AI policy template
AI policy template: an acceptable use policy you can adapt this week.
A complete AI use policy template for companies: approved tools, a table of what data may go where, permitted and prohibited uses, human review by risk tier, buying and building AI, notices, incidents and training. Three sections are free to read below; the full Word and PDF template comes with the AIMP certification.
What is inside
Twelve sections and a tier appendix, about 2,000 words.
Every bracketed field marks a decision your organization makes, such as who approves tools or how quickly incidents are reported. The rest is written ready to adopt.
- 1. Purpose and scope
Who and what the policy covers, including contractors and AI features inside other software.
- 2. Definitions
AI system, generative AI, agent, approved tool, the four data classes and the three risk tiers, in plain words.
- 3. Roles and accountability
Who owns the policy, who approves tools, what every user is responsible for.
- 4. Approved tools and what data may go where
The one table everyone must know: public, internal, confidential and regulated data against consumer tools, approved enterprise tools and assessed systems.
- 5. Permitted and prohibited uses
Clear lists of what staff may do with AI and what they may not.
- 6. Human review by tier
What has to happen before launch and in operation for high, medium and low-risk uses, and how often each is reviewed.
- 7. Buying, building and connecting AI
Intake, vendor review and the rules for connecting AI to company systems and data.
- 8. Transparency and notices
When customers, applicants and employees must be told that AI is involved.
- 9. Security, privacy and incidents
Access, logging, and how to report and handle an AI incident.
- 10. Training
Who needs which level of AI literacy, and how it is recorded.
- 11. Exceptions
How to ask for one, who decides, and how long it lasts.
- 12. Review and approval
Sign-off, version history and the review schedule.
Read before you download
Three sections in full.
Sections 1, 4 and 5 as they appear in the template (version 1.0, last reviewed October 16, 2026). Bracketed fields are the decisions your organization makes; the italic notes are guidance you delete before you publish.
1. Purpose and scope
This policy governs the use of artificial intelligence by [Organization] and by anyone acting on its behalf, including contractors and vendors operating AI for us. It applies to every AI system we buy, build, embed or use, including AI features inside existing software and AI agents that act in our systems. Its purpose is to let us use AI for [the organization's purpose] while protecting our customers, our people, our data and our obligations.
Scope should name the obvious exceptions explicitly (for example, personal use on personal devices with no company data) so that nobody argues the policy does not apply.
4. Approved tools and what data may go where
The Approved Tools list is maintained by the AIMO at [location]. The table below is the rule everyone must know.
| Data class | Public or personal AI tools (no contract) | Approved enterprise tools (contractual data terms) | Systems assessed for regulated data |
|---|---|---|---|
| Public (already published) | Allowed | Allowed | Allowed |
| Internal (not sensitive, not public) | Never | Allowed | Allowed |
| Confidential (plans, code, contracts, financials) | Never | Allowed where the contract permits and the tool is listed for it | Allowed |
| Regulated (personal, health, financial, children's, biometric, contract-protected) | Never | Never | Only in the system assessed and approved for that data |
If a tool is not on the Approved Tools list, treat it as a public tool. Ask the AIMO to add a tool rather than using it in secret; registration takes two lines.
Why a table and not a ban: our briefing on the Samsung leak and shadow AI sets out the evidence.
5. Permitted and prohibited uses
Permitted, under this policy
- Drafting, summarizing, translating, classifying and analysing with approved tools and permitted data.
- Writing and reviewing code in approved tools under the engineering standards.
- Customer-facing use through systems that passed intake and risk assessment, with the required human review.
- Agents that act in our systems, within the autonomy level, permissions and limits approved for each action.
Prohibited
- Entering regulated or confidential data into tools not approved for it.
- Letting an AI system make a Tier 1 decision without the human review this policy requires.
- Presenting AI output to customers, regulators or courts without verification.
- Using AI to profile, surveil or evaluate people outside an approved, assessed system.
- Granting an AI agent credentials belonging to a person, or write access it does not need.
- Uses prohibited by law, including those listed in [applicable laws, e.g. the EU AI Act Article 5].
Tier 1 systems make or materially influence decisions about people, money, safety or legal rights (section 2 defines all three tiers; section 6 sets the review each needs). The full template, with the other nine sections and the tier appendix, comes in Word and PDF with the AIMP certification: students unlock it when they complete lesson 1.2.
Questions
Before you adopt it.
How do I get the full template?
Sections 1, 4 and 5 are published free on this page. The full template, in Word and PDF, is part of the AIMP toolkit: AIMP students unlock it when they complete lesson 1.2 of the course, and AIMP holders have it in their library.
What is an AI acceptable use policy?
It is the document that tells staff which AI tools they may use, which data may go into which kind of tool, which uses are prohibited, when a person must review AI output, and how to report a problem. It is usually the first AI governance document an organization adopts.
Can I use it for employees in any country?
It is written to be adapted. It follows the structure that common frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 expect, but the obligations that apply to you depend on where you operate. Have it reviewed before you adopt it.
Is this legal advice?
No. The template is educational material and a starting point. Have legal, privacy and security review it before it creates obligations for your organization.
Newsletter
The IAIM Briefing
A monthly summary of what changed in AI regulation, governance and practice, with the sources for every item. Free. Unsubscribe in one click. See a sample issue.