The short answer
An AI acceptable use policy sets the rules for using AI at work: which tools are approved and how new ones get approved, what information must never be entered, who reviews outputs and who is accountable, when to disclose AI use, and how to report a mistake. Good policies are short, plain and backed by technical controls, because staff are already using AI and a ban mostly pushes that use out of sight.
In the US, build the policy on the obligations you already have under the FTC Act, state privacy laws and any sector rules, such as HIPAA. Treat any template, including the checklist below, as a starting point that your legal and HR advisers must review before you publish.
Decide three things before you write
- Scope. Who the policy covers (employees, contractors, volunteers, board members) and what counts as AI: chatbots, AI features inside existing software, browser extensions, meeting note-takers and agents that act on someone's behalf.
- Stance. Approve a small set of business tools rather than banning AI. Bans push people to personal accounts, the problem our shadow AI guide describes.
- Ownership. One accountable owner, supported by privacy, IT and HR, who keeps the policy and the approved tools list current.
The sections your policy needs
| Section | What it should say |
|---|---|
| Purpose and scope | Why the policy exists, who it covers and which tools and uses it applies to |
| Approved tools | The current list, work accounts only, and how to request a new tool (with a security and privacy review) |
| Information never to enter | Credentials in any tool; personal information and client confidential data in any tool or use not approved for it |
| Human review and accountability | The person who uses an output owns it; outputs affecting people, money or compliance are checked first |
| Disclosure | When to tell clients, colleagues or the public that AI helped produce something |
| Accuracy and bias | Verify facts, figures and citations; watch for unfairness in anything about people |
| Intellectual property | Caution with copyrighted material in prompts and with presenting AI output as original work |
| Records and retention | Whether prompts and outputs are business records, and where they are kept |
| Security | No AI browser extensions, plug-ins or add-ins without approval; limits on what agents can access and do |
| Training | Required before access, refreshed when tools change |
| Breaches and reporting | What to do, and how quickly, if restricted information goes into the wrong tool |
| Review cycle | An owner and a review date, plus a review whenever a major tool or law changes |
The parts that need the most care
Information never to enter. Be concrete. Passwords, API keys and other credentials never go into any AI tool. Customer, patient and employee personal information, client confidential data and anything under a non-disclosure agreement never go into unapproved or consumer tools, and go into approved tools only for approved uses. Tie the rules to your data classification. If you are a HIPAA covered entity or business associate, protected health information stays out of any AI tool that is not covered by a business associate agreement; our guide to AI and HIPAA explains what to check.
Human review and accountability. Accountability for decisions rests with your organization, not with an automated system, and the NIST AI Risk Management Framework's govern function calls for clear roles and accountability (NIST). Say who reviews what, and keep decisions about individuals with people. Some states and cities, Illinois and New York City among them, also regulate AI in hiring and employment decisions, so involve HR before AI touches recruiting or performance reviews.
Extensions, plug-ins and agents. An extension can often read whatever is on screen, so each one needs approval. Agents that read email or files and take actions need the least access possible and approval steps for anything consequential: the OWASP Top 10 for LLM applications lists prompt injection and excessive agency among the main risks (OWASP). Select vendors carefully and be careful what information you provide to any tool you have not reviewed.
Intellectual property and copyright. The law on who owns AI output, and when output infringes someone else's work, is still developing, and vendor terms differ. A cautious policy says: do not paste in third-party material you have no right to use, check output before publishing it as your own, and ask first before using AI for anything you plan to register or license. This is general information, not legal advice.
The US legal context
The US has no single federal privacy law and no comprehensive federal AI law, but existing law already applies to AI tools. The FTC Act prohibits unfair or deceptive practices, including in how organizations collect, use and protect personal information (FTC). Sector laws add their own duties, such as HIPAA for health information, GLBA for financial institutions and FERPA for student records, and state privacy laws such as California's CCPA and the Texas Data Privacy and Security Act add notices, consumer rights and assessments for high-risk processing. A few states have AI-specific laws as well; our overview of AI laws in the US explains the landscape.
For a model of plain rules, look at public-sector AI policies. OMB memorandum M-25-21 requires federal agencies to name Chief AI Officers, keep inventories of AI use cases and apply minimum practices to high-impact AI (OMB), and Maryland's Responsible AI Policy requires an intake process with risk tiers and a risk assessment before high-risk AI is deployed. They are written for government, though Maryland's policy also applies to contractors, and the structure translates well.
Rather talk it through? If staff are already using AI and you need workable rules quickly, we can draft a policy with you that matches your tools and controls, ready for your advisers to review. Talk to a Promatics specialist
AI acceptable use policy checklist
- Purpose, scope and the people covered are stated
- AI is defined to include built-in features, extensions and agents
- Approved tools are listed, and work accounts are required
- New tools have a request route with a privacy and security review
- Information never to enter is listed: credentials anywhere, personal and client confidential data outside approved uses
- The rules are tied to your data classification
- A named person is accountable for every output used in work
- Outputs affecting people, money or compliance are reviewed before use
- Disclosure rules for clients, colleagues and the public are set
- Facts, figures, citations and decisions about people are checked for accuracy and bias
- Intellectual property and copyright cautions are included
- Records and retention rules cover prompts and outputs
- Browser extensions, plug-ins and add-ins need approval
- Agent access is limited, and consequential actions need approval
- Training is required before access
- Reporting steps and contacts for mistakes and breaches are clear
- An owner and a review date are set
- Your legal counsel and HR adviser have reviewed the draft
Making the policy stick
A policy works only if the approved route is easier than the unapproved one. Publish the approved tools list where people will find it, back the rules with technical controls (blocking unapproved apps and extensions, data loss prevention, logging) and train people with examples from their own work. Ask staff to acknowledge the policy, and make reporting a mistake safe: someone who pastes the wrong file and says so quickly is helping you.
When to bring in help
A small organization using one or two well-known AI tools can draft a sensible policy from this checklist and have its advisers review it.
Bring in help when staff use many AI tools and nobody knows which, when you handle health, financial or client confidential information, when you are deploying agents or building AI applications, or when a board, insurer or client asks how you manage AI risk. Our AI governance and security service drafts the policy with you, discovers the AI tools already in use, sets up the controls that enforce it and tests AI applications for prompt injection and data leakage. We prepare the policy for your legal and HR advisers; we do not replace them.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- AI Risk Management Framework, National Institute of Standards and Technology (NIST)
- Privacy and security business guidance, Federal Trade Commission
- OMB memoranda, including M-25-21 on federal agency use of AI, Office of Management and Budget
- Health Information Privacy (HIPAA), U.S. Department of Health and Human Services
- OWASP Top 10 for LLM Applications (2025), OWASP Gen AI Security Project
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.