What an AI use policy must cover
Scope. Name everyone covered, including contractors and temporary staff, and every kind of tool. ChatGPT and Claude are the obvious ones. AI inside email, documents, CRM and practice-management software counts too, along with meeting note-takers, browser extensions and coding assistants.
Approved tools. List each tool by product, plan and account type. Approve it once you can answer where prompts are processed, how long they are kept, whether they train models, and which contract supports those answers. A firm handling health information also needs a business associate agreement with a cloud service that stores or processes it.
Data that stays out. Passwords and API keys never go into an AI tool. Client personal information, health information, financial data, and material under a client agreement or NDA stay out unless the policy owner approves the exact tool, account, data and purpose in writing. Replace names and numbers with placeholders, and leave information out when unsure.
Review of output. A person checks AI output before it reaches a client, is published, or informs a decision, and stays responsible. NIST’s Generative AI Profile identifies confabulation (confident output that is false) as a core risk, so check facts, figures and citations against their sources.
Disclosure to clients. Say where clients learn how the firm uses AI and check contracts first. ABA Formal Opinion 512 says a lawyer needs informed consent before entering information about a representation into a self-learning AI tool; boilerplate consent is not enough.
Incidents. Give one reporting contact, one channel and a time limit, and preserve the conversation. HIPAA sets an outside limit of 60 days from discovery for notice to individuals. The FTC Safeguards Rule requires a report within 30 days when unencrypted information about 500 or more consumers is acquired without authorization.
Training, ownership, and review. Train people before access and collect an acknowledgment. Name one owner who approves tools and exceptions, keeps a decision log, and reviews the policy on a schedule and after incidents. NIST AI RMF groups these practices under Govern.
Copy this AI use policy template
AI acceptable use policy
Company: [company name] · Owner: [name or role] · Effective date: [date]
1. Scope
This policy applies to every employee and contractor who uses an AI tool for [company name], including tools reached through a website, app, browser extension, coding assistant, or API.
2. Approved tools
Use only these company-approved AI tools for work: [list tools and approved accounts]. Ask [owner] before using another tool or connecting one to company data.
3. Data that must never go into AI tools
Never enter customer records, personal data, passwords, API keys, account numbers, confidential company information, or material covered by a client agreement unless [owner] approved the exact tool, account, data and purpose in writing.
4. Review of output
A person must check AI output before it is sent to a customer, published, used in code, or used to make a decision. The reviewer remains responsible for accuracy, confidentiality, tone and the final action. Review who stays responsible for AI output.
5. Reporting
Report accidental disclosure, unsafe output, unexpected behavior, or a suspected breach to [reporting contact] through [channel] as soon as found. Preserve the prompt, output, time and tool name when safe.
6. Owner
[Owner] approves tools and exceptions, answers questions, records decisions, and reviews this policy on [schedule] and after an incident or material tool change.
Back the rules with a control
A written rule tells people what to do but does not prove it held. Put a technical check where a prompt leaves the device, then test it with made-up client details. See Enforced or written down?.
AI usage policy against acceptable use policy
The names describe one document. An AI usage policy, a generative AI policy, and an AI acceptable use policy all set which AI tools people may use for work, which information stays out of them, who checks the output, and who owns the rules. Acceptable use policy is the name many companies already give their rules for email, devices, and the internet, so some add AI as a section of that policy and others keep a separate AI policy. Either works when it covers the parts above and names one owner.
Why not ban AI instead?
A ban moves AI use where nobody can see it. An approved path with clear data rules keeps work visible. Read Should a company ban AI at work?.
Frequently asked questions
- What is an AI acceptable use policy?
- A company rule defining who may use AI, approved tools, restricted data, output review, problem reporting, and ownership.
- What should be included in an AI policy?
- Include scope, approved tools, restricted data, human review, disclosure, incidents, training and a named owner.
- How do you write an AI usage policy?
- List people and tools in scope, restricted data, review, one reporting route and an owner, then have counsel review it.
- Does a company need an AI policy?
- A company allowing AI at work needs rules employees can find and follow, matched to its real tools, data, contracts and process.
- Can I use an AI policy generator to write our policy?
- A generator supplies a generic draft. A usable policy needs the real tool list, data rules, reporting channel, owner and counsel’s review.
- How do I add an AI policy to an employee handbook?
- Add training and acknowledgment clauses, connect violations to the handbook’s disciplinary section, and have counsel review it.
- What data should employees never put into ChatGPT or Claude?
- Passwords and API keys never belong in a prompt. Keep personal, health, financial, confidential and contract-restricted information out unless the exact use is approved in writing.
- Do we need a lawyer to review our AI policy?
- Yes. Counsel should review the draft against contracts, workforce rules, industry and location before adoption.