Guide
AI acceptable use policy for employees
An AI acceptable use policy is the short, practical version of your AI rules — the page every employee actually reads. It answers one question: what may I do with AI at work, and what must I never do?
How it differs from a full AI policy
The company AI policy covers ownership, vendor checks and review cycles. The acceptable use policy is written for staff: concrete dos and don'ts in plain language, ideally on one or two pages.
What to include
- The tools staff may use, and the account type to use them with (company account, not personal).
- Data that must never be entered: customer personal data, confidential contracts, credentials, unreleased financials — adapted to your business.
- A rule that AI output is checked by a person before it is sent, published or used in a decision.
- Disclosure: when customers or colleagues should be told that content was produced with AI.
- Uses that need approval first, such as anything affecting hiring, performance or customers directly.
- How to ask for a new tool, and how to report a mistake or misuse.
Make it easy to follow
Short sentences, examples from your own work, and a named contact person do more than long legal wording. Ask staff to confirm they have read it, and record that — it is useful evidence of AI literacy work.
Start from what is already in use
Before writing the rules, find out which AI tools people already use. The free TrustPack AI exposure scan helps you map that in a few minutes, and the full TrustPack generates an acceptable use policy that names your actual tools.
This guide is general governance information, not legal advice. Specialist review is recommended before relying on it for regulatory decisions.