What to Put in an AI Acceptable Use Policy for Employees
Published . Updated .
AI means artificial intelligence. An AI acceptable use policy tells employees which AI tools they may use, which data must never go into them and who to ask when they are unsure. A good one fits on two pages and comes with an approved tool, so people have a reason to follow it.
Why does a company need an AI acceptable use policy?
Most employees already use AI, and many do it without guidance. In a 2025 global study of more than 48,000 people in 47 countries, led by the University of Melbourne with KPMG, 58% of employees said they intentionally use AI at work. Only 40% said their workplace has a policy or guidance on generative AI use. KPMG, April 2025
Employees surveyed in 47 countries. Self-reported answers.
The same study found that 57% of employees hide their use of AI and present AI-generated work as their own, and that almost half admit to using AI in ways that go against company policies, including uploading sensitive company information into free public AI tools. Microsoft and LinkedIn's 2024 Work Trend Index found that 78% of AI users bring their own AI tools to work. Microsoft, May 2024
"The findings reveal that employees use of AI at work is delivering performance benefits but also opening up risk from complacent and non-transparent use. They highlight the importance of effective governance and training, and creating a culture of responsible, open and accountable AI use."
Nicole Gillespie, Chair of Trust and Professor of Management, Melbourne Business School, University of Melbourne, April 2025
What sections should the policy include?
| Section | What it says | Example wording |
|---|---|---|
| Approved tools | Which AI tools staff may use for work, and how to request a new one | "Use the company AI assistant for work tasks. Ask IT before using any other AI tool with company information." |
| Data rules | Which kinds of data may go into which tools | "Never enter customer personal data, contracts, source code or unreleased financial results into a public AI tool." |
| Permitted uses | Tasks AI may help with, and tasks it may not decide alone | "AI may draft and summarise. A person makes decisions about customers, payments and employees." |
| Checking output | Who checks AI output before it is used | "Check facts, figures and quotes before anything AI-assisted leaves the company." |
| Disclosure | When staff should say AI was used | "Tell your manager or the customer when AI drafted a substantial part of the work." |
| Ownership and exceptions | Who owns the policy and approves exceptions | "The AI owner approves exceptions and reviews this policy every six months." |
Keep the language plain. People follow a rule they can remember, and a two-page policy is read more often than a long one.
Field guide. The Field Guide to AI Governance covers the records and controls that sit behind a usage policy. Read the field guide.
Which data should never go into a public AI tool?
Sort company data into three groups and write the groups into the policy:
- Open. Public information and generic drafting, such as a job advert or a public product description. Any approved tool.
- Internal. Internal documents, plans and meeting notes. Only tools the company has approved and connected under agreed controls.
- Restricted. Customer personal data, employee records, contracts, source code, credentials and unreleased financial results. Never in public AI tools, and only in approved systems with access controls and logging.
What Is Shadow AI? explains what happens when restricted data reaches tools the company cannot see. Claude Cowork is having a moment covers a related risk: consumer AI plans handling company files.
Writing your first AI policy and need an approved tool behind it? Talk to Chiri or see how Chiri Brain handles it.
What should the policy say about AI agents?
Many policies cover chat tools and stop there. AI agents need their own lines, because they act rather than answer. An agent that can send email, update records or run code works with the permissions someone gave it. Three rules cover most cases:
- Agents run under a named owner. Every agent has a person responsible for what it does.
- Agents get the narrowest access the task needs. Access is granted per task and reviewed, not copied from a person's full account.
- High-impact actions need a person. Payments, messages to customers, deletions and access changes are approved before they run, and the approval is recorded.
How do you get people to follow it?
A policy works when the approved route is easier than the workaround. Four things help:
- Offer an approved tool that does the job. Without one, a policy only pushes use out of sight.
- Train people briefly and practically. In the KPMG study only 47% of employees said they had received AI training.
- Name one owner. One person answers questions, approves exceptions and updates the policy.
- Check that it holds. Review which AI services are in use, through identity, network or expense records, on a schedule.
Gartner surveyed 302 cybersecurity leaders in 2025 and found that 69% of organisations suspect or have evidence that employees use prohibited public generative AI. Gartner, November 2025 The policy is where that problem starts to close, and The AI Governance Maturity Model shows what comes after it. For the wider set of rules, see the field guide to AI governance.
How Chiri approaches this. Chiri builds, operates, and improves company-specific software as an AI managed service provider. Small teams of senior operators and engineers work with the customer. Chiri supports permissions, activity records, and shared context through its platform, so approved AI tools can reach company data under agreed controls. See AI harness and governance
Want an approved AI tool that makes the policy easy to follow? Talk to Chiri.
Questions and answers
What is an AI acceptable use policy?
A short set of rules telling employees which AI tools they may use, which data must never go into them, how to check AI output and who to ask.
What should an AI usage policy include?
Approved tools, data rules, permitted uses, how output is checked, when AI use is disclosed, and who owns the policy and approves exceptions.
Should a company ban ChatGPT and other public AI tools?
A ban without an approved alternative tends to push use out of sight. Pair restrictions with an approved tool, clear data rules and regular review.
Who should own the AI policy?
One named person with authority to approve exceptions and update the policy, often the executive accountable for AI.
How often should an AI policy be reviewed?
At least twice a year, and whenever the company adds a new AI tool or the rules that apply to it change.