How-toAI GovernanceGetting Started
How to write an AI acceptable use policy people will actually read
A short, clear AI policy beats a long one nobody opens. Seven steps to write an AI acceptable use policy that fits on two pages and works in practice.
Isaac Ward
AI Practitioner
- Published
- Last reviewed
Most AI policies fail for the same reason: they’re too long. People skim them once, if at all, and carry on as before.
The goal here is a policy of around two pages that people can read in five minutes and remember. Detail can live elsewhere. The policy just needs to make the rules clear.
Before you start
Have your AI tool inventory to hand. A policy written without knowing what’s actually in use tends to be either too vague or out of touch.
- Time
- 3 hr
- Level
- Beginner
- Steps
- 7
Before you start
- Your current AI tool inventory
- Your existing data protection and information security policies
- A named policy owner and an approver
Tools you need
- A word processor or shared doc
- Your AI tool inventory
1Say why the policy exists
Open with two or three sentences in plain language. For example: "We want everyone to use AI confidently and safely. This policy explains which tools you can use, what you must never put into them, and how to check what they produce."
Set a positive tone. This is about enabling good use, not banning it.
2Define the scope
Say who the policy applies to (staff, contractors, partners) and what it covers: standalone AI tools, AI features inside other software, and browser extensions.
3List the approved tools
Name the AI tools people can use, and what each is approved for. Keep this list short and in a table if possible.
Explain how to request a new tool, and who decides. A clear route reduces workarounds.
4Set clear data rules
This is the most important section. Be specific about what must never be entered into an AI tool unless it is approved for that data. Typically: client information, personal data, confidential commercial information, and passwords or credentials.
Use examples from your own business so people recognise the situations.
5Require a human check
State that people are responsible for anything they produce with AI. Facts, figures, citations and advice must be checked before they’re shared outside the business.
AI can help with the work. It doesn’t take accountability for it.
6Cover disclosure and ownership
Say when people should be open about AI use, internally and with clients. Name the policy owner, who to contact with questions, and how to report a mistake or concern without fear of blame.
7Publish, train and review
Share the policy with a short briefing, not just an email. Ask people to confirm they’ve read it. Set a review date, every six months is a sensible default, and update it whenever you approve new tools or the rules change.
Frequently asked questions
How long should an AI policy be?
Around two pages for the core policy. Put detailed procedures, tool settings and risk assessments in supporting documents.
Should our AI policy ban ChatGPT?
Not necessarily. Many firms approve a business or enterprise version with appropriate data controls and restrict free consumer versions for client or personal data.
Who should own the AI policy?
A named day-to-day owner, often in operations, risk or compliance, with a director or partner accountable for it.
