Writing an AI Acceptable Use Policy People Will Follow
Most AI policies are copied from enterprise templates, filed, and ignored. A page that staff actually read prevents more incidents.
Erin Moore
Fractional Chief AI Officer
An AI acceptable use policy needs to answer five questions in language your staff will actually read: which tools are approved, what data must never be entered, how to get something new approved, what happens when the rules are broken, and who to ask. If it runs past a page, the length is costing you compliance rather than buying you protection.
Why length is the enemy
Long AI policies are usually copied from enterprise templates written for organisations with compliance departments. They get filed and ignored, which leaves you worse off than having none — you now have a written standard you are visibly failing, and an incident becomes a governance failure rather than an accident.
The realistic goal is not covering every scenario. It is that a new employee reads it once and behaves correctly in the ninety percent of situations that are foreseeable.
The five questions
Which tools are approved. A named list, not a category description. "Approved AI assistants" invites interpretation; a list does not. Keep it current — a stale list is the fastest route to being ignored.
What data must never go in. Be specific and concrete: customer personal data, anything under NDA, credentials, unreleased financials, health or payment information. Vague phrasing like "sensitive information" transfers the judgment to the person least equipped to make it.
How to get something approved. The route and the expected timeline, in days. If approval is slow, staff route around it and you have manufactured shadow AI with your own process.
What happens when the rules are broken. Proportionate and stated. Most breaches are people trying to do their job with a better tool, and treating them as misconduct guarantees the next one stays hidden.
Who to ask. A named person. Policies without a human attached generate guesses.
The enforcement question nobody answers
Most policies specify consequences and no detection. If you cannot tell whether the policy is being followed, the consequences are theoretical and everyone knows it.
Realistic detection for most companies is a quarterly amnesty-backed ask plus a register of what is in use, not surveillance. That is a weaker control than an enterprise would accept, and it is honest about what you can actually enforce. Pretending otherwise is the part that erodes trust in the whole document.
Where to start
Take the free one-page AI policy template, replace the tool names and the approver with your own, and adopt it this week. An imperfect policy in force beats a comprehensive one in draft.
Then review quarterly. Tools change faster than policies, so the approved list goes stale first — which is why the register and review cadence matter more than the initial drafting. The full structure sits in the AI governance framework.
For the vocabulary and the functions a policy should map to, NIST's AI Risk Management Framework is a reasonable public anchor — useful when someone asks what standard you are working to.
Frequently asked questions
What should an AI acceptable use policy include? Approved tools by name, data that must never be entered, the approval route and its timeline, proportionate consequences, and a named person to ask. Five questions, one page.
How long should an AI policy be? One page. Longer policies are copied from enterprise templates, filed and ignored, which leaves you with a written standard you are visibly failing rather than protection.
Do we need a lawyer to write it? Have counsel review it, particularly in regulated industries or where you handle personal data at scale. Legal should review rather than own it — legal-owned policies optimise for surviving disputes and tend to be unusable day to day.
How do we enforce an AI policy? Realistically, through a quarterly amnesty-backed ask and a register of tools in use, rather than surveillance. Stating consequences you cannot detect undermines confidence in the whole document.
Further reading
Tagged with:
Ready to Automate Your Business?
Let's discuss how AI automation can deliver measurable ROI for your organization in 90 days or sooner.