Who should approve the AI acceptable use policy?

The named AI risk owner approves it, after one review pass with legal, security and an operational manager. Keep the review to a single meeting; the goal is a policy in force within a week, then improved on a set review date.

How often should we update it?

Set a review date when you publish, typically every six months, and update sooner when you approve a new tool, change vendors, or a new regulation or customer requirement applies to you.

Do employees need to sign it?

A simple acknowledgment is worth it. It confirms people have read the page, gives you a record, and turns the policy from a document into an expectation.

Is a template enough on its own?

It's enough to start, which is the point. Fill it in, have counsel review it, and adopt it. Then build the rest of your governance program around it.

What to put in an AI acceptable use policy (free one-page template)

By Erick Truong · October 8, 2026 · 4 min read

The short answer

An AI acceptable use policy tells your people which AI uses and data are allowed, restricted and prohibited, which tools are approved, where a person must review the output, when to disclose AI use, and who owns the policy. Keep it to one page so people actually read it, and name the owner before anything else.

Why should an AI policy fit on one page?

Because the policy only works if people follow it, and people only follow what they've read. Most AI policies die in review: forty pages, six stakeholders, three months, and by the time it's approved half the company is already using tools it doesn't mention.

One page people actually read beats forty pages nobody opens. It also forces the useful decisions: if a rule can't be said in a sentence, it isn't clear enough to follow.

What are the parts of a one-page AI policy?

Eight short sections cover it. Each one should be a few lines, not a few paragraphs.

Purpose and scope. Why the policy exists, and who it applies to: staff, contractors and vendors acting for you, on any device, in any tool.
Allowed uses. Public or internal information in approved tools: drafting, summarizing, research, analysis, code assistance.
Restricted uses. Confidential company, customer or employee information, and anything under contract or regulation, allowed only in named tools and with a named approval.
Prohibited uses. Secrets, credentials and keys; regulated personal data; and any tool not on the approved list, including personal accounts for company work.
Approved tools. The current list, the plan or tier, who administers each one, and how to request a new one.
Human review. A named person approves AI-assisted output before it reaches a customer, a contract, a regulator or a public channel. Internal, low-stakes work needs spot checks only.
Disclosure. When people must say that customers or colleagues are reading, or being assessed by, materially AI-generated output.
Accountability and incidents. The AI risk owner, the review date, and how to report a data exposure, a harmful output or an unapproved tool the same day, with good-faith reporting never penalized.

My free one-page AI acceptable use policy template has all eight sections laid out with brackets to fill in. It's a starting point, not legal advice: have counsel review it before you adopt it.

How do you decide what's allowed, restricted or prohibited?

Start from the data classifications you already have. If you have public, internal, confidential and restricted tiers, map them straight across: public and internal data in approved tools is allowed, confidential is restricted, and the most sensitive tier is prohibited.

If you don't have classifications, use a simpler test: anything you wouldn't want screenshotted and shared is at least restricted. Anything you couldn't explain to the person it belongs to is prohibited.

Then add real examples from your own business. "Don't paste customer contracts into a personal chatbot account" teaches more than any definition of confidential information.

Should we ban ChatGPT and other public AI tools?

Usually not. A blanket ban doesn't stop AI use; it moves it to personal phones and personal accounts, where you have no visibility and no data terms at all. That is shadow AI, and it's the riskiest version of the problem.

The safer move is to approve at least one tool with business data terms, put it on the approved list, and make the restricted and prohibited lines clear. People take the sanctioned path when it's easy and the rules make sense.

How do you roll out an AI policy in a week?

Monday: name the owner. One executive accountable for AI risk. Put their name in the policy before anything else.
Tuesday: fill in the three rows. Allowed, restricted and prohibited, using your data classifications or the screenshot test.
Wednesday: list the approved tools, including the ones already in use. A tool you don't name is a tool nobody will report.
Thursday: review with legal, security and one skeptical manager. One hour, one pass, one page.
Friday: circulate it and ask for acknowledgment. Put the review date in the calendar before you send it.

What does a one-page policy leave out?

On purpose, quite a lot. The acceptable use policy is the first control, not the whole program. Vendor due diligence before contracts are signed, monitoring after launch, incident response, and impact assessments for higher-risk uses all sit alongside it. Those belong to the wider AI governance framework, and I explain how they fit together in what AI governance actually covers.

Frequently asked questions

Who should approve the AI acceptable use policy?: The named AI risk owner approves it, after one review pass with legal, security and an operational manager. Keep the review to a single meeting; the goal is a policy in force within a week, then improved on a set review date.
How often should we update it?: Set a review date when you publish, typically every six months, and update sooner when you approve a new tool, change vendors, or a new regulation or customer requirement applies to you.
Do employees need to sign it?: A simple acknowledgment is worth it. It confirms people have read the page, gives you a record, and turns the policy from a document into an expectation.
Is a template enough on its own?: It's enough to start, which is the point. Fill it in, have counsel review it, and adopt it. Then build the rest of your governance program around it.