What an AI Acceptable Use Policy Should Include

Short answer

An employee AI acceptable use policy should list the approved AI tools, say what data may and may not be entered, require human review of AI output before it is used, define prohibited uses, set rules for disclosure and intellectual property, explain how to request new tools and state who owns the policy and how it is enforced. Keep it short enough that people read it.

Key facts

Name approved tools explicitly, including which accounts: company workspace versus personal accounts.
Data rules should map to your existing data classification, not invent a new one.
Human review of AI output is the core control for accuracy and accountability.
Technical controls such as SSO, DLP and sensitivity labels should back up the written policy.
Review the policy at least yearly, because AI tools change quickly.

Purpose and scope

Open with one or two sentences on why the policy exists: to let staff use AI productively while protecting client data, company information and the business's reputation. Then define scope. It should cover all employees, contractors and temporary staff, all company data and any AI tool used for work, whether chat assistants, AI features inside other software, browser extensions, meeting note-takers or coding assistants.

Approved tools and accounts

List approved tools by name and account type. For example: Microsoft 365 Copilot and Copilot Chat signed in with your work account, and Claude through the company's Claude Team or Enterprise workspace. State that personal or free accounts of any AI tool are not approved for company data, even if the same product is approved under the company account.

Explain how to request a new tool and who approves it. Without a clear path, people use unapproved tools quietly.

Tool status	Meaning
Approved	May be used with data up to the stated classification
Approved with limits	May be used for specific tasks or data types only
Under review	Do not use with company data until approved
Not approved	Do not use for work, including personal accounts

Data rules

Tie data rules to your existing classification scheme. If you use Microsoft Purview sensitivity labels such as Public, General, Confidential and Highly Confidential, say which labels may be used with which tools.

Never enter passwords, API keys, or authentication secrets into any AI tool.
Do not enter regulated data, such as protected health information, payment card data or controlled unclassified information, unless the tool is specifically approved for it.
Client confidential information may only be used in approved company accounts, and only where client contracts allow.
Do not upload personal data about employees or customers beyond what the task requires.
Follow the same rules for AI meeting note-takers: get consent where required and do not record restricted meetings.

Using AI output responsibly

You are responsible for any AI-assisted work you share, send or publish.
Check facts, figures, citations, names and legal or technical claims before use.
Do not use AI as the sole basis for decisions about hiring, firing, pay, credit or other significant decisions about people.
Disclose AI assistance where clients, contracts or regulations require it.
Review AI-generated code for security and licensing issues before merging.
Do not use AI to impersonate others, create misleading content or bypass security controls.

Ownership, training and enforcement

Name an owner for the policy, usually IT or security with legal and HR input, and a review cycle of at least once a year. Require short training and an acknowledgment when people get access to an AI tool.

Explain how the policy is enforced. Written rules work best when backed by technical controls: single sign-on through Entra ID so only company accounts reach approved tools, Purview DLP and sensitivity labels to limit what can be shared, Defender for Cloud Apps or network controls to discover or block unapproved AI services where licensed, and audit logs for review. State how to report a mistake, such as pasting the wrong data into a tool, and make reporting safe so people do it quickly.

Keep it readable

Aim for two to four pages. Put a one-page summary at the top with the five rules people must remember: use approved tools with your work account, follow data rules, review output, disclose where required and ask before adopting new tools. Put detail and examples in an appendix. Update the approved tool list separately so the policy itself does not need a full revision every time a tool changes.

How Accred Consulting approaches it

Accred Consulting drafts AI acceptable use policies as part of Microsoft 365 Copilot and Claude deployments. Discovery reviews your data classification, client obligations and current AI use, then Accred drafts a policy for review by your leadership and legal counsel, who own the final version. Accred then configures the Microsoft 365 controls that back it up, including Entra ID single sign-on, sensitivity labels and DLP where licensed. Work follows a Proposal with clear scope, fixed price and timeline, and you work directly with US-based specialists, with documentation and knowledge transfer at handover.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

What should an AI acceptable use policy for employees include?