Your employees are already using AI. The question is whether they're doing so within a framework that protects your organisation — or without any guardrails at all. An AI Acceptable Use Policy (AUP) is the foundational document that sets expectations for how AI tools can and cannot be used across your enterprise. Without one, you're exposed to data leaks, compliance violations, reputational damage, and inconsistent decision-making.
This guide walks you through creating a comprehensive AI AUP from scratch — including what sections to include, how to get executive buy-in, and how to roll it out effectively.
Why Every Enterprise Needs an AI Acceptable Use Policy
The rapid adoption of generative AI tools like ChatGPT, Copilot, and Gemini has outpaced most organisations' ability to govern them. A 2024 survey found that 68% of employees use AI tools at work, but only 25% of organisations have a formal AI use policy in place.
Without a clear policy, your organisation risks:
- Sensitive data exposure — employees pasting confidential information into public AI tools
- Intellectual property issues — AI-generated content with unclear ownership or embedded third-party IP
- Compliance violations — using AI in ways that breach privacy laws, industry regulations, or contractual obligations
- Inconsistent quality — AI outputs used without verification, leading to errors in customer-facing materials
- Shadow AI — unapproved tools proliferating across departments with no visibility or control
An AI AUP doesn't restrict innovation — it enables it. By setting clear boundaries, you give employees confidence to use AI tools productively while protecting the organisation.
Key Sections of an AI Acceptable Use Policy
A comprehensive AI AUP should cover the following areas. Use this as your template structure:
1. Purpose and Scope
Define why the policy exists and who it applies to. Be explicit: does it cover all employees, contractors, and third-party vendors? Does it apply to all AI tools or only specific categories?
- State the policy's objectives (risk reduction, compliance, responsible innovation)
- Define what constitutes an 'AI tool' for policy purposes
- Clarify geographic and jurisdictional scope
2. Approved and Prohibited AI Tools
Maintain a clear list of sanctioned AI tools and explicitly prohibited ones. This prevents shadow AI adoption and gives IT/security teams a manageable scope.
- Approved tools: List specific tools vetted by IT/security (e.g., enterprise ChatGPT, approved Copilot instances)
- Conditionally approved: Tools allowed for specific use cases with additional controls
- Prohibited: Tools explicitly banned due to security, privacy, or compliance concerns
3. Data Classification and Handling
This is the most critical section. Define exactly what data can and cannot be used with AI tools.
- Public data: Generally acceptable for use with approved AI tools
- Internal data: May be used with enterprise-licensed tools that don't train on inputs
- Confidential data: Restricted to approved, on-premise or private-instance AI tools only
- Regulated data (PII, health, financial): Requires specific approval and additional safeguards
Golden rule: Never input data into an AI tool that you wouldn't be comfortable seeing published publicly. If the tool's data handling is unclear, treat it as public.
4. Use Case Guidelines
Provide specific guidance for common use cases. Employees need practical examples, not just abstract principles.
- Content creation: AI-generated content must be reviewed by a human before publication. Disclose AI involvement where required.
- Code generation: AI-generated code must undergo the same review and testing processes as human-written code.
- Customer interactions: AI-assisted responses must be reviewed before sending. Customers must be informed when interacting with AI.
- Data analysis: AI-generated insights must be validated against source data before informing decisions.
- Recruitment: AI tools must not be the sole decision-maker in hiring. Human oversight required at every stage.
5. Human Oversight and Accountability
Establish who is responsible for AI outputs and decisions.
- The person using the AI tool is responsible for verifying and taking ownership of its output
- Managers are responsible for ensuring their teams follow the policy
- Designate an AI governance lead or committee for escalations
6. Security and Privacy Requirements
Define technical and procedural safeguards:
- Authentication requirements for AI tools
- Data residency and sovereignty requirements
- Logging and audit trail expectations
- Incident reporting procedures for AI-related security events
- Vendor assessment requirements for new AI tools
7. Intellectual Property and Copyright
Address ownership and rights:
- AI-generated content created during employment belongs to the organisation
- Employees must not use AI to reproduce copyrighted material
- Disclose AI involvement in work product where legally or contractually required
8. Compliance and Enforcement
Define consequences and review processes:
- Violations will be addressed through existing disciplinary procedures
- Regular audits of AI tool usage and compliance
- Annual policy review cycle
- Clear escalation path for policy questions or exceptions
The Approval Process: Getting Your Policy Signed Off
A policy is only as good as its organisational backing. Here's how to get your AI AUP approved:
- Draft with cross-functional input — involve IT, Legal, HR, Compliance, and business unit leaders from the start. A policy written in isolation will be ignored.
- Align with existing frameworks — your AI AUP should complement, not conflict with, existing IT security, data governance, and code of conduct policies.
- Executive sponsorship — secure a C-suite sponsor (CTO, CIO, or CISO). This signals organisational commitment and removes adoption barriers.
- Legal review — ensure the policy aligns with applicable laws including privacy legislation, employment law, and industry-specific regulations.
- Board presentation — for larger organisations, present the policy to the board with a risk-framed business case.
For a ready-made starting point, download our AI policy templates — they include all sections above with customisable language.
Rolling Out Your AI AUP Effectively
The most common failure mode for AI policies is poor rollout. A policy that sits in a SharePoint folder doesn't protect you. Here's how to make it stick:
Phase 1: Communicate (Week 1–2)
- All-hands announcement from executive sponsor
- Email distribution with policy summary and FAQ
- Post on internal wiki, intranet, and relevant Slack/Teams channels
Phase 2: Educate (Week 2–4)
- Mandatory training sessions (30–45 minutes) covering key policy points
- Role-specific guidance for high-risk teams (legal, HR, customer support)
- Interactive scenarios and case studies
- Refer to our AI governance guides for training resources
Phase 3: Embed (Ongoing)
- Integrate policy acknowledgment into onboarding
- Quarterly refresher communications
- Add AI policy compliance to performance review criteria
- Regular updates based on new tools, regulations, and incidents
Common Mistakes to Avoid
Learn from organisations that got it wrong:
- Being too restrictive: Blanket bans drive AI usage underground. If you ban everything, you lose visibility.
- Being too vague: 'Use AI responsibly' isn't a policy. Employees need specific, actionable guidance.
- Ignoring the update cycle: AI evolves monthly. Your policy should be reviewed at minimum quarterly.
- Forgetting enforcement: A policy without monitoring and consequences is merely a suggestion.
- Skipping the 'why': Employees follow policies they understand. Explain the risks, not just the rules.
Measuring Policy Effectiveness
Track these metrics to assess whether your AI AUP is working:
- Policy acknowledgment rate — percentage of employees who have read and signed
- Training completion rate — percentage who completed mandatory AI training
- Incident frequency — number of AI-related security or compliance incidents
- Shadow AI prevalence — number of unapproved AI tools detected on the network
- Exception requests — volume and nature of policy exception requests (high volume may indicate overly restrictive policies)
Build Your AI AUP with Confidence
An AI Acceptable Use Policy is your organisation's first line of defence in the age of AI. It doesn't need to be perfect on day one — but it does need to exist. Start with the framework above, adapt it to your organisation's risk profile, and iterate based on real-world usage.
Aona AI provides enterprise-ready AI policy templates and governance tools that make creating, distributing, and enforcing your AI AUP straightforward. Our platform tracks policy acknowledgment, monitors compliance, and helps you keep policies current as regulations evolve.
Ready to create your AI Acceptable Use Policy? Get started with Aona AI's policy templates and governance platform at aona.ai.