An AI acceptable use policy tells everyone in the organisation which generative AI tools they may use, for what, with which data and with what safeguards. It reduces the use of unauthorised tools (shadow AI), protects confidential information and personal data, sets human review and accountability, and underpins AI literacy training. It is one of the first controls in an AI governance programme.
How to use
- Enter the organisation name, sector and size.
- List the AI tools already approved, described by type and contract.
- Tick the permitted uses and choose a data stance: restrictive, balanced or enabling.
- Name the accountable role, the review cycle and who approves requests.
- Read the warnings, adjust the text and export it as DOCX for legal review and sign-off.
What each field asks for
| Field | What to enter |
|---|---|
| Organisation name | Appears in the title and body of the policy. |
| Sector | Adds clauses and examples specific to the sector. |
| Size | Sets the governance model: single owner or committee. |
| Approved AI tools | Describe them by type and contract; no brand needed. |
| Permitted uses | Tick what people may do with the approved tools. |
| Data stance | How much internal information may go into the tools. |
| Role accountable for the policy | The job title or team, not the person’s name. |
| Review cycle | Choose the cycle |
| Who to ask for approval or questions | Optional. Team, committee or internal channel. |
Example
A fictional medium-sized clinic, Blue Horizon Clinic, approves two tools (a corporate chat assistant under an enterprise contract and a coding assistant), permits drafting, summarising, translation and research, and chooses the balanced stance. The tool produces a 15-section policy with health care clauses (patient data only with a lawful basis and minimisation, and AI does not replace clinical judgement), examples of acceptable and unacceptable use, committee-based governance because the clinic is medium-sized, and a review every 12 months.
When to use
- When people already use generative AI at work and there are no written rules yet.
- Before rolling out a corporate AI tool to the whole organisation.
- When setting up AI governance or the AI literacy measures required by the EU AI Act.
Frequently asked questions
What is an AI acceptable use policy?
It is the internal document that sets out which AI tools may be used, for which tasks, with which data and under which controls. It guides people day to day and shows that the organisation manages the risks of generative AI.
Does every company need an AI policy?
If people use generative AI at work, yes, even in a small company. Without written rules, each person decides alone what data to put into the tools, and the risk of leaks and of unauthorised tools grows.
Does the EU AI Act require an AI acceptable use policy?
The EU AI Act does not require a document with this name, but it asks for AI literacy measures for staff dealing with AI systems and places duties on deployers of high-risk systems. The GDPR and the LGPD apply whenever personal data is involved. A policy helps organise these obligations; check the current timeline of the Act.
What is shadow AI?
It is the use of AI tools not approved by the organisation, usually free personal accounts. The risk is that company information or customer data leaves your control. A policy tackles this by offering approved tools and clear rules.
Which DPCert certification covers this topic?
Responsible use of AI at work is assessed in RAIF (Responsible AI Foundation), the entry-level DPCert certification. Data governance for AI is covered in more depth in RAIP (Responsible AI Practitioner).
Is the result legal advice?
No. The tool is educational and generates a draft from your answers. Adapt the text, check the laws that apply to your organisation and validate it with your legal team before publishing.