Acceptable use policy (AI)

An acceptable use policy (AUP) for AI translates governance principles into everyday instructions. A practical policy lists approved, restricted and prohibited tools; classifies which data may never go into external AI services (personal data, confidential client information, trade secrets, credentials); requires human verification of outputs before they are relied on or sent outside; sets rules for disclosing AI assistance to clients or the public; and explains how to request a new tool and how to report problems.

ISO/IEC 42001 expects top management to establish an AI policy and Annex A includes controls on policies for responsible use; the policy also supports the AI literacy duty that the EU AI Act places on providers and deployers. An AUP works only with training, accessible approved alternatives and periodic review, because tools change quickly. It is the main counter to shadow AI.

Example: a consultancy's policy allows an enterprise assistant for drafting, forbids uploading client data to consumer chatbots, and requires a reviewer's initials on any AI-assisted deliverable.