How to Write an AI Acceptable Use Policy (2026)

Here is the awkward truth most leadership teams are still catching up to: your staff are already using AI at work, and a lot of them are doing it in ways you have not approved. A 2026 PagerDuty survey of office professionals found that 66% had used AI tools at work even though they believed company policy prohibited it. Deloitte's UK research put the share of generative-AI users who hide it from their employer at 31%. And according to the IBM Cost of a Data Breach report, only about a third of organisations require any formal approval before an AI tool gets used.

So the real choice is not "allow AI or ban it." That decision was made for you months ago, in the gap between what you wrote down and what people actually do. The choice is whether that usage happens inside a few clear rules or in the dark, where a paralegal pastes a client contract into a free chatbot and nobody finds out until it matters.

An acceptable use policy is how you close that gap. Done well it is short, readable, and permissive enough that people follow it instead of routing around it. This guide covers what belongs in one, the rules that actually carry weight, and a starter template you can adapt in an afternoon.

Why a one-line ban backfires

The instinct, when the risk feels big, is to write "do not use AI tools for company work" and move on. It never holds. The tools are too useful and too available, so a blanket ban does not stop usage, it just stops people telling you about it. You trade a visible, manageable risk for an invisible one.

The numbers above are the proof. Two thirds of people use AI despite thinking it is against the rules, which means the rule changed nothing except their willingness to admit it. A ban also punishes your most motivated staff, the ones trying to work faster, while doing nothing about the genuine hazards: confidential data leaving the building, a hallucinated figure landing in a client report, or a biased model quietly shaping a hiring shortlist.

A good policy does the opposite. It says yes to the common, low-risk uses, draws a hard line around the few things that are genuinely dangerous, and makes the safe path the easy path. People follow rules that let them get their work done.

What an AI acceptable use policy covers

A workable policy answers a handful of practical questions. You do not need a forty-page document. You need clear answers to these:

• Who it applies to. Employees, contractors, and anyone acting on the company's behalf. Say it plainly so there is no "I'm a freelancer, it doesn't apply to me" loophole.
• Which tools are approved. Name the ones people can use freely (say, your paid ChatGPT Team or Microsoft 365 Copilot seat), the ones that need a sign-off, and how someone requests a new one. A short allowlist beats a vague principle.
• What data can go in. This is the core of the whole document. Be specific about what is fine (public information, your own draft text) and what is never allowed (client data, personal data, credentials, source code, anything under NDA) in tools that are not covered by a company agreement.
• What needs a human check. Anything that goes to a customer, a regulator, or into a decision about a person gets reviewed by a human before it ships. AI drafts, people approve.
• Disclosure. When and how to flag that AI was involved, both internally and to clients, so nobody is surprised later.
• Who owns it. A named person or role answers questions and keeps the list current. A policy with no owner is a policy nobody updates.

A starter template you can adapt

Here is a plain-language skeleton. Copy it, change the specifics to match your tools and your risk tolerance, and keep the whole thing to a page or two. The goal is something a new hire can read in five minutes and actually remember.

AI ACCEPTABLE USE POLICY: [Company name]
Last updated: [date] · Owner: [role / name]

1. PURPOSE
   We encourage using AI to work better. This policy sets the few
   rules that keep that safe for our clients, our data, and us.

2. WHO THIS APPLIES TO
   All employees, contractors, and anyone acting on behalf of the
   company, on any device used for work.

3. APPROVED TOOLS
   - Use freely: [e.g. Company ChatGPT Team, Microsoft 365 Copilot]
   - Needs approval from [owner]: any other AI tool before work use.
   - To request a new tool: [how, and who decides].

4. WHAT YOU CAN AND CANNOT PUT INTO AI TOOLS
   Allowed: public information, your own draft text, non-sensitive
   internal notes, in approved tools only.
   Never allowed in non-approved tools: client data, personal data
   of any individual, passwords or keys, source code, or anything
   under NDA or marked confidential.

5. HUMAN REVIEW
   AI can draft. A person is responsible for anything that reaches a
   client, a regulator, the public, or a decision about an individual
   (hiring, credit, performance). Check facts before you send.

6. DISCLOSURE
   Tell your manager if AI materially shaped a deliverable. Follow any
   client contract terms on AI use. Do not present AI output as
   independently verified when it is not.

7. WHAT IS NOT ALLOWED
   - Using AI to make a final decision about a person with no human review.
   - Entering confidential or personal data into unapproved tools.
   - Passing off unverified AI content as fact.

8. IF SOMETHING GOES WRONG
   Report it to [owner] quickly. Early disclosure is treated as
   good judgement, not a mistake to hide.

Two notes on using it. First, map section 3 to tools you have actually licensed, because telling people to use "approved tools" without naming a paid, private option just pushes them back to the free consumer apps you were worried about. Second, keep section 4 ruthless and everything else generous. That balance is what makes a policy both safe and followed.

The rules that carry the most weight

If you are short on time, get four things right and the rest is detail.

Give people a good sanctioned tool. A policy that restricts AI without funding a private, paid option is just a ban with extra words. A company seat on a tool that does not train on your inputs removes most of the temptation to use something riskier. Governance and a real tool are the same project.

Protect the data, not the activity. Do not try to list every permitted task, you will never finish and the list will be wrong by Friday. Define the data instead. "Never put client or personal data into a tool we have not vetted" scales to tasks you have not imagined yet.

Keep a human on anything that touches a person or a customer. This is where the real liability sits, and in the EU it increasingly has legal weight: decisions about hiring, credit, and similar matters are exactly where regulators expect meaningful human oversight. Make "AI drafts, a person decides and signs off" the default for that category.

Name an owner. One role that answers questions, keeps the approved-tools list current, and reviews the policy a couple of times a year. Technology moves faster than annual reviews, so a living document with an owner beats a perfect one that ossifies.

Rolling it out so people actually follow it

A policy nobody reads protects nobody. Treat the launch as a change you manage, not a file you email once.

Announce it in plain language and explain the why, especially the data rule, with a concrete example or two. Point everyone at the sanctioned tools in the same message, so the first thing they learn is what they can do. Fold a two-minute version into onboarding so new hires get it on day one rather than discovering the rules by breaking them. And make reporting a problem genuinely safe: if admitting an early mistake gets someone scolded, the next person will hide theirs, and you are back to the dark.

Then revisit it. New tools appear, your approved list changes, and regulations keep moving. A quick review every six months, owned by the person in section 7, keeps it honest.

The companies handling AI well in 2026 are not the ones with the strictest rules. They are the ones whose rules are clear enough to follow and generous enough to make following them the path of least resistance. Write that policy, give people a real tool to go with it, and most of the shadow-AI risk you are worried about simply has nowhere to hide.