AI Acceptable Use Policy Template: Free Download, Examples and a 30-Day Plan

Here’s a free AI acceptable use policy template: ten plain-language sections built on three data tiers, ready to download as a Word file or a PDF. Below it you’ll find example clauses for three kinds of company and a 30-day plan to get your version approved, published and acknowledged.

“We’re drafting one” is a common answer when you ask an organization about its AI policy, and sometimes it has been the answer for a year. Legal has a draft. HR wants changes. Someone is waiting for the approved tool decision before finishing it. While it sits in review, the absence of a policy is itself a policy, and that policy is “anything goes.” A one-page policy that’s published beats a twelve-page policy that isn’t, and you can improve it at the first scheduled review.

Download the free AI acceptable use policy template

The download has the same ten sections you’ll see below, laid out as a ready-to-edit policy: bracketed fill-ins for your company name, policy owner, tools page and request form, a document control table, short tips you delete before publishing, and an employee acknowledgment block. Edit the Word file; send the PDF to reviewers.

Not legal advice: have HR and legal review it before you publish. The template gives you a solid structure; it doesn’t replace that review.

The template is the do-it-yourself option. If you’d rather have the policy written for your company, the AI Use Policy Pack ($149) is the done-for-you option. There’s a side-by-side comparison further down.

How this relates to your shadow AI policy

If you’ve read the shadow AI policy your IT team actually needs, you’ve seen the core of this: three data tiers, named approved tools, and the right order of operations for curbing unsanctioned AI use. That post explains why the approach works. This one gives you the full document around it, section by section, with suggested wording, and the plan to get it approved, published, and acknowledged. The data tiers are identical in both, deliberately, so your guidance never contradicts itself.

Here’s how the AI Readiness assessment asks the question, and the 0 to 4 scoring ladder:

G1. Do you have an AI acceptable use policy?

0. No
1. Drafting one
2. Published, but no training or acknowledgment
3. Published, trained, and acknowledged by employees
4. Reviewed on a set schedule and backed by technical controls

Notice that “drafting one” scores a 1. The ladder rewards publishing, then training, then enforcement. The fastest single improvement for most organizations is to get from 1 to 3 within a month, which is exactly what the plan below is for.

The AI acceptable use policy template, section by section

Ten short sections. Keep the whole thing to two pages at most, written in plain language. Replace the bracketed parts and adapt the wording to your organization and your regulations.

1. Purpose and scope

“This policy explains how employees and contractors of [Company name] may use AI tools for work. It covers any AI tool, including AI features built into software we already use.”

2. The three data tiers

• Never in any AI tool: customer personal data, employee and HR records, financial results before release, credentials and keys, anything under legal hold. Add anything your regulations require.
• Only in approved tools: internal documents, code, process documentation, and drafts containing company information.
• Fine anywhere: public information, general questions, and learning.

Add one line telling people what to do when they’re unsure: treat it as the stricter tier and ask.

3. Approved tools

“Approved AI tools are listed on [intranet page]. To request a new tool, use [request form]; requests are reviewed within [number] business days.” Keep the list on a separate page so you can update it without re-approving the policy. A fast request process is what keeps people from routing around the policy. Before a tool goes on the list, ask the vendor two AI-specific security questions, and if the debate is consumer accounts versus enterprise licenses, end the evaluation stall first.

4. Using AI output

“You are responsible for any AI output you use. Check facts, figures, and code before relying on them. Anything sent to customers or published externally must be reviewed by a person first.”

5. Prohibited uses

• Making decisions about individuals, such as hiring, performance, or eligibility, based solely on AI output without human review.
• Creating content that impersonates a real person.
• Using AI to get around security controls.
• Entering information you’re contractually obliged to keep confidential, such as material under a client NDA, into any tool not approved for it.

The first item matters more each year, as rules on automated decisions about people spread, particularly in hiring. Mapping your regulatory obligations covers how to check which apply to you.

6. Disclosure

“When AI has substantially produced content for customers or external audiences, follow your team’s disclosure guidance.” Leave the specifics to teams; a marketing team and a legal team will need different rules.

7. Privacy and monitoring notice

“Use of approved AI tools is logged for security and compliance purposes.” Saying this plainly is both fair and effective; people behave differently when they know.

8. Building with AI

“Automations, agents, or integrations that connect AI to company systems require IT approval before use.” This closes the gap where an enthusiastic employee connects an AI tool to a business system with their own credentials. The standards behind the approval are in APIs before agents.

9. Violations

“A first issue is handled through a conversation and retraining. Repeated or serious issues go through our standard HR process.” Proportionate consequences keep people reporting mistakes instead of hiding them.

10. Ownership and review

“This policy is owned by [role]. It is reviewed every six months, or sooner when significant new AI tools are adopted. Version [number], effective [date].”

AI acceptable use policy examples for three kinds of company

The ten sections stay the same from company to company. What changes is what goes in each tier, which tools are approved and which uses are off limits. Here are short example clauses for three common situations. They’re illustrations to adapt with your HR and legal teams, not wording to paste in as-is.

Example 1: a marketing or creative agency

• Data tiers: “Client materials, including briefs, drafts and brand assets, are in the ‘only in approved tools’ tier, and only when the client’s contract allows AI use. Check the client’s AI terms in [project system] before you start.”
• Disclosure: “Tell the client before delivery when AI generated images, video or voice in their work, and apply any AI label the publishing platform requires.”
• Prohibited uses: “Don’t create images, video or audio that show or sound like a real person without that person’s written permission.”

Example 2: a healthcare clinic or other regulated organization

• Data tiers: “Patient information, including anything that could identify a patient, is in the ‘never’ tier. The only exception is a tool listed on [intranet page] as approved for patient data after compliance review and a signed agreement with the vendor.”
• Using AI output: “AI may draft notes, summaries or patient messages, but a licensed clinician reviews and approves anything that goes into the record or to a patient.”
• Prohibited uses: “AI output is never the only basis for a clinical, coverage or eligibility decision.”

Banks, insurers and other regulated firms follow the same pattern: name the regulated data types in the never tier, and point to the one or two tools approved to handle them.

Example 3: a software company

• Data tiers: “Source code is ‘only in approved tools.’ Secrets, API keys, tokens, production data and customer data are ‘never,’ including inside code or logs you paste in for debugging.”
• Using AI output: “AI-written code goes through the same review, tests and license checks as code written by a person.”
• Building with AI: “Coding agents that can run commands, open pull requests or reach production systems need IT approval and their own scoped credentials, never a developer’s personal ones.”

Template, policy generator or done for you?

If you searched for an acceptable use policy generator, there are four realistic routes. All of them end the same way: HR and legal review before you publish.

Using an AI assistant as your policy generator

Paste the template into an AI tool your company has approved, with a prompt like the one below. The template is public, so it’s fine to share; don’t add anything from your never tier, such as employee names, contracts or customer details.

I'm adapting an AI acceptable use policy template for a [your headcount]-person [your industry] company in [your country or state]. Our approved AI tools are [your approved tools]. Regulations that apply to us include [your regulations, or "not sure"]. Rewrite the template below in plain language, keep it under two pages, keep all ten sections and the three data tiers, and list every assumption you made that I should check with HR or legal.

[paste the template here]

Whichever route you take, approval is where policies tend to stall. That’s the next step.

Getting it approved fast

Serial email review is what keeps policies in draft. Replace it with one meeting. Invite legal, HR, security, IT, and your executive sponsor, send the draft two days ahead, and aim to leave with approval of version 1. Two framings help:

• “Approve it for six months.” A policy with a scheduled review feels less final, which takes the perfectionism out of the room.
• “What’s the risk of another quarter with no policy?” Put that question on the agenda. It tends to settle debates about wording.

If you have an AI council, this is its natural first decision.

A 30-day plan from draft to acknowledged

1. Week 1: adapt the template (the Word download above is the quickest start). Fill in the approved tools list and the request process.
2. Week 2: the single review meeting. Leave with version 1 approved and a six-month review date.
3. Week 3: publish and announce it together with the approved tools, framed as “here’s how to use AI here.” Run a ten-minute training with real examples from your own work: “here’s a customer email; which tier is it?” For the longer-term skills side, see the AI training plan for your IT team.
4. Week 4: collect acknowledgments through the policy tool you already use, and follow up with managers whose teams haven’t completed it.

At the end of the month you’re at level 3.

Level 4: back the policy with controls

Level 4 adds a review schedule and technical controls. Map each policy section to the control that enforces it:

• The “never” tier is enforced by DLP and sensitivity labels, as described in labels and DLP before AI.
• Approved tools are enforced by SSO, web filtering of unapproved AI sites, and restricted app consent, covered in identity as your AI control plane.
• The monitoring notice is backed by audit logging; logging what your assistants do covers what to capture.
• The building-with-AI section is backed by consent restrictions and an inventory of AI tools and integrations.

Where a policy line has no control behind it, note it as a gap. That list becomes your next quarter’s work.

Common mistakes at this stage

Writing it in legalese. If a new employee can’t understand it in five minutes, it won’t be followed.

Publishing without an approved tool. A policy that says “only approved tools” with nothing approved is a ban in disguise.

Publishing without training. Level 2 is common, and it’s fragile. Ten minutes of examples does more than the policy text.

No owner or review date. AI tools change quickly; a policy with no review date goes stale within a year.

Treating a template as finished. Any template, ours included, is a starting point. Have HR and legal check your version against your contracts and regulations before you publish.

Where does your team actually stand?

The acceptable use policy is one of 24 questions in the AI Readiness assessment, which covers six dimensions: data, security, infrastructure, skills, use cases, and governance. The free version is 10 questions and gives you a score in a few minutes.

Get your free AI Readiness Score →

Want to see what the full assessment covers first? Flip through a complete 38-page sample report.

Related guides

• The Shadow AI Policy Your IT Team Actually Needs (With Template)
• SOX, State Privacy Laws, and AI: Map Obligations Before the Pilot
• APIs Before Agents: Giving AI Access to Your Systems Safely
• The 30-Minute AI Council: Lightweight Governance That Sticks
• Sensitivity Labels and DLP Before AI: The 30-Day Rollout