AEGITz · Free Resource

AI Acceptable Use Policy

A two-page template. Replace every highlighted field, delete what does not apply, and have your employment counsel review it before you publish it.

How to use this. A twelve-page policy is a policy nobody reads, which is legally the same as not having one when a regulator asks. Keep it to two pages. Route it through whatever you already use for handbook acknowledgments, and re-acknowledge annually, because the tool landscape moves faster than your handbook does.

Company: Effective date: Policy owner:

1. Purpose and scope

This policy governs the use of artificial intelligence tools by all employees, contractors, and temporary staff of in the course of company work. It applies whether the tool is paid for by the company or by the individual, and whether it is used on company or personal equipment.

2. Approved tools

The following tools are approved for company use. The distinction between consumer and business versions of the same product matters: the free tier and the enterprise tier of the same assistant carry very different commitments about whether your inputs are retained and used for model training.

Tool	Approved for	Tier / license	Request access from

Any tool not on this list requires approval before use with company information. Personal accounts on consumer versions of approved tools are not approved for company work.

3. Information that must never be entered into any AI tool

Abstract categories fail because everyone draws the line differently. The following are prohibited without exception:

Client or customer records containing names paired with financial, medical, or legal detail
Anything covered by a signed non-disclosure agreement
Employee personnel files, payroll, and compensation data
Passwords, API keys, access tokens, or credentials of any kind
Source code the company does not own
Unreleased financial results, board material, or transaction documents
(add categories specific to your business)

The practical test: if you would not email it to a vendor you have never met, do not paste it into a tool.

4. Human review before anything leaves the company

Every piece of AI-assisted work that reaches a customer, a regulator, or the public is reviewed by a named role, not by a general expectation of care.

Type of output	Reviewed by	Reviewed for
Client-facing documents		Accuracy, tone, commitments made
Code		Correctness, security, licensing
Financial analysis		Calculation, source data
Marketing and public content		Factual claims and citations specifically

Fabricated statistics and invented citations are the most common failure mode. Marketing review is a fact check, not a proofread.

5. Disclosure

Decide each of these and state the answer. Delete the options that do not apply.

Client disclosure: employees must / need not disclose AI assistance to clients when . Some contracts and some professional obligations require it.
Synthetic media: AI-generated likeness, voice, or imagery in marketing is permitted with labeling / prohibited.
Hiring: use of AI in screening, scoring, or evaluating candidates is prohibited / permitted with human review only. This area carries real legal exposure and the safe default is prohibition until counsel advises otherwise.

6. Requesting a new tool

Send requests to , including what you want it for and what information it would touch. You will receive an answer within business days.

The businesses with the worst shadow AI problems are almost always the ones where asking took a month and the answer was always no. People do not stop using useful tools. They stop telling you.

7. Security requirements

Access approved tools through company single sign-on where it is available
Do not connect an AI tool to company email, files, or calendar without approval from
Report any suspected exposure of company or client information to immediately, without waiting to confirm it

8. Enforcement

Violations are handled under the company's existing disciplinary process. Reporting your own mistake promptly will always be treated more favorably than a discovered one.

Acknowledgment

I have read and understand this policy and agree to follow it.

Name Signature Date