What is an AI acceptable use policy?
An AI acceptable use policy is a short document that tells your team how they may use AI tools at work: which tools are allowed, what information must never go into them, and how AI output is checked before anyone relies on it. It protects your customers’ information and your business’s name, and it saves everyone guessing.
What should it cover?
Six things, in plain words:
- Approved tools. A list of the AI tools people may use for work, and how to ask for a new one.
- Information that stays out. What must never be typed, pasted or uploaded into an AI tool.
- Checking the output. Who reviews AI-written work before it goes to a customer, into the books or into a contract.
- Being open about AI. When customers should be told that AI wrote or answered something.
- Accounts and access. Business accounts for work, and what happens when someone leaves.
- Ownership and problems. Who owns the policy, who to tell when something goes wrong, and when the policy is reviewed.
The template
Copy the text below into your own document and replace everything in [square brackets].
[Business name]: policy on using AI tools at work
Effective from [date]. Owner: [name and role]. Next review: [date, for example in 12 months].
1. Why we have this policy
We use AI tools to save time on routine work. This policy explains how to use them safely, so we protect our customers’ information, our own information and our good name.
2. Who it applies to
Everyone who works for or with [business name]: employees, contractors and anyone else using our systems or acting on our behalf.
3. Approved AI tools
You may use these AI tools for work, with a business account set up by [name or role]:
- [Tool name], for [what it is used for]
- [Tool name], for [what it is used for]
To use any other AI tool for work, ask [name or role] first. Don’t sign up for AI tools for work with a personal account.
4. Information that must never go into an AI tool
Unless [name or role] has confirmed in writing that the tool is approved for it, never put any of this into an AI tool:
- customers’ personal information, such as names with contact details, account numbers or payment details
- health, financial or legal information about any person
- passwords, access codes or security details
- our financial records, pricing or contracts that aren’t public
- anything a customer or supplier has asked us to keep confidential
When in doubt, leave it out, or remove names and details first.
5. Checking what AI produces
AI tools can be wrong, out of date or make things up. Before you use AI output:
- read it in full and check facts, figures, names and dates against the source
- never send AI-written work to a customer, or use it in the books, a quote or a contract, without a person checking it
- the person who sends or files the work is responsible for it, whoever or whatever drafted it
6. Being open with customers
Tell customers when they are talking to an AI tool, for example an AI receptionist or chat assistant, and give them a way to reach a person. [Add any line of work rules that apply to you.]
7. Accounts and access
Use only business accounts for AI tools at work. When someone leaves, [name or role] removes their access the same day.
8. Problems and questions
If you think information went into an AI tool that shouldn’t have, or AI output caused a mistake, tell [name or role] straight away. Nobody is in trouble for reporting a problem quickly.
9. Review
[Name or role] reviews this policy every [12] months, and sooner if we add a new AI tool.
Signed: [name], [role], [date]
How do you roll it out?
Keep it short and make it real. Fill in the tools you actually use, walk the team through it in ten minutes, and ask each person to confirm they’ve read it. Review it when you add a tool. If you work with health, financial or legal information, check the policy with an adviser who knows your line of work before you rely on it.
Which AI tools would go on the approved list?
That depends on the jobs you hand to AI. Plainscout compares tools by job, with prices and the security and compliance claims each vendor makes on its own pages: start with AI receptionists, AI bookkeeping software or AI estimating software, or see all jobs.