Fewer than a quarter of organizations have a formal, enforced AI acceptable use policy — and most of the ones that exist were written once, buried in a compliance portal, and never looked at again. A policy nobody reads doesn't govern anything. Below is a practical template you can adapt directly, plus the guidance on what actually makes it stick.
Why Most AI Policies Fail
The typical failure mode isn't a missing policy — it's a policy that was written by legal in isolation, phrased in language employees don't parse under deadline pressure, distributed once via email, and never paired with any way to actually enforce it. Employees who never read it default to whatever gets the task done fastest. The policy exists; the behavior it was supposed to govern doesn't change.
An effective AI acceptable use policy does three things a typical one skips: it's short enough to actually read, it's paired with a real enforcement mechanism (not just a promise of consequences), and it names approved tools instead of only prohibiting unapproved ones — because "don't use AI" without an alternative just pushes usage underground.
The Template
Adapt the sections below to your organization's specifics. Keep the tone plain — this document works only if people actually read it.
1. Purpose & Scope
This policy governs the use of artificial intelligence tools — including chatbots, AI writing assistants, AI coding assistants, and any application that sends data to a machine learning model — by all employees, contractors, and third parties acting on behalf of [Company]. It applies regardless of whether the tool is provided by the company or accessed independently.
2. Approved Tools
The following AI tools are approved for work use under the conditions listed: [list tools, e.g., "WeeBie-governed access to OpenAI/Anthropic/Azure OpenAI via the company gateway"]. Tools not on this list require approval per Section 5 before use with any company data.
3. Prohibited Data Categories
The following data must never be entered into an AI tool that is not explicitly approved for that data category: personally identifiable information (PII), protected health information (PHI), payment card data, authentication credentials or API keys, unreleased financial results, source code for proprietary systems, and any data classified Confidential or Restricted under [Company]'s data classification policy.
4. Personal Accounts
Personal AI tool accounts (i.e., not provisioned or managed by the company) may not be used to process company data, regardless of the tool's stated privacy terms.
5. Requesting a New Tool
To request approval for an AI tool not currently on the approved list, submit a request to [team/email]. Requests are reviewed within [X] business days against security, privacy, and data-handling criteria.
6. Monitoring & Enforcement
AI usage through company-provisioned tools and networks is logged and monitored for policy compliance. Violations are handled under [Company]'s standard conduct policy, escalating from coaching for first-time inadvertent violations to formal action for repeated or willful violations.
7. Incident Reporting
If you believe sensitive data was submitted to an AI tool in violation of this policy, report it immediately to [security contact/email]. Reports made in good faith will not result in punitive action for the act of reporting.
8. Review Cycle
This policy is reviewed every [90 days / 6 months] and updated as approved tools, regulations, or the threat landscape change. Last reviewed: [date].
What to Customize Before You Ship It
- The approved tools list is the single highest-leverage line item. A policy with no approved alternative reads as "AI is banned" to most employees, who will use it anyway. Naming a governed path is what actually changes behavior.
- Data categories should match your existing classification scheme, not invent a new one — reuse whatever labels (Public/Internal/Confidential/Restricted, etc.) your organization already trains employees on.
- The approval SLA has to be real. If "submit a request" means a two-month wait, employees will route around the policy. A fast, visible review process is what keeps people inside it.
- Monitoring can't be a bluff. Section 6 only has teeth if AI usage actually is monitored. Say so honestly — if you don't yet have visibility into AI traffic, that's the first gap to close, not the policy language.
Rolling It Out So It Actually Sticks
- Pilot with one team first. Run the policy and the approval process with a single department before company-wide rollout. You'll find the friction points before they become company-wide complaints.
- Pair the policy with training, not just an email. A 15-minute walkthrough with real examples ("here's what redaction looks like, here's what gets blocked") lands better than a linked PDF.
- Make the approved path the easy path. If the sanctioned tool is slower or clunkier than the unsanctioned alternative, the policy will lose regardless of what it says.
- Put visibility behind the policy. A policy that says usage is monitored needs an actual system generating that visibility — request-level logging, PII detection, and an audit trail an auditor or investigator can query, not just server access logs.
- Revisit on a fixed schedule. AI tooling changes fast enough that a policy written a year ago is likely already out of date on which tools are "approved."
The Enforcement Gap Most Policies Have
The section every policy template includes and few organizations can actually back up is Section 6 — monitoring. Writing "AI usage is monitored" doesn't make it true. Enforcing prohibited data categories requires a system that inspects the actual content of AI requests, not just knows that a request to an AI provider occurred. This is the gap a self-hosted AI gateway closes: it puts the policy's Section 3 (prohibited data) and Section 6 (monitoring) into an actual technical control, scanning requests for PII and other restricted categories in real time and producing the audit record Section 7's incident reporting needs to investigate anything.
A policy is necessary but not sufficient. It sets the rule; a governed gateway is what makes the rule enforceable rather than aspirational.
The Bottom Line
The best AI acceptable use policy is the one people actually follow, and people follow policies that are short, paired with a real approved alternative, and backed by enforcement that's visible rather than theoretical. Start from the template above, cut anything that doesn't apply to your organization, and don't publish Section 6 until it's true.