AI acceptable use policy: guide and template outline
Most teams need a short, plain policy before (or right after) buying Copilot, ChatGPT, Claude or Gemini. Here is a starter outline you can adapt. Review it with your legal counsel before use.
Template outline
- Purpose and scope (who and which AI tools it covers, including embedded AI features and personal accounts)
- Risk posture (innovation-forward vs cautious) and who owns the policy
- Approved tools register (tool, approved uses, data allowed, restrictions)
- Data rules: what may never go into AI (customer data, credentials, regulated data) and what may go into approved tools only
- Human accountability: AI output is a draft; verify facts, citations and numbers
- Disclosure: when to tell clients or colleagues AI was used
- AI-generated code and “vibe coding”: review before it touches company data
- New tool requests and exceptions process
- Incident reporting (data pasted into the wrong tool)
- Training, acknowledgment and review cadence
How the plans you are comparing affect the policy
Your approved-tools register should match what each plan actually promises on data use. See the Data & training terms and Admin & compliance rows on the comparison grid (filter: “Data, admin & compliance”).
Further reading (examples published by others)
Coming soon: enforcement recipes (how to apply each clause with your admin tools) and a downloadable template.