Free AI Policy Template (Acceptable Use)

1. Scope and purpose

Who this applies to and what it is trying to protect.

This policy applies to every [employee, contractor, intern] of [Company Name] when they use any generative-AI tool (public, internal, or embedded in another product) in the course of their work. It also applies to AI agents that act on the company's behalf, whether a person started them or they run on a schedule.

Its purpose is to let you use AI confidently where it helps the business, and to protect [Company Name], its customers, and its counterparties from the four failure modes most associated with AI mistakes: confidential data leaking into a tool that does not respect that trust boundary; AI output being treated as fact without verification; an AI agent taking an action nobody approved; and AI use being inconsistent or undocumented across the team.

2. Definitions

The terms we use throughout the policy.

• AI tool. Any software that uses machine-learning models to generate text, code, images, audio, video, or decisions in response to a prompt. Includes ChatGPT, Claude, Gemini, Copilot, Midjourney, Notion AI, meeting note-takers, and any feature labeled "AI" inside a tool you already use.
• AI agent. An AI tool that takes actions rather than only producing text: browsing the web, running code, reading and sending email or messages, editing files or records, filling forms, or operating a computer on your behalf. Coding agents, browser agents, "computer use" features, and scheduled automations built on a model all count.
• Public AI tool. An AI tool available without an enterprise agreement that binds the provider to data-handling commitments (no-training, defined retention, audit rights). Consumer and individually paid tiers of ChatGPT, Gemini, and Claude fall here. As of late 2026 the major consumer tiers use conversations to train future models unless the individual user opts out, and retention can run for years. An individual's privacy toggle is not a company control and does not move a tool out of this category.
• Enterprise AI tool. An AI tool provided to [Company Name] under a contract that explicitly covers data handling, typically with a no-training-on-inputs commitment and a defined data-retention period. The approved list is in Appendix A.
• Confidential information. Anything [Company Name] would not share on its public marketing site. See §4 for the specific data categories.
• Automated decision. Any use of an AI tool to make, or substantially support, a decision about a person: hiring, screening, promotion, pay, discipline, termination, credit, insurance, housing, benefits, or access to a service. See §7.
• Shipping. Sending, publishing, or committing AI-generated work in a way that affects a customer, counterparty, or the public. Drafts you keep to yourself are not shipping. An agent sending a message or changing a record counts as shipping.

3. Acceptable use

Green, yellow, and red categories. Use this as your day-to-day reference.

We encourage AI use for the kinds of work it is genuinely good at. We require the extra steps in §5 to §7 for anything that reaches customers, touches regulated data, takes an action, or affects a decision about a person.

1. 01Green. Encouraged. Drafting internal documents, brainstorming, summarizing non-confidential reading, learning a new tool or domain, generating unit-test scaffolds from non-confidential code, translating between natural languages, code review suggestions on non-confidential repositories, and agents that only read and draft (no sending, no changes to systems) on Public or Internal data.
2. 02Yellow. Allowed with the §5 verification step. Drafting customer-facing emails, writing public marketing copy, generating data analysis from anonymized datasets, producing first-pass code that will ship to a non-regulated product, AI meeting note-takers where every participant has been told a recorder is running, and agents that take actions under the §6 controls.
3. 03Red. Not allowed in any public AI tool. Pasting or describing in detail: customer PII, unreleased product or financial information, counterparty contracts, credentials, security incident details, legal advice requests, anything covered by a signed NDA, anything under active HR or legal review. Any of these may be processed in an approved enterprise AI tool (Appendix A) if the same rules on verification apply.
4. 04Red. Not allowed in any tool. Giving an agent your own login, password, or payment method; letting an agent send external communications, move money, or change customer records without a person approving each action; using AI to make an automated decision about a person outside §7; generating a realistic image, voice, or video of a real person without their written consent; and recording a meeting with an AI note-taker without telling the people in it.

4. Data classification: which categories go where

The single most important section. Adjust the categories to match your org's existing data taxonomy.

If your organization already has a data-classification scheme (Public, Internal, Confidential, Restricted is common), use it. Otherwise, start with the four tiers below. The same tiers govern what an agent is allowed to read, not only what a person pastes.

1. 01Public. Information [Company Name] has already published: marketing copy, docs, case studies, patents, job listings. Safe in any AI tool.
2. 02Internal. Information you would share in a company-wide all-hands but not publicly: internal processes, org charts, non-sensitive project updates, internal meeting notes and transcripts. Safe in enterprise AI tools (Appendix A). Avoid public AI tools unless the content is also de-identified.
3. 03Confidential. Information shared under a commercial trust expectation: customer data, counterparty contracts, unreleased product plans, unpublished financials, strategy memos. Enterprise AI tools only. Public AI tools are not acceptable, even if redacted, because redaction quality is inconsistent under time pressure.
4. 04Restricted. Information covered by a regulatory, legal, or contractual obligation: PHI, payment-card data, material non-public information, active legal-hold material, anything flagged by [Legal, Compliance, Security]. No AI tool, public or enterprise, unless [Security or Compliance] has explicitly approved the specific use case in writing.

5. Verification before shipping

Every AI output that leaves [Company Name] has a human review step.

AI output looks confident whether it is right or wrong. This is the single most-reported failure mode in post-incident reviews and the easiest to prevent. Newer models are wrong less often, which makes the errors that remain harder to spot, not easier. The review step stays.

• Specific facts. Numbers, dates, names, citations, quotes attributed to a real person must be verified against a primary source before the output is shipped. "The AI said so" is not verification. A link the tool produced counts only once a person has opened it and confirmed it says what the tool claimed.
• Summaries of source documents must be spot-checked against the source. If the summary is more than two paragraphs, spot-check at least three claims.
• Code. If AI-generated code will run in production, it must pass the same review bar as human-authored code: tests, code review, static analysis. AI authorship is not a shortcut around that bar, and an agent that wrote and ran its own tests does not count as review.
• Charts and visualizations generated from your data must be cross-checked against the source data on at least three randomly selected data points.

6. AI agents and automated actions

Rules for tools that act, not only answer.

An agent can do in a minute what used to take a person an afternoon, including the mistakes. The controls below exist because an agent reads instructions from everything it touches: a web page, an email, a PDF, a calendar invite. Any of those can carry text written to redirect the agent (prompt injection), and no current model is immune to it. The policy therefore limits what an agent can reach and what it can do without a person, rather than trusting it to notice an attack.

• Least access. An agent gets its own credentials scoped to the task, never your personal login or the full access of the person who started it. Access to Confidential data needs [the policy owner]'s sign-off; Restricted data is off limits to agents without written approval under §4.
• A person approves consequential actions. Sending anything outside the company, spending money, changing customer or financial records, deleting data, granting access, and publishing all require a human to review the specific action before it executes. Read-only and draft-only steps do not.
• The three-way test. An agent that can read private data, reads content from outside the company (web, inbound email, uploaded files), and can send or post externally needs the strictest controls. Remove one of the three and the risk drops sharply. Design the task so the agent never has all three at once where you can.
• Inventory and logging. Every agent in use is listed in Appendix A with its owner, what it can reach, and what it can do. Every action it takes is logged in a way that traces back to an accountable person.
• Start low-risk. New agents run on Public or Internal data and draft-only tasks until [the policy owner] has reviewed a few weeks of logs. Expand scope deliberately, not because the vendor added a feature.
• Stop and report. If an agent does something you did not ask for, touches data it should not have, or its output references instructions you never gave, stop it and report under §10. That is the signature of prompt injection.

7. Decisions about people

Hiring, pay, discipline, credit, and eligibility are regulated uses in a growing number of places.

Using AI to rank, score, screen, or recommend outcomes for people is legal in most places but increasingly comes with notice, testing, and record-keeping duties. Appendix C lists the rules in force as of this version. Whether or not a rule applies to [Company Name] today, the steps below are the ones those rules require, and they are cheap to do from the start.

• A named person decides. AI may inform a decision about a person; it does not make one. The decision-maker reviews the AI input, can override it, and is recorded as the decision-maker.
• Tell the person when AI was a material part of the decision, in plain language, before or at the time of the decision, wherever the law requires it and wherever a reasonable person would want to know. Several US states require notice for employment decisions as of 2026, and some give the person a right to opt out or request human review.
• Test for bias before use and at least annually. Keep the results. Vendor assurances are not a substitute for your own test on your own population, and in some jurisdictions you share liability for a vendor's tool.
• Keep records of which tool was used, for which decisions, with what inputs, for [four years or your retention schedule]. Regulators and plaintiffs ask for these first.
• Prohibited uses. No AI inference of protected characteristics, no emotion recognition of employees or applicants, no social scoring, and no use of location, zip code, or similar proxies for a protected class.

8. Attribution and disclosure

When AI-generated content must be labeled as such.

• External marketing copy, thought-leadership writing, and op-eds published under a named [Company Name] author must disclose AI assistance if the AI did more than grammar or tone editing.
• Customer-facing communications drafted by a person do not require AI disclosure. Employees are professionally responsible for their output regardless of how it was drafted.
• An AI chatbot, voice agent, or automated reply that interacts with customers must make clear it is AI when asked and wherever a person could reasonably believe they are talking to a human. The EU requires this by design, and several US states require it on request or for specific categories (companion, health, and consumer-facing bots).
• Synthetic media. Any AI-generated or AI-altered image, audio, or video of a real person, event, or place that could be taken as real must be labeled as AI-generated where it is published. This is a legal requirement in the EU and in a growing list of US states, and a trust requirement everywhere.
• Code committed to [Company Name] repositories should be attributable to the human committer, following the team's existing review process. Internal convention on whether to note AI involvement in commit messages is left to each team.
• Any claim that a [Company Name] product or feature uses AI externally must be reviewed by [Marketing + Legal] before publication.

9. Governance

Who owns this policy, how it updates, and where to raise concerns.

• Policy owner. [Head of Security or named person]. Reviews and updates this policy at least annually, or sooner when a tool, regulation, or incident warrants it. Appendix C lists the regulatory dates worth a calendar reminder.
• Approved tools and agents list (Appendix A). Updated by the policy owner. Teams may propose additions by emailing [security@company.com]. A vendor adding agent features to an already-approved tool is a new entry, not an automatic extension.
• Employee questions about whether a specific use case is acceptable go to [the policy owner or a designated AI-governance channel].
• Questions that need legal or privacy review go to [General Counsel or Privacy Officer]. In regulated industries, these should be time-boxed (e.g. 48-hour response target).

10. Incidents and exceptions

Blameless reporting protects the organization. Silent fixes guarantee the next incident.

If you realize you have shipped something with an AI-introduced error (a wrong number, a fabricated citation, a misattributed quote), if you have pasted something into a public AI tool that fell into the Confidential or Restricted categories, or if an agent took an action you did not intend, report it to [the policy owner] immediately.

Reporting is blameless. The purpose is to assess impact, fix the output if it reached a customer, revoke any credentials an agent may have exposed, and identify whether the policy or training needs an update. Retaliation against a person who self-reports in good faith is itself a policy violation.

• One-off exceptions to §3 (Acceptable Use), §4 (Data Classification), or §6 (Agents) can be granted by [the policy owner or compliance lead] in writing, case-by-case, with a dated expiry.
• Standing exceptions are not granted. If a use case needs a permanent carve-out, the policy itself should be updated.

11. Training

Everyone using AI for work completes a short onboarding.

All new [employees, contractors] complete an AI acceptable-use training as part of onboarding. The training covers this policy plus the high-value skills that prevent the most common mistakes: prompt structuring, verification habits, data-classification judgment under time pressure, and recognizing when an agent has been steered by content it read.

Existing [employees, contractors] complete a refresher annually or when this policy materially changes. Teams with elevated exposure (customer support, legal, finance, HR, engineering touching customer data, anyone running agents) may have additional role-specific training.

Appendix A. Approved enterprise AI tools and agents

Fill in with your organization's enterprise-licensed AI stack. Update when contracts change or an agent is added.

The following AI tools have been reviewed for data handling and are approved for use with data up to and including the Confidential tier. Restricted-tier data requires additional per-use approval from [Security or Compliance] regardless of tool. Agents are listed separately with their scope.

• [ChatGPT Enterprise / Claude for Enterprise / Gemini for Workspace]. Approved for general text drafting, summarization, Q&A up to Confidential. [Start date] through [end of contract]. Data-handling commitment: [no training on inputs, N-day retention].
• [GitHub Copilot Enterprise / Cursor / Claude Code / etc.]. Approved for coding assistance on [Company Name] repositories up to Confidential. Data-handling: [as above]. Agent mode: [allowed on branches, never pushes to main, never deploys] or [not enabled].
• [Meeting note-taker]. Approved for internal meetings with a visible recording notice. External meetings require verbal consent at the start. Transcripts are Internal tier; recordings deleted after [30 days].
• Agent: [name]. Owner [person]. Can read [systems]. Can do [actions] without approval; [actions] with approval. Credentials: [service account, scoped]. Logs at [location].
• [Add your tools and agents here]

Appendix B. Change log

Every material change to this policy is recorded here with date, author, and a one-sentence summary of what changed and why. The living history matters more for audit purposes than a clean version number.

• [YYYY-MM-DD]. [Policy owner]. Initial adoption of MaxtDesign AI Studios starter template v1.1.

Appendix C. Regulatory watch list

Accurate as of October 16, 2026. Not legal advice. Confirm each item against the primary text before relying on it, and prune to the jurisdictions where you operate.

None of these rules require a company to adopt an acceptable-use policy. All of them are easier to meet if you have one. The items that most often reach an ordinary business are the employment-decision notices, the chatbot and synthetic-media disclosures, and the data-handling terms your AI vendors offer.

• United States, federal. No general AI statute. Executive Order 14365 (December 2025) directs the Justice Department to challenge state AI laws in court and conditions some federal funding on states easing them; as of this version no state law has been struck down, and firms advise complying with state law as written. Existing law (FTC Act, Title VII, ECOA, FCRA, HIPAA) applies to AI use the same as to any other tool.
• Colorado. The AI Act was rewritten (SB 26-189, May 2026) and its effective date moved to January 1, 2027, with narrower duties for deployers of high-risk systems; enforcement is also subject to pending litigation (xAI v. Weiser). Expect a disclosure and impact-assessment duty for consequential decisions if it takes effect as written.
• California. FEHA automated-decision regulations in force since October 1, 2025 (bias testing is evidence, vendor liability can reach the employer). CPPA automated-decision-making rules: pre-use notice, opt-out, and risk assessment for significant decisions, employer compliance due January 1, 2027. SB 243 companion-chatbot disclosure and safety duties in force since January 1, 2026.
• Illinois. HB 3773 in force since January 1, 2026: notify applicants and employees when AI is used in employment decisions; zip codes may not be used as a proxy for a protected class. Implementing rules were withdrawn for rework.
• Texas. TRAIGA in force since January 1, 2026: bans intentional unlawful discrimination and certain manipulative uses, with a 60-day cure period; no general notice or audit duty.
• New York City. Local Law 144 since 2023: annual bias audit and candidate notice for automated employment decision tools.
• European Union, AI Act. Prohibited practices in force since February 2025; general-purpose model obligations since August 2025; Article 50 transparency duties since August 2, 2026 (users must know they are talking to AI, deepfakes must be labeled). High-risk system obligations, including HR and credit uses, were deferred by the Digital Omnibus (Regulation 2026/1744) to December 2, 2027 for stand-alone systems and August 2, 2028 for systems embedded in regulated products. Applies to any company offering AI-driven services to people in the EU.
• Vendor data terms. Consumer tiers of the major assistants train on conversations by default with user-level opt-outs (Anthropic since October 2025, OpenAI and Google long-standing); enterprise and API tiers exclude training by contract. The gap between the two tiers is the reason §2 and Appendix A exist.