Most AI policy templates online sit behind a download form, or date from 2024 and say little more than "don't paste confidential data into ChatGPT". A policy like that doesn't stop much. In a 2026 survey of 1,250 office professionals at large companies, 86% believed their employer had AI policies in place, and 66% had used AI tools at work they believed weren't permitted. Rules that only forbid push AI use out of sight. The template below gives staff an approved way to say yes, and it's all here in the text, ready to copy.
What is an AI policy template?
An AI policy template is a ready-made AI usage policy that a company copies and fills in, setting out which AI tools staff may use, what data may go into them, who checks the output, and what happens when something goes wrong. You'll also see it called an AI use policy or an AI acceptable use policy. They're the same document.
This one is written for companies of roughly 20 to 1,000 people that already have staff using ChatGPT, Claude, Copilot, Gemini or the AI features inside software they pay for. It covers the policy itself, the clauses to add for your sector, and how to roll it out so people follow it. It isn't legal advice. Have counsel review the sections that touch employment law, privacy and your sector's rules before you issue it.
What should an AI usage policy include?
A complete policy settles ten questions. Most templates cover the first four and stop. The last six are where policies fail in practice.
| Section | What it settles | The line that matters |
|---|---|---|
| 1. Purpose and scope | Who and what it covers | It applies to everyone, leadership included, and to AI features inside existing software |
| 2. Approved tools | Which tools, on which plans | Work account only; a personal account isn't approved, even for the same product |
| 3. Data rules | What can go into which tool | Three classes of data, each matched to the tools allowed to receive it |
| 4. Checking output | Who is responsible for what AI produces | You own what you send; the more it matters, the more you check |
| 5. Decisions about people | Hiring, pay, discipline, firing | AI output alone never decides |
| 6. Being open about AI | When to tell people | Customers, meeting attendees and clients who have asked |
| 7. Agents and connected tools | AI that can act or reach systems | Approval, an owner, narrow access and an off switch first |
| 8. Asking for a new tool | How to get to yes | A named owner answers within a set number of days |
| 9. When something goes wrong | Mistakes and leaks | Stop, tell, fix, learn; reporting fast is never the problem |
| 10. Ownership and review | Who keeps it current | A named owner, a backup and a review date |
The data rules do the most work, because they turn "be careful" into a decision anyone can make in a few seconds. Sort information into three classes, and match each class to the tools allowed to receive it.
The AI policy template
Copy everything in this section into a document. Replace each [bracketed] item with your own details, and delete any bracketed option that doesn't apply. The approved tools list belongs in a separate page or spreadsheet that the policy links to, so you can change it without reissuing the policy.
[Company] AI Usage Policy
Effective [date]. Owner: [name, role]. Backup: [name, role]. Next review: [date, six months from now].
1. Purpose and scope
We want everyone at [Company] to use AI where it helps them do better work, and to do it safely. This policy says which AI tools you can use, what you can put into them, and who checks what comes out.
It applies to all employees, contractors and temporary staff, at every level including leadership, on any device, whenever you use AI for [Company] work. "AI tool" means any software that generates or analyses text, images, audio, code or data, including AI features inside software we already use, such as email, documents, meetings, our CRM and our applicant tracking system.
2. Approved tools
Use AI for [Company] work only through the tools on the approved tools list, signed in with your [Company] account. The list is at [link]. For each tool it names the plan we pay for, what it may be used for, and the highest class of data it may receive (section 3).
Personal accounts, free or paid, are not approved for [Company] work, even for a product that's on the list. Consumer plans often come with different data terms from the business plans we pay for.
If a tool you need isn't on the list, ask for it (section 8). Asking will never count against you.
A starting list looks like this:
| Tool and plan | Use it for | Highest data class |
|---|---|---|
| [Company AI assistant, on our business plan] | Drafting, summarising, research, analysis | [Internal or Confidential] |
| [AI features in our email and documents suite] | Drafting and summarising inside those apps | [Internal or Confidential] |
| [Meeting note-taker] | Notes of meetings where everyone has agreed | Internal |
| [Coding assistant, on our business plan] | Writing and reviewing code | [Internal] |
3. Data rules
Every piece of information falls into one of three classes.
- Public: already published, or meant for anyone. You may use it in any approved tool.
- Internal: everyday work that isn't meant for outsiders, such as drafts, plans, internal email and meeting notes. Use it only in approved tools, signed in with your [Company] account.
- Confidential: personal data about customers, staff or applicants; client files; health, financial and legal records; [source code]; unreleased financial results; anything covered by a confidentiality agreement. Use it only in a tool the approved list marks for Confidential data, and include only what the task needs.
Never enter passwords, API keys, access tokens or other credentials into any AI tool. If you aren't sure which class something is, treat it as Confidential and ask [owner].
4. Checking output
You are responsible for anything you use, send or publish, whether or not AI helped you make it. Before it leaves your hands, check its facts, figures, names, quotes and citations against the source.
The more it matters, the more you check. Work for a client, a contract, a regulatory filing, a public statement, or anything about a named person gets a second reader: [role]. Don't present AI output as the reviewed view of a professional unless one has reviewed it.
5. Decisions about people
Do not use content generated by a general-purpose AI assistant (a chatbot, or AI features in our everyday software) to decide, rank, score or recommend people for hiring, promotion, pay, discipline or dismissal[, or for a customer's access to our services, credit, housing, insurance or healthcare]. This applies to every tool on the approved list unless the list names it as an approved decision tool.
AI may help with the work around those decisions: drafting a job advert, summarising applications for a person who reads them all, or scheduling interviews.
A dedicated tool that scores, ranks or recommends people (an approved decision tool) may be used only after [HR lead] and [counsel] have approved it for that use and recorded the legal duties that come with it. A named person reviews its output before any decision and has the authority to overrule it. AI output alone never decides.
6. Being open about AI
Tell people when AI does something they would reasonably expect a person to do. A customer talking to an AI assistant should know it's an AI. Ask everyone's agreement before an AI note-taker records or transcribes a meeting. Follow any client contract or engagement terms about AI use; some forbid it or require you to say when you use it.
7. Agents and connected tools
An AI agent or integration that can act (send messages, change records, make purchases, run code) or that can reach company systems needs approval from [IT lead] before it's connected. Each one has a named owner, the narrowest access that does the job, a way to switch it off, and a record of what it did. Don't connect an AI tool to your work email, calendar, files or chat without that approval.
8. Asking for a new tool
Ask through [form or channel]. Say which tool and plan, what you'd use it for, and which class of data it would touch. [Owner] will reply within [10 working days] with yes, yes with limits, or no and the reason. When a tool is approved, it goes on the list for everyone.
If you've already been using a tool that isn't approved, tell [owner]. Telling us won't count against you. We'd rather know.
9. When something goes wrong
- Stop. Stop using the tool for that task.
- Tell. Tell [owner or IT security contact] the same day. For example: you put Confidential data into the wrong tool, AI output caused an error that reached a customer, or an agent did something it shouldn't.
- Fix. We'll work out with you what needs fixing and who needs to know.
- Learn. We'll change the policy, the list or the training so it doesn't happen again.
Reporting quickly is never the problem. Hiding a mistake is. Deliberately breaking this policy may lead to action under [disciplinary policy].
10. Ownership, training and review
[Owner] owns this policy, with [backup] as backup. Everyone completes [AI training] within [30 days] of joining and again when the policy changes. The owner reviews this policy and the approved tools list every [six months], and sooner if a vendor changes its terms or a law that applies to us changes. Send questions to [channel].
I have read this policy and will follow it. Name, date.
Why does an AI policy name the plan, not just the product?
Because the same AI product can come with different data terms on a consumer plan and a business plan, a policy that approves "Gemini" or "Claude" without naming the plan approves both. The vendors' own pages show the gap.
Google's Gemini Apps Privacy Hub says that with the Keep Activity setting on, "Google uses your activity to provide, develop, and improve its services (including training generative AI models)", and that "a subset of chats are reviewed by human reviewers". Its privacy hub for Google Workspace says the opposite for work accounts: "Your content is not human reviewed or otherwise used for Generative AI model training outside your domain without permission."
Anthropic draws the same line. On consumer Claude accounts, it uses chats to improve its models if the user chooses to allow it. For its commercial products, such as Claude for Work and its API, it says that "by default, we will not use your inputs or outputs from our commercial products" to train its models.
So the policy approves a plan, signed in with a work account, and treats a personal account as a different tool. Check the current terms of every plan on your list when you write it, and again at each review. Vendors change them.
AI policy examples: clauses to add for your sector
The template is the common core. Add the clauses for the work you do. These examples show the shape.
Law and accounting firms. "Client information goes only into tools where access is limited to the people working on that matter. Check every citation, quotation and figure in AI-assisted work against its source before it's filed or sent." For what the rules and recent sanctions mean for firms, see our guide to AI in law firms.
Healthcare and anyone handling patient data. "Protected health information goes only into tools covered by a signed business associate agreement with [Company], on the plan named in that agreement. Never in a consumer AI tool, including screenshots, pasted records and meeting transcripts."
HR and recruiting. Section 5 does most of the work. Colorado's new AI law adds a reason to write it down (see below). If you hire in Connecticut, our guide to the Connecticut AI law covers its notice and layoff duties.
Companies that write software. "Proprietary source code goes only into coding assistants on our business plan. Don't paste code from an AI tool into our products without reviewing it as you would a colleague's, including its licence."
Private equity portfolios. Issue one policy across the portfolio with a separate approved tools list for each company, so each can match its own contracts and data, while the rules for data, people decisions and incidents stay the same everywhere.
Why do AI policies fail?
AI policies fail when the approved way is slower or harder than the workaround, because staff who need AI to do their job will use it anyway, out of sight. The 2026 PagerDuty survey shows how wide the gap is. Of the 1,250 office professionals it polled at companies with revenue of $500 million or more, 66% had used AI tools at work they believed weren't permitted, and 88% had shared work-related information with public AI tools, including 34% who had put in customer data. Most of them, 86%, believed their employer had an AI policy.
The same survey found that 81% believe leadership works under different AI rules from everyone else. That's why the template's scope says "at every level including leadership". A rule the senior team visibly ignores isn't a rule.
Our framework calls these rules guardrails, and its test is that the safe way has to be the easy way. Three things in the template do that. The approved list says yes to specific tools rather than no to everything. The request route has an owner and a deadline, so asking is faster than working around. And the incident section rewards telling over hiding. Why bans drive AI underground, in module 3 of our free course, explains the pattern. Your starter guardrails, in module 2, builds the approved list, the data map and the output standard with you.
Do you need an AI policy by law?
For most companies the reason to have an AI policy is practical rather than legal, but a few laws now assume you have one, and employment is where they bite first.
Colorado's Senate Bill 26-189, which takes effect in January 2027, covers technology that materially influences consequential decisions about people, including hiring. It excludes a general-purpose chatbot only if the chatbot isn't intended for those decisions and is "subject to an acceptable use policy that prohibits generated content to be used in a consequential decision". The first paragraph of section 5 is that policy for your general-purpose assistants. A dedicated scoring tool approved under its third paragraph falls outside the exclusion and carries the law's full duties, which is why the template sends it through HR and counsel first. A recruiter who asks a chatbot to rank applicants still brings it into scope, so the rule has to be followed as well as written. Our guide to the Colorado AI law covers the rest of what it requires.
If you operate in the EU, the AI Act has required providers and deployers of AI systems to take measures on their staff's AI literacy since 2 February 2025 (Article 4). According to an annotated version of the act, the 2026 Digital Omnibus amended that article's wording, so check the current text with counsel. Training under section 10 of the template is the usual way to meet it.
How to adapt the template and roll it out
Six steps, in order. Each one produces what the next one needs.
01 · Find out what's already in use
You can't write an approved list without knowing what people use now. Ask, and make it safe to answer. Running a disclosure amnesty, in module 3 of our course, shows how. The free Shadow AI Audit covers the AI features vendors have switched on inside software you already pay for. You get a list of tools and the jobs people use them for.
02 · Fill in the approved tools list
For each tool worth keeping, choose the plan, sign the business terms, and decide the highest class of data it may receive. Read each vendor's data terms for that plan. Approved tools and the vendor checklist gives you the questions to ask. You get the list that section 2 links to.
03 · Map your data to the three classes
Write down what counts as Confidential at your company, in your own words and with your own examples: client files, payroll, the board pack, source code. The data map walks through it. You get the examples that make section 3 usable.
04 · Name the owner and the request route
Pick the person who answers tool requests, and their backup, and set the reply time you'll actually keep. Set up the form or channel. You get the names and links for sections 8 to 10.
05 · Have counsel review the sections that touch law
Sections 5, 6 and 9, and any sector clauses, are the ones with legal consequences: employment decisions, recording consent, client contracts and discipline. Ask counsel to check them against the states and countries where you employ people. You get a policy you can issue.
06 · Launch it with training, not an email
Walk everyone through the policy using real examples from their own work, and have them acknowledge it. Everyone's first hour with AI, our free course for all staff, covers the output standard and stop, tell, fix, learn in one session. Then put the review date in the owner's calendar. If you'd like help deploying AI across the company, not just writing the rules, see AI deployment.
Sources
- SB 26-189, signed act, Colorado General Assembly, May 2026: the chatbot exclusion and its acceptable use policy condition, and the January 2027 start.
- PagerDuty Report Finds Two-Thirds (66%) of Office Professionals Have Used Unauthorized AI Tools at Work, PagerDuty, June 2026: the survey of 1,250 office professionals, conducted by Wakefield Research, used for the figures on unpermitted use, data sharing, policies and leadership.
- Gemini Apps Privacy Hub, Google, checked October 2026: consumer Gemini's use of activity for training and human review.
- Generative AI in Google Workspace Privacy Hub, Google, checked October 2026: Workspace content isn't human reviewed or used for training outside your domain without permission.
- Is my data used for model training? (consumer), Anthropic, March 2026: when consumer Claude chats are used to improve models.
- Is my data used for model training? (commercial), Anthropic, August 2026: the default for commercial products.
- Article 4: AI literacy, EU AI Act Explorer (secondary), checked October 2026: the article's application date and its amended wording.