Your AI use policy, before you turn AI on
This is nearly always the first task on the action plan, and it's also the one most companies push to next month, and then the month after that. Our AI Acceptable Use & Governance Policy template does most of the work. It comes with a list of approved tools, plain rules on what people may and may not do with them, a four-level data classification scheme, the security requirements, and a page at the back for every employee to sign. You fill in the blanks and send it to counsel.
The template opens as a web page laid out for printing, so your browser's print command (or save as PDF) turns it into the finished document.
Why the policy comes first
Your employees are already using ChatGPT, Claude and Copilot. Ask them. Most have never been told what's allowed, so they've made up their own rules, and some of those rules involve pasting the customer list into a chat window. We call that shadow AI, and it comes with three risks that the assessment surfaces before it finds anything else:
- Unclear policies. Without written rules, employees do not know what is allowed, what is prohibited or how to use AI tools responsibly.
- No strategic roadmap. Random adoption produces duplicate tools, wasted spend and missed value.
- Untrained users. People who paste customer data, financials or trade secrets into public AI tools create data exposure and compliance findings.
On the scoring rubric, a policy that's been approved and signed moves the governance factor from the bottom band to the middle all by itself. Enforcing it with technical controls, approved apps on and unapproved apps off, is what moves it to the top.
1 to 2: no formal policy, AI use unmanaged. 3 to 4: drafted, not approved or enforced. 5 to 6: approved, approved platforms defined. 7 to 8: enforced through technical controls with a review cadence. 9 to 10: part of enterprise risk management with executive reporting. See the full rubric →
What the template covers
Eight sections, plus a one-page quick reference meant to be printed and taped next to the keyboard.
Purpose & scope
Who the policy covers, which is employees, contractors and consultants, and what it covers, which is every generative AI tool, every AI feature that has quietly appeared inside your productivity apps, and anything custom you build.
Approved AI tools
A table of the tools you've approved, the versions, and what each one may be used for. Underneath it, one rule in bold: nothing off this list touches company data.
Acceptable use guidelines
What's allowed, such as drafting, summarizing public information and brainstorming, and what isn't: final decisions about people, and anything that amounts to legal, medical or financial advice.
Data classification
Four levels, Public through Restricted, and a plain answer for each on whether it may go into an AI tool.
Security requirements
Company accounts only, MFA on everything, opting out of model training where the vendor allows it, checking outputs before relying on them, and who to call when something gets pasted that shouldn't have been.
Compliance requirements
Ready-made sections for healthcare, financial services and government contractors, with room to add whatever regulations apply to you.
Monitoring & enforcement
What the company reserves the right to monitor, and what happens on a first, second and serious violation, from retraining up to termination.
Employee acknowledgment
A signature page, plus the quick reference card: the short list of things never to put in an AI tool and the short list of things to always do.
Data classification
| Level | Description | AI usage |
|---|---|---|
| Public | Information intended for public disclosure | Allowed |
| Internal | Non-sensitive business information | Approved tools only |
| Confidential | Sensitive business or customer data | Prohibited |
| Restricted | PII, PHI, trade secrets | Strictly prohibited |
🚫 Never put these in AI tools
- Customer personal information (PII, PHI, financial data)
- Proprietary information: trade secrets, financials, strategic plans
- Confidential employee information
- Intellectual property: source code, patents, designs
- Login credentials, API keys or passwords
- Contract terms, pricing, legal or privileged documents
✅ Always
- Use approved AI tools only, with a company account and MFA
- Verify AI output before you rely on it
- Report accidental disclosure immediately
- Complete the required AI training
- Ask IT when unsure
Rolling it out
Five steps that take the governance factor from a draft on someone's desk to a control that's actually enforced.
Customize
Fill in your approved tools, the regulations that apply to your industry, and who people should report to. Then have counsel read it.
Approve
Leadership signs it and names one person as the policy's owner.
Communicate and train
Every employee signs the acknowledgment and completes the awareness training. See AI training.
Enforce
Approved apps allowed, everything else blocked at the tenant level so nobody has to remember the rule, and DLP policies tuned to the four classification levels.
Review
Read it again at least once a year, and every time a new tool gets approved. Put AI use on the leadership agenda on a schedule, so the policy doesn't turn into a document nobody has looked at since the year it was written.
Need the policy adapted to your industry?
The guided evaluation comes with the full policy template library and a working session where our engineers fit it to the way your business actually runs.