AI acceptable use policy: what to include (and a training session plan)

Many of your staff probably already use AI tools. A policy nobody reads protects no one. A policy people understand, and know how to follow, does.

Here is why it is urgent. As of 3 May 2026, 19.8% of US businesses reported using AI, and the rate rises with size: 37% of firms with 250 or more employees, and 32% of firms with 100 to 249 (US Census Bureau: Large Firms With at Least 20 Employees Biggest AI Users, archived copy). The larger the firm, the more likely AI is already in use.

This post gives you 10 sections to include, a 5-question test for any tool request, 5 data examples and a 30-minute session plan. It offers structure and plain-English example lines, not policy text you could adopt as it stands. It is general information, not legal advice.

Why you need an AI acceptable use policy

Tool use moves faster than rules. People paste a customer email into a chatbot to save ten minutes, with no bad intent and no idea where the text goes. A policy sets expectations before that happens: what is fine, what is not and who to ask.

It also helps your managers. Without one, every "can I use AI for this?" becomes a one-off judgement call, and two managers will answer differently.

Is a policy a legal requirement? Not generally as such. The EU AI Act sets duties such as AI literacy, and the Commission says its AI literacy obligations have applied since 2 February 2025, but its overview of the Act does not name an acceptable use policy as a requirement (European Commission: AI Act regulatory framework). That page covers EU rules only. Check what applies where you operate.

The 10 sections to include

Here are two sets of 5. Set A is about scope and approved tools. Set B is about data and behaviour. Each section has an example line in plain English. These are examples to adapt, not company policy.

Set A: scope and approved tools

1. Purpose. Say why the policy exists in one or two sentences. Example: "We want you to use AI tools to work faster, without putting customers, colleagues or the company at risk."
2. Who it covers. Employees, contractors, interns and anyone using AI on the company's behalf. Example: "This applies to everyone who does work for us, on any device."
3. Approved and banned tools. A short list, kept somewhere people can find it. Example: "Use only the tools on the approved list. Anything else needs a yes first."
4. How to request a new tool. A named route with a reply time. Example: "Send the request form to IT. You will get an answer within 5 working days."
5. Accountability. Who owns the policy and who answers questions. Example: "You are responsible for anything you send, whether you or a tool wrote it."

Our pick for Set A: accountability. It is the line to remember: if a tool wrote it and you sent it, it is yours.

Set B: data and behaviour

6. What data may never go into a tool. Name the categories. Example: "Never enter customer details, passwords, contracts or anything marked confidential into a tool that is not approved for it."
7. Personal and customer data. Say what is allowed, in which approved tool, and what is not. Example: "Do not paste names, emails or account numbers into a general chatbot."
8. Checking and labelling AI output. People check before they share. Example: "Check facts, figures and names against a trusted source before you use AI output. Say when AI helped, if a client or manager asks."
9. Intellectual property and copyright. Cover what goes in and what comes out. Example: "Do not enter another company's confidential material. Ask before you publish AI-made images or text as your own work."
10. How to report a problem. Make it easy and safe. Example: "If a tool leaks data or gives you something harmful, tell the owner of this policy straight away. Reporting early is welcome."

Our pick for Set B: the data rule. One paste into the wrong tool can leak data, so a clear, specific rule here matters most.

Approved tools: a 5-question test

A list will always lag behind the tools people find. Give staff five yes or no questions to ask before they try anything new.

1. Is it on the approved list? If not, ask before you use it.
2. Do I know where my data goes? Who runs the tool, and where is what you type stored?
3. Do I know whether it keeps what I type? Check whether it saves your input or uses it to train the tool.
4. Do I know who owns the output? Check the terms for what you can do with what the tool produces.
5. Do I know who to ask? Use the request route from section 4 of your policy.

Answer "no" or "I do not know" to any of them and you stop and ask, rather than guess. For reference, NIST publishes a voluntary framework for AI risk thinking, with a companion Generative AI Profile (NIST: AI Risk Management Framework). It is not a standard to comply with, and NIST says it is being revised, but it is a useful source of risk questions for the people who approve your tools.

Our pick: question 2, where your data goes. It is an easy one to skip, and its answer tells you whether the other four matter.

Data rules in practice: 5 examples

Rules stay abstract until you see them against real tasks. These five are examples to adapt to your own tools and rules, not company policy.

1. Drafting an email. Generally fine in an approved tool, if you leave out private details and read the result before you send it.
2. Summarising a meeting. Depends on the tool. Only record or paste a meeting into one approved for that use, and tell attendees.
3. Pasting a customer record. Do not, unless the tool is approved for customer data. Replace names and numbers with placeholders if you only need help with the wording.
4. Uploading a contract. Treat it as confidential. Use only a tool your organisation has approved for it, or leave it out.
5. Generating an image. Fine for internal drafts. Before you use one publicly, check your policy on copyright and ask if you are unsure.

Our pick: example 3, the customer record. It is an easy slip to make, and a placeholder takes ten seconds.

Training staff on it: a 30-minute plan

A policy only changes behaviour once people have talked it through. Run one 30-minute session for each team, then repeat it when the tools or rules change. Remember the Census figure: if about one in three larger firms uses AI, some of your people probably do.

Prepare: the one-page policy summary, the data examples above on slides and a poll.

1. Minutes 0 to 5: why. Open with the question "Which AI tools do you use at work?" Share the answers back and say why the policy exists.
2. Minutes 5 to 12: the 10 sections. Walk through the two sets in plain words, with one example line each. Do not read the policy aloud.
3. Minutes 12 to 22: scenarios. Show the five data examples one at a time. Ask "Can this go into an AI tool?" and give people a minute to vote before you reveal the answer.
4. Minutes 22 to 27: questions. Open anonymous questions. People will ask things they may not ask out loud, such as "I already did this last month. Am I in trouble?"
5. Minutes 27 to 30: sign-off. Ask everyone to confirm they have read the policy and know who to ask.

Close with the Census figures: AI use rises with firm size, so a short session now is cheaper than clearing up a leak later. If you want a deeper track, our post on AI literacy training covers skills and a measure of whether they stuck, and data classification levels helps you decide which data belongs in which tool.

Our pick: the scenario block. Voting on a real example is easier to remember than hearing a rule.

Ways to host your AI policy session with AhaSlides

This session works best when people answer rather than listen. Use these slide types, built from the examples in this post.

1. Pick Answer: "Can this go into an AI tool?" for each data example, with options such as "Yes, in an approved tool", "Only with names removed" and "No".
2. Word Cloud: "Which AI tools do you use?" You see the real tools, including the ones that are not on your list.
3. Rating Scale: "How clear is each section?" Run it at the end and rewrite the lowest-scoring section first.
4. Open Ended: "What AI task would you like help with?" You see what your policy has missed.
5. Q&A: anonymous, so people ask the questions they would not ask in the room. Our tips for running a Q&A session will help.

The AI acceptable use at work course template gives you the slides ready to adapt, so the five data examples above can run as a vote.

Frequently asked questions

What should an AI acceptable use policy include?

Scope, approved tools, data rules, output checks, intellectual property and a way to report problems. The 10 sections above cover each of these, with an example line for every one.

Is an AI policy required by law?

Not generally as such. The EU AI Act sets duties such as AI literacy, but the Commission's overview does not name an acceptable use policy as a requirement. Rules differ by country and sector, so check the ones that apply to your organisation.

What data should never be put into an AI tool?

Anything your policy marks as confidential, such as customer, personal and contract data, unless the tool is approved for that kind of data. If you are unsure, treat it as off limits and ask.

Is NIST AI RMF mandatory?

No. NIST says the framework is intended for voluntary use. It is a reference for thinking about AI risk, and NIST says it is being revised.

How long should the training session be?

There is no set length. A 30-minute session is a practical start, then a short refresher whenever the tools or the rules change.

Where to start

Write the data rule first, because it matters most. Then book one 30-minute session for the team that uses AI the most, and ask them what the policy is missing. For the wider picture on using AI with good judgement, see AI workforce training and human judgment, and for the privacy side, AI documentation and privacy training. The button below opens the AI acceptable use at work template.