How to Write an AI Acceptable Use Policy for Employees (With a Sample Outline)

Your staff are already using AI tools. Someone is pasting meeting notes into a chatbot to get a summary. Someone else installed a browser extension that "writes better emails". A manager is asking an assistant to rank job applicants. None of this is necessarily bad, but without rules you have no idea which company data has gone where, and nobody knows what they're allowed to do.

An AI acceptable use policy (AUP) fixes that. It doesn't need to be long. The best ones fit on a page or two, use plain language, and answer the three questions employees actually have: Which tools can I use? What can I put into them? What am I still responsible for?

This guide walks through how to write one for a small or mid-sized organization, with examples and a short sample outline you can adapt.

Small businesses tend to stall on AI policy because it feels like it needs a lawyer, a committee and a risk framework. Those things help later. Right now, the biggest risks are simple and common:

A clear one-page policy published this month addresses all four. You can build the fuller program (tool intake reviews, an AI inventory, vendor contract terms) over the following quarter.

Pick one accountable owner. In a small business that's usually the IT lead, operations manager or whoever owns security. Name a second approver from HR or leadership. Write both into the policy header along with an effective date and a review date (at least annually; AI tools change fast, so six months is better).

Before writing rules, find out what's happening. A 10-minute anonymous survey works well:

Pair it with a quick technical check: browser extensions on managed devices, OAuth apps connected to your email and file storage, and AI features enabled in your existing SaaS admin consoles. The answers will tell you which tools to approve, which to block and where the real data risk is.

A tiered model is easier for staff than a long allow/deny list:

Keep the actual list on a separate page (an intranet page or shared doc) and link it from the policy, so you can update tools without re-approving the policy.

This is the most important section. Tie it to the data categories you already use, or define simple ones:

Add a tie-breaker: "When unsure, treat it as confidential and ask."

Worked examples help more than definitions. Include three or four:

AI output is a draft, not a source. The policy should say plainly:

Decide when people must disclose AI use. A practical rule: disclose when content is substantially AI-generated and it's customer-facing, published, legal, or the customer or contract requires it. Internal drafts usually don't need a label. Never present AI output as independently verified fact without checking it.

Mistakes will happen. Make it safe to report them quickly: "If you think you've put the wrong data into an AI tool, or you see unapproved AI use, tell [contact] right away. Reporting in good faith will not be held against you." That sentence does more for security than any monitoring tool.

Here is a short outline you can turn into a one- or two-page policy. Replace the bracketed fields.

Afterwards: add a simple intake form for new tool requests, keep a list of the AI tools and features in use, and check that the contracts for your approved tools cover data use, retention and training the way you expect.

This is general guidance, not legal advice. Have qualified counsel review your final policy, especially if you handle regulated data or operate in several jurisdictions.

Resources: Free 1-page AI acceptable use policy template · Full kit with a tool intake questionnaire, vendor AI clause checklist and NIST AI RMF workbook: AI Acceptable Use Policy Template + AI Governance Kit ($39; code LAUNCH30 takes 30% off paid kits through Oct 31, 2026). I make these templates.

Drafted with AI assistance and reviewed for accuracy.

Not affiliated with Microsoft or Google.