What is an AI acceptable use policy?Link to this section
It tells your people which AI tools they can use for work, what information can go into them, and who to ask when they're unsure. A good one is short enough to read in a few minutes and specific enough to apply to an ordinary email.
How do you use this template?Link to this section
- List the AI tools your organisation has approved, and any it hasn't. Our AI tool register template is one way to keep that list.
- Change each part in square brackets to your own details.
- Name who answers questions and who approves new tools.
- Share it with your people, and ask each person to confirm they've read it.
- Set a date to review it. AI tools change quickly, so every six to twelve months suits most organisations.
The templateLink to this section
The policy as your people will read it. Change each part in square brackets, and delete any section that doesn't apply.
[Organisation name] AI acceptable use policy
Version [1.0] · Approved [date] by [name or role] · Next review [date]
1. Why we have this policy
AI tools can help us do good work more quickly. This policy sets out how we use them, so you can use them with confidence, and so our clients, customers and colleagues can trust what we produce.
2. Who it covers
Everyone who works for or with [Organisation name], including employees, contractors and volunteers, whenever they use AI for our work or with our information.
3. The AI tools you can use
You can use the AI tools on our approved list for your work. The list says what each tool is for and any limits on it: [link to your list, or use the table below].
| Tool | Decision | What it's for, and any limits |
|---|---|---|
| [Tool and plan] | Approved | [Drafting, summarising and research] |
| [Tool and plan] | Approved with limits | [Internal work only. No client or customer information.] |
| [Tool and plan] | Not approved | Use [approved tool] instead. |
If a tool isn't on the list, ask before you use it for work (section 7). That includes free and personal accounts of a tool that is on the list, unless the list says otherwise.
4. What you can put into AI tools
Each approved tool lists the types of information it can be used with. As a guide:
- Published information and general questions can go into any approved tool.
- Internal work can go into tools approved for internal work.
- Client or customer information, information about staff, financial information and health information go only into tools approved for that type of information, and only when the work needs it.
- Passwords, security keys and [any other information your organisation never shares] never go into an AI tool.
If you're unsure which type of information something is, treat it as the more sensitive one, or ask.
5. Checking what AI gives you
AI tools can be wrong while sounding sure. You're responsible for anything you use, send or publish, whether or not AI helped with it.
- Check facts, figures, names and quotes before you rely on them.
- Read anything AI drafts before it goes to a client, a customer or the public.
- [Say when AI wrote a substantial part of something, where a client or the work expects it.]
6. Decisions a person makes
AI can help prepare decisions that affect people, but a person makes them: hiring, pay, performance, and anything else that could significantly affect someone. [Add any other decisions your organisation keeps for a person.]
Never use AI to create images, audio or video of a real person without their permission, or for anything that breaks the law or our other policies.
7. New tools and questions
To try a tool that isn't on the list, ask [name or role] first, and say what you'd use it for and which types of information would go into it. If you're not sure whether something is allowed, ask [name, role or channel] before you go ahead.
8. If something goes wrong
If information goes into an AI tool that it shouldn't have, or something AI produced causes a problem, tell [name or role] straight away. Reporting it early is always the right thing to do, and it's how we put things right quickly.
9. Your information
[Organisation name] may record which AI tools you use, and ask you about them, to decide which tools to keep and where people need help. [Say what you record, who sees it, and link to your privacy notice for staff.]
10. Reviews and changes
We review this policy every [six or twelve] months, and whenever we approve or retire a tool. When it changes, we'll tell you what changed and ask you to confirm the new version.
Confirmation
I've read this policy and I'll follow it.
- Name
- Date
What does the one-page version say?Link to this section
It's for your people to keep to hand. It points to the full policy, which still applies.
[Organisation name]: using AI at work
- Use the AI tools on our approved list: [list or link].
- Put in only the types of information each tool is approved for. Passwords and security keys never go in.
- Check what AI gives you. You're responsible for what you use, send or publish.
- A person makes decisions about people, such as hiring, pay and performance.
- Ask [name or role] before you try a new tool, or whenever you're unsure.
- If something goes wrong, tell [name or role] straight away.
- The full policy: [link].
What changes in the UK, Australia and New Zealand?Link to this section
Where to check the template against each country's privacy law, and which sections to adapt.
United KingdomLink to this section
Personal information is covered by the UK GDPR and the Data Protection Act 2018, so name them in section 9 and link to your privacy notice for staff. The Information Commissioner's Office (ICO) publishes guidance on AI and data protection, worth reading before you approve a tool for personal information in section 4. If your organisation also works in the EU, check whether the EU AI Act applies to any of your uses.
AustraliaLink to this section
The Privacy Act 1988 and the Australian Privacy Principles cover personal information. The Office of the Australian Information Commissioner (OAIC) publishes guidance on privacy and the use of commercially available AI products, including what to check before you choose one. From 10 December 2026, organisations covered by the Act that use software to make, or help make, decisions that could significantly affect a person must say so in their privacy policy, so list those uses beside section 6.
New ZealandLink to this section
The Privacy Act 2020 and its information privacy principles cover personal information. The Office of the Privacy Commissioner's guidance, Artificial intelligence and the information privacy principles, expects a privacy impact assessment before an organisation uses an AI tool with personal information, so add that step to section 7 for any tool that will see it.
Common questionsLink to this section
Is this template free to use?Link to this section
Yes. Copy it, change it and share it inside your organisation.
Do we need a policy if people only use one or two AI tools?Link to this section
Yes, if those tools see any of your organisation's information. A short policy tells people what can go into them and who to ask, and that matters as much for one tool as for ten.
How long should an AI acceptable use policy be?Link to this section
Short enough that people read it. The full template is about two pages, and the one-page version covers what most people need day to day.
Who should approve it?Link to this section
Whoever is answerable for how your organisation uses AI, usually the leadership team. Name them in the version line, so people know whose policy it is.
How often should we review it?Link to this section
At least once a year, and whenever you approve or retire a tool. AI tools change their features and terms often, and a review keeps the policy accurate.
How do we know people have read it?Link to this section
Ask each person to confirm they've read it, and keep a record. In The GAiGE, people read your policies in their AI Adoption Portal, and you see who has confirmed them.
Is this legal advice?Link to this section
No. It's a starting point for organisations that use AI tools rather than build them. Check it against the laws that apply to you, and with a lawyer if you're unsure.