelve months is typical; AI moves fast. |
A short template
Adapt the bracketed parts. Keep it this short; long policies don’t get read.
- 1. Scope. This policy applies to everyone who works for [Company], including contractors, and to every AI tool used for [Company] work.
- 2. Approved tools. Use only the tools on the approved AI tools list on [intranet page]. If a tool isn’t on the list, don’t use it for work until it’s approved.
- 3. Your data. Never enter customer personal information, passwords, or [Confidential/Restricted] data into a tool unless the list says that tool is approved for that class of data.
- 4. You own the result. Check AI output before you use it. You are responsible for anything you send, publish or decide with its help.
- 5. Never without review. Don’t let AI make or communicate a decision about a customer, applicant or employee without a person reviewing it.
- 6. Be open. Tell people when content they rely on was substantially produced by AI, where [Company] or the law requires it.
- 7. New tools. Request new tools through [form]. [Team] assesses security, privacy, legal and model risk before approval.
- 8. Report problems. Report data exposure, harmful or biased output, or a tool acting unexpectedly to [contact] the same day.
- 9. Breaches of this policy are handled under [Company]’s code of conduct.
- 10. Owner and review. [Role] owns this policy. It is reviewed every [6/12] months.
Examples: allowed or not?
| Use | Usually |
|---|---|
| Rewording an internal email in the approved assistant | Allowed |
| Summarising a public regulation | Allowed, check the summary against the source |
| Pasting a customer complaint, with their name, into a free chatbot | Not allowed |
| Generating code in an approved coding tool | Allowed, with normal code review |
| Using AI to score job applicants | Not allowed without an approved, assessed tool and a human decision |
| Uploading a draft contract to an approved tool with a data agreement | Allowed if the list says that tool may hold confidential data |
| An agent that sends emails to customers on its own | Not allowed without a separate approval and controls |
For banks and insurers
In a federally regulated institution, the acceptable use policy is only the staff-facing layer. Under OSFI’s E-23, an AI tool that produces results people rely on for decisions is a model, so it belongs in the model inventory with a risk rating. Under B-10, the company supplying it is a third party to assess. The approved tools list is where the three meet: a tool goes on it only once those reviews are done.
That list needs an owner and a record of who approved each entry and when. MINERVA keeps that record, with each AI tool’s owner, rating, supplier and decisions. See AI governance software.
Related questions
What is an AI acceptable use policy?
A short policy that tells employees which AI tools they may use, for what purposes, and with which data, and who is responsible for checking AI output.
Is there a NIST AI acceptable use policy template?
No. NIST publishes the AI Risk Management Framework but no acceptable use policy template. Many organizations base their policy on the framework’s Govern function and write the staff rules themselves.
Should the policy name specific AI tools?
Better not. Point to an approved tools list that someone keeps current, so the policy doesn’t need re-approving every time a tool changes.
Can employees use free ChatGPT or similar tools at work?
Under most policies, not with confidential or personal data, because free consumer plans may keep or use what is typed. Approved enterprise plans with a data agreement are the usual alternative.
How often should an AI acceptable use policy be reviewed?
Every six to twelve months, and sooner when a major new tool, regulation or incident arrives.
Sources
- Government of Canada — Guide on the use of generative artificial intelligence
- Office of the Privacy Commissioner of Canada — Principles for generative AI
- NIST — AI Risk Management Framework
- ISO — ISO/IEC 42001:2023, AI management system
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.