If you searched for an AI acceptable use policy template, you already know the problem: your team is using AI tools every day, and there's nothing written down about what's allowed. This guide gives you a free starter policy you can copy below, explains what a complete policy needs, and points you to a full editable kit if you want the whole system instead of just one document.
Free AI acceptable use policy — starter version
Copy this, replace the bracketed fields, and you have a defensible v1. It is deliberately short so people actually read it.
- Scope. This policy applies to all staff and contractors at [COMPANY] and to all AI tools, including chatbots, AI features inside other software, and AI tools that take actions on your behalf.
- Approved tools. Use only the AI tools on our approved list for work involving company or customer information. To request a new tool, contact [OWNER]; most requests are answered within [5] business days.
- Never enter into any AI tool: customer or employee personal data, passwords or API keys, payment or bank details, health information, or anything covered by a client confidentiality agreement — unless the approved-tools list explicitly allows that tool for that data.
- Human review is mandatory. You are responsible for any AI-assisted work you submit. Review it for accuracy before it ships, is sent, or is published.
- No AI-only decisions about people. AI may assist but may not decide hiring, firing, discipline, or performance outcomes.
- Report mistakes. If company data went into the wrong tool, tell [CONTACT] within 24 hours. Honest reports are treated as learning events, not misconduct.
This starter is general business information, not legal advice. If you operate in a regulated industry or employ staff in the EU/UK, have counsel review before adopting.
What a complete AI policy needs (that a single template skips)
A one-page policy is a good start, but the questions that actually trip companies up come later: How do we approve a new tool? How do we vet whether a vendor trains on our data? What do we do the day someone pastes a client list into a chatbot? How do we answer a client's security questionnaire? A complete program answers all of those, not just "here are the rules."
- A tool-approval workflow so requests don't sit in limbo and shadow AI doesn't fill the gap.
- A vendor assessment checklist to vet training, retention, DPAs, and security in under an hour.
- An employee one-pager — the version people will actually read and remember.
- An incident-response procedure for when data goes where it shouldn't.
- A risk register so you can show insurers and clients you've thought it through.
- A rollout plan so the policy gets adopted instead of filed and forgotten.
Skip the blank page — get the full kit
8 editable documents (.docx/.xlsx) that take you from "no policy" to rolled out and acknowledged in 30 days, about 4 hours of work: the acceptable-use policy, a tool-approval workflow, a vendor assessment checklist, an employee one-pager, an incident-response procedure, a pre-filled risk register, and a 30-day rollout plan.
Get the kit — $49 Consultant license — $14914-day money-back guarantee. Not legal advice.
Why this matters now
Industry surveys in 2026 report that roughly two-thirds of employees use AI tools at work, while fewer than one in five companies has a formal AI policy. At the same time, cyber-insurance renewals, client security reviews, and vendor questionnaires increasingly ask, in writing, whether you have one. "We're careful" is not an answer a procurement team can check a box for. A written, acknowledged policy is.