Free 30-min call with LidiaCalls are in English or Finnish
Menu

Calls are in English or Finnish

Free 30-min call with Lidia

AI Acceptable Use Policy: a Short Template for Your Team

By · Published · 6 min read

An AI acceptable use policy is one page: which AI tools your people may use for work, what never goes into them, who checks AI output before a customer sees it, and who to ask. Copy the template below and adapt it in about an hour.

What you will take away

  • Why the account an employee uses matters more than the tool
  • What the EU AI Act's AI literacy article asks, briefly
  • A one-page template to copy, in nine short sections
  • Three ways to get people to follow it

An AI acceptable use policy is a one-page agreement inside your company that says which AI tools people may use for work, what information must never go into them, who checks AI output before it reaches a customer, and who to ask when something is unclear. Below is a template you can copy and adapt in about an hour. Keep it short: a policy that runs to twelve pages is a policy nobody opens, and then you are back where you started, not knowing what your people put into AI.

This article and the template are practical guidance, not legal advice. Check the final version with your own adviser, especially if you work with health, financial or children's data.

Why does a small business need one?

Try answering these about your own company. Which AI tools are your employees using right now, and on whose accounts? Has anyone pasted a client list, a contract or a price calculation into a free chatbot to "tidy it up"? If they did, would you know?

Nobody reads every chat, so that is not where the risk sits; it sits in the moment information leaves on a personal account, because from then on you no longer decide who keeps it or what it is used for. OpenAI, for example, says that on personal ChatGPT accounts content may be used to improve its models unless the user turns this off in the settings, while for its business and API products it states that it does not use your data for training by default. The same tool, two very different situations, and the only difference is which account the employee used. A policy states the rule; approved accounts, access settings and training help put it into practice.

It also protects your people. Most of them use AI with good intentions, to work faster, and nobody told them where the line is. Telling them is fairer than discovering the problem later.

What about the EU AI Act?

The AI Act has an article on AI literacy (Article 4), which applied from 2 February 2025. In July 2026 it was amended by Regulation (EU) 2026/1744: the current text asks providers and deployers of AI systems to "take measures to support the development of AI literacy" of their staff, and states that this does not require them to guarantee any specific level of AI literacy of any individual. A policy and a practical session can contribute to AI literacy. The measures should reflect the tools, tasks, staff knowledge and people affected. This template is not a compliance assessment. I would not, though, write a policy because of the law alone. Write it because you want to know where your company's information goes; the law is a side benefit.

The template

Copy this into a document, replace the parts in square brackets, and delete anything that does not apply to you.

[Company name] - How we use AI at work Version [1.0], [date]. Owner: [name, role]. Questions: [name or channel].

1. Why we have this. We use AI to save time on routine work. We also look after our clients' information and our own. This page says how we do both.

2. Approved tools. For work, use only these tools, on company accounts:

  • [Tool 1, plan, who has access]
  • [Tool 2, plan, who has access] Approval covers the specific task, permitted data, access and retention settings. A business subscription alone does not authorise us to upload personal or confidential information. Personal AI accounts are not used for company work. To suggest a new tool, ask [owner]; we check how it handles data before we approve it.

3. Never put into any AI tool:

  • passwords, access codes, API keys;
  • clients' personal data beyond what the approved process needs [list: e.g. ID numbers, health data, bank details];
  • contracts, prices or terms that are not public, unless the tool is approved for that in section 2;
  • anything a client gave us in confidence. If in doubt, do not upload it. Ask [owner] first. Removing names and numbers does not necessarily make information anonymous or suitable for an AI tool.

4. A person checks before it goes out. AI may draft emails, texts, summaries and calculations. Anything that reaches a client, a supplier or the public is read and approved by a person, who is responsible for it as if they wrote it. AI output is a draft, not a source: facts, figures and legal statements are checked against the original.

5. Be open about AI. If a client talks to an AI assistant on our behalf, the assistant says that it is AI. We do not present AI-written text as a personal promise we have not checked.

6. Decisions about people. AI is not used on its own to decide about hiring, pay, performance or a client's access to our services. A person decides.

7. Mistakes and incidents. If you put something into AI that should not be there, or you see AI output that is wrong in a way that matters, tell [owner] the same day. We fix it; we do not look for someone to blame.

8. Costs. Subscriptions and usage limits are managed by [owner]. Do not connect paid AI services or add usage on your own.

9. Learning. New team members get a short introduction to this page and to the approved tools. We review this page every [six] months and when we add a tool.

I have read this page: [name, date]

How do you get people to follow it?

Three things make the difference.

First, give people a better option than the forbidden one. People may keep using personal accounts if the approved alternative does not help with their daily tasks. Approve a business plan for the tasks they really do.

Second, put AI where people already work. When AI suggestions appear inside the email, CRM or document tool your team uses every day, people do not need a separate window, and the policy becomes part of the routine instead of a rule to remember.

Third, keep the human check visible. In the UK government's 2025 survey of 3,500 businesses, 84% of those using AI kept at least some human input or checking on its results. Make it explicit who checks what, and it stops being a matter of individual habit.

From our own system I run my own work on a system of AI agents, and these are the rules it works under: there is a written list of what data may go to AI and what may not; passwords and API keys live in a separate encrypted vault and are passed only to the program that needs them, not typed into chats; and a person approves the templates, rules and company knowledge it works from and checks samples of what goes out. The template above is the small-business version of the same three ideas.

Where to go next

If you want to set up the approved tools and train your team on them, that is what my AI in your team service covers, and agreeing what data may go to AI is part of it. If you are still deciding where AI fits at all, start with how to implement AI in a small business: a 30-day plan, and for the question of how much freedom to give AI, read AI agents for small businesses. More articles are in the blog.

Talk it through

If you want a second pair of eyes on your draft policy, or help deciding which tools to approve, we can go through it in a free 30-minute call. Afterwards you get a short written outline with up to three tasks worth starting with.

Calls are in English.

Free 30-min call with Lidia

Sources