AI acceptable use policy: what to include, with an example

An AI acceptable use policy tells staff which AI tools they may use at work, for what, with which information, and how AI output is checked before anyone relies on it. Here's what a complete one covers, a real example, and a free template to start from.

What it should cover

Approved tools and purposes

Which AI tools staff may use, under which account, and what each may be used for. Anything not listed needs approval first.

Data rules

What may go into each tool, what must never go in (such as personal or confidential information), and what must be removed first.

Prohibited uses

Uses that aren't allowed at all, written as plain examples staff will recognise from their own work.

Checking AI output

Who reviews AI-generated text, figures and summaries before they're relied on or sent, and how closely.

Decisions about people

Whether AI may make or help make decisions about customers, patients or staff, who stays responsible, and how people are told.

Telling people

When customers or others are told that AI was used, for example with a chatbot or AI-generated content.

Accounts and security

Business accounts rather than personal ones, settings such as training on your data, and who manages access.

Reporting problems

How staff report a mistake, a data leak or a tool behaving unexpectedly, and who they report it to.

Training and sign-off

A short induction before first use, a signed acknowledgement, and when the policy is reviewed.

An example

Word for word from a pack written for a fictional dental practice in Australia with 12 staff that uses ChatGPT, Microsoft Copilot and the AI scheduling assistant in its practice software. Parts are left out for length.

Approved AI tools and how they may be used

Only the three tools listed below are approved. For each, the approved purpose, the excluded uses and the data rules are stated. The data rules match the AI Tool Inventory exactly.

ChatGPT

May be used for: drafting generic patient reminder wording from approved templates (business owner: Reception Team Lead), and summarising supplier emails and invoices with patient details removed (business owner: Practice Manager).
Must not be used for: any message that contains a named patient, clinical advice or content, decisions about fees, refunds or payment plans, or approval of a supplier payment.
Must never receive: patient names, patient contact details, appointment history or health information from notes.

AI scheduling assistant in the practice software

May be used for: suggesting and making appointment bookings, moves and cancellations within the practice software only (business owner: Reception Team Lead). It may receive patient names, patient contact details and appointment history within the practice software.
Must not be used for: booking or moving clinical appointments without a staff member confirming the slot, or for work outside the practice software. Its outputs MUST NOT be copied into ChatGPT or Microsoft Copilot.
Must never receive: health information from clinical notes.

Prohibited uses

MUST NOT enter health information from clinical notes into ChatGPT or Microsoft Copilot. For example, a Dentist pastes a periodontal note into ChatGPT to help write a recall message. The correct approach is to use generic recall wording in ChatGPT and add the patient-specific detail inside the practice software.
MUST NOT enter patient names or contact details into ChatGPT or Microsoft Copilot, including to personalise a message or to correct a number. A Dentist asking ChatGPT to "fix the wording for Mrs Lee's hygiene reminder" has already broken this rule.
MUST NOT pay or approve a supplier invoice on the strength of an AI summary alone. An AI summary that misstates a unit price and leads to an incorrect payment is a reportable incident.

See the whole sample pack or the samples for the UK, EU and US.

Start with a free AI policy

Answer a few questions and get a short AI use policy for your organisation, free. Confirm your email to copy it or download it as a Word document. No account needed.

Rules that shape it, by region

Australia

From 10 December 2026, organisations covered by the Privacy Act must explain in their privacy policy when computer programs, including AI, make or help make significant decisions about people using personal information.

The 10 December rule explained

United Kingdom

UK GDPR and the Data Protection Act 2018 apply to personal data entered into AI tools, and the Data (Use and Access) Act 2025 changed the rules on significant automated decisions.

UK automated decision rules

European Union

The EU AI Act has required organisations using AI to take measures to support their staff's AI literacy since 2 February 2025 (Article 4, as amended in 2026), and its transparency duties, such as telling people they're talking to a chatbot, have applied since 2 August 2026.

The EU AI Act for small businesses

United States

There's no general federal AI law for businesses, but state laws apply, such as Colorado's and California's rules on automated decisions from January 1, 2027.

Colorado and California rules

Checked 5 November 2026. General information, not legal advice.

Need more than a policy?

The AI Policy & Risk Pack is written from your answers about how your organisation uses AI, for Australia, the UK, the EU or the US. Preview every section free before you pay. It's a starting point to review and adopt, not legal advice.

AI Acceptable Use Policy
AI Risk Checklist
AI Risk Register
Transparency & Disclosure Notices
Rollout Plan and Adoption Guide
AI Tool Inventory
Staff Acknowledgement Form
Management Summary

Questions

What is an AI acceptable use policy?

A document that tells staff which AI tools they may use at work, for what, with which information, and how AI output is checked. It's usually the main document in an organisation's AI policy.

Is it the same as an AI policy?

Mostly. "AI policy" can also mean a broader set of documents, such as a risk register, a tool inventory and customer notices. The acceptable use policy is the part staff read and sign.

Do small businesses need one?

If staff use AI tools at work, including AI features built into software you already use, a short written policy helps everyone follow the same rules. A small business needs a shorter policy, not none.

Should staff sign it?

Yes. A signed acknowledgement shows each person has read the policy, and gives you a record if something goes wrong. It isn't legal advice, and it works best once it names your actual tools.