AI acceptable use policy

An AI acceptable use policy is a short, specific document that tells employees three things: which AI tools are approved for use at work, which categories of data cannot be entered into any external AI tool, and how to get a new AI tool reviewed before using it.

It is operational guidance that a person can read in five minutes and act on, written in plain language rather than legal language, and it works without banning the technology.

A working AI AUP has four components. An approved-tool list that names specific tools with any relevant conditions (enterprise mode required, no personal data, etc.). A data classification section that names the categories of data that cannot go into external AI tools, with examples. A vetting process that tells employees what to do when they want to use a tool that is not on the list. And a brief explanation of why each rule exists, which is what makes people follow it.

AI adoption moved faster than policy processes. A year or two ago, many organizations were still deciding whether AI tools were relevant to their work. By the time that question was answered, significant adoption had already occurred.

Writing a policy after adoption has started is harder than writing one before it. The policy has to account for tools already in use, avoid retroactively prohibiting things people find valuable, and be specific enough to be useful without being so restrictive that it is ignored.

The result is that many organizations have either no policy, or a policy that is too vague to change behavior. Neither is adequate given the data-handling implications of AI tool use at scale.

Without a policy, employees make independent decisions about what data is appropriate to share with AI tools. Most of those decisions are made with good intent and no specific guidance. Some will be wrong in ways that have consequences.

Regulatory. GDPR requires a lawful basis for transferring personal data to a third party. An employee using a consumer AI tool to process customer or employee data may be creating a compliance gap the organization cannot easily explain. A working AI policy, combined with an approved-tool list that only includes tools with appropriate DPAs, closes that gap.

Contractual. Client contracts and NDAs often include data handling restrictions. An AI policy that is specific about what constitutes covered information, with examples, reduces the risk of inadvertent breach.

Operational. Without a policy, there is also no framework for reviewing new tools before adoption. Every department makes its own evaluation, or makes none at all. Over time, the organization accumulates AI tool commitments with no central record and no consistent standard.