How to Create an AI Acceptable Use Policy.
A practical framework for giving employees clear AI rules without creating a policy so restrictive that useful AI adoption moves underground.
A useful AI acceptable use policy should be short enough that employees will actually read it. It should define approved tools, prohibited data, when human review is required, how AI-generated work should be checked and who to ask before using a new AI service. The policy should enable sensible use — not simply ban AI and drive it underground.
Why SMEs need an AI acceptable use policy
Employees can adopt AI in minutes. Governance usually moves more slowly. Without a clear policy, different teams make their own assumptions about which services are approved, what can be uploaded and whether AI output can be used directly with customers.
UK government AI Management Essentials guidance focuses on organisational processes for responsible AI use, while the EU AI Act also places emphasis on AI literacy for organisations within scope. A lightweight policy, backed by staff awareness, is therefore a practical baseline rather than paperwork for its own sake. UK AI Management Essentials ↗
The policy structure
For most SMEs, the policy can be organised into eight practical sections. Keep the main employee document straightforward and put deeper technical controls into supporting standards or procedures where necessary.
Explain why the policy exists, who it applies to and which forms of AI are covered — including embedded AI, chatbots, agents and browser extensions.
Name the approved route for business use and make it clear that employees should not create unmanaged accounts for company work.
Define what data may be used, what needs approval and what is prohibited — especially secrets, personal data and confidential information.
Require employees to check important facts, calculations, references, legal language and customer-facing content before use.
Require separate approval for recruitment, employee decisions, customer eligibility, automated actions, regulated advice and other consequential workflows.
Set expectations for disclosing AI use where appropriate and for reviewing externally published AI-generated or manipulated content.
Give employees a simple route to report accidental data disclosure, unsafe output, unauthorised tools or an AI action that went wrong.
Name the policy owner, review cycle and process for approving new AI tools so the document can keep up with the technology.
Define the approved route clearly
A policy becomes much easier to follow when it tells people what they can use rather than only what they cannot. List the approved services, account type and intended use. For example, your business might approve Microsoft Copilot with work accounts and a managed ChatGPT Business workspace, while prohibiting company data in personal consumer AI accounts.
The distinction matters because providers can apply different protections to managed business services. OpenAI says business customer inputs and outputs are not used for training by default, and Microsoft says Copilot prompts, responses and Microsoft Graph data are not used to train foundation models. OpenAI business data ↗ Microsoft enterprise data protection ↗
Drafting and summarising ordinary business content
Using an approved managed AI service to draft internal communications, summarise non-sensitive material or brainstorm ideas.
Still requires normal judgement and checking before the output is relied on or sent externally.Working with internal company information
Using approved business AI with information the employee is authorised to access and that the system is approved to process.
Apply data minimisation and follow company classification, access and retention rules.Decisions affecting people
Recruitment, performance, disciplinary, eligibility or other consequential decisions should not be introduced casually.
Require an owner, documented review, human oversight and appropriate legal or specialist input.Secrets and unapproved data transfer
Passwords, API keys, recovery codes and unauthorised uploads of sensitive customer or employee data should be explicitly prohibited.
Employees should report accidental disclosure immediately rather than trying to hide the mistake.Make the data rules concrete
“Do not share sensitive data” is too vague. Employees need examples that reflect your organisation. The ICO's AI guidance reinforces existing data-protection principles, including security, transparency and data minimisation. ICO AI guidance ↗
Define when human review is mandatory
A useful policy should tell employees when AI output is only a draft and when it requires explicit human approval. The threshold should increase with the impact of a mistake.
Require human review before AI output is used for:
Adapt this list to your business and sector.
How to roll the policy out
Publish the policy alongside the approved tools and a short training session. The goal is for staff to understand the rules at the moment they need them, not remember a PDF they read six months earlier.
What to avoid
The bottom line
The best AI acceptable use policy is not the strictest one. It is the one employees understand, managers can enforce and the business can keep current as AI changes. Make the approved path easy, put stronger controls around higher-risk uses and give people somewhere to ask before they improvise.
Build your policy from authoritative guidance.
Use these sources when tailoring your AI policy to data protection, managed AI platforms and wider AI governance expectations.
External links open official third-party websites in a new tab. CloudSec AI does not control those sites and this article is practical technology and governance guidance rather than legal advice.
Make AI rules people will follow.
We can develop a practical AI acceptable use policy around your existing tools, data and workflows, then support implementation with staff guidance and appropriate technical controls.
Start a conversation ↗