AI acceptable use policy: what to include, with examples

What is an AI acceptable use policy?

An AI acceptable use policy (often called an AI usage policy for employees) is the set of rules your people follow when they use artificial intelligence for work. It answers the questions staff actually ask: can I use this tool, can I paste this in, can I use my own account, and do I need to check the answer?

It is different from two related documents:

• Your general IT acceptable use policy, which covers email, internet and devices. AI needs its own rules because a single prompt can carry a whole contract or customer list, and because AI tools now act on people's behalf.
• An AI security policy, which is written for IT and security teams and covers inventory, access, logging, agent approval and incident response. The acceptable use policy is the staff-facing half of the same picture.

A good policy is short enough to read in a few minutes, specific about which tools are approved, and honest about how it is enforced. If your rules exist only on paper, people will route around them; that is how shadow AI starts.

Why UK organisations need one

Most organisations do not get to decide whether staff use AI. People already use chat assistants in the browser, AI features switched on inside SaaS tools, browser extensions, desktop apps and coding assistants. The policy decides whether that use is visible and governed or not.

There are practical reasons to write one now:

• UK GDPR accountability. When staff put personal data into an AI tool, your organisation is still the controller. You need a lawful basis, suitable terms with the provider and appropriate security. Our guide to AI and UK GDPR explains the obligations in plain English.
• Client confidentiality. Contracts, engagement letters and NDAs often restrict where client information can go. A consumer AI account is rarely on the approved list.
• Security. Credentials, source code and system details pasted into prompts are a gift to an attacker if they leak. See AI data leakage.
• AI literacy. If your organisation is in scope of the EU AI Act as a provider or deployer, its AI literacy obligations applied from 2 February 2025; the article has since been amended, so check the current text. Our page on whether the EU AI Act applies to UK businesses explains who is caught.
• Evidence. Clients, auditors and insurers may ask how AI is used. A policy, plus records of how it is enforced, is the simplest answer.

This is general information, not legal advice.

What to include in an AI acceptable use policy

These are the sections a workable policy usually needs. Our AI acceptable use policy template gives sample wording for each.

• Purpose and scope: who the policy applies to (employees, contractors, temporary staff) and which activities it covers, including AI features inside tools you already use
• Approved tools: a named list of AI tools staff may use, with the account type required (work account, single sign-on) and what each is approved for
• Personal accounts: whether staff may use personal or free AI accounts for work; most organisations say no, because the business has no contract or control over that data
• Prohibited data: the types of data that must not go into AI tools, or only into specific approved ones: personal data, special category data, client files, credentials, source code, unpublished financial results
• Uploads and files: rules for uploading documents, spreadsheets, images and recordings, not just typing prompts
• Checking output: a duty to review AI output for accuracy, bias and confidentiality before it is sent, published or used in a decision
• Agents, extensions and connectors: AI browser extensions, desktop AI apps, AI agents and Model Context Protocol (MCP) connectors need approval before installation or connection to company systems
• Coding assistants: which assistants developers may use, and rules for source code, secrets and repository access
• Requesting a new tool: a simple route for people to ask for a tool to be assessed, so they do not quietly sign up for one
• Incident reporting: what to do if sensitive data was entered into the wrong tool, and who to tell
• Monitoring notice: a clear statement that AI use on company devices and accounts is monitored and that controls may warn, redact or block
• Ownership and review: who owns the policy and how often it is reviewed, given how fast AI tools change

AI acceptable use policy examples

Example clauses, written generically. Adapt them to your own tools, data and culture.

Approved tools. "You may use the AI tools listed in Appendix A for work, signed in with your work account. Using any other AI tool for work requires approval from the IT team."

Personal accounts. "Do not use personal or free AI accounts for work tasks, even for content that seems harmless. The organisation has no agreement with those providers about how your data is stored or used."

Prohibited data. "Do not enter, paste or upload the following into any AI tool unless Appendix A says that tool is approved for it: personal data about customers or colleagues, health or other special category data, client documents, passwords, API keys or other credentials, source code, and unpublished financial information."

Checking output. "You are responsible for anything you produce with AI. Check facts, figures, references and tone before you send or publish it, and do not present AI output as professional advice without review."

Agents and extensions. "Do not install AI browser extensions or desktop AI apps, or connect an AI agent or MCP server to company email, files, systems or code repositories, without approval."

Incidents. "If you think you have entered data into an AI tool that you should not have, tell the IT team straight away. Early reporting helps us limit the impact; you will not be penalised for reporting promptly."

Monitoring. "AI use on company devices and accounts is monitored to protect our data and our clients. Security tools may warn you, remove sensitive data from a prompt, or block an action that breaks this policy."

Making the policy real with Workforce AI Security

A policy tells people the rules. Check Point Workforce AI Security is a way to make those rules hold in practice, without relying on everyone remembering them. Based on Check Point's own material, it lets you:

• See what is really in use first: discovery of sanctioned and shadow AI apps, tools and MCPs, with an AI application catalogue you can search, so Appendix A reflects reality. See shadow AI discovery.
• Block unapproved tools: block employee access to unauthorised AI apps, and apply different policies to managed and unmanaged apps, so a work account and a personal account of the same service can be treated differently.
• Keep prohibited data out: contextual, AI-powered data loss prevention that detects personal data, credentials, source code and financial data in prompts, uploads and attachments, with inline redaction, copy and paste restrictions, and file and image redaction with OCR.
• Guide rather than just block: interactive user guidance at the moment someone is about to break the policy, which teaches the rule in context.
• Govern agents: runtime controls that block risky agentic actions, and rules against risky connections between AI tools and corporate resources.
• Show it is working: audit trails and customisable reports that support your compliance work.

AI used through web applications is covered by Workforce AI Security Essentials; desktop AI apps, coding assistants and agents need Workforce AI Security Enterprise. Our deep dive explains how Workforce AI Security works.

How to roll out an AI acceptable use policy

1. Discover current use. Run discovery with a pilot group so the policy is based on the tools people really use, not guesses.
2. Decide what to approve. Pick the business-grade tools you will support and the data each is approved for. An AI risk assessment for each tool makes this defensible.
3. Draft and consult. Write the policy with IT, HR, legal and your data protection lead. Check whether you need a DPIA; see AI DPIA.
4. Publish and collect acknowledgement. Keep it short, link it from your intranet and ask staff to confirm they have read it.
5. Train. Explain the why, with examples from your own organisation. Our sister site covers safe use of AI training.
6. Enforce in stages. Start by monitoring, then add warnings, redaction and blocking, so people adjust before they are stopped.
7. Review regularly. New tools and features arrive constantly; review the approved list and the policy on a set cycle and after any incident.

Blocking everything rarely works: people move to personal phones and laptops where you have no visibility. Our guide on how to block AI tools explains when to block and when to govern instead.

How Forever Systems helps

We help you get from a blank page to a policy that is enforced:

• We can run a discovery pilot with Workforce AI Security so your approved list is grounded in real usage.
• We help you turn each clause of the policy into a technical control: which apps are allowed, which are restricted with redaction or warnings, and which are blocked.
• We help you choose between Essentials and Enterprise based on how your people actually use AI, and confirm entitlements at quote.
• We can help you stage the rollout and review the results with you.

We do not provide legal advice; we work alongside your legal and data protection advisers. Pricing for Workforce AI Security depends on users, tier and term, so ask us for a quote. To talk about your AI acceptable use policy, contact us.