# AI acceptable use policy

**Company:** {{company_name}}
**Policy owner:** {{policy_owner}} (questions and exception requests go here)
**Effective date:** {{effective_date}}
**Review cycle:** every six months, or sooner when we adopt a new AI tool

> How to use this template: replace every `{{...}}` value, delete the guidance in block quotes like this one, and fill in the approved tools table in section 3. Have someone with legal or privacy responsibility read it before you publish it. This template is a starting point and is not legal advice.

## 1. Purpose and scope

This policy explains how people at {{company_name}} may use generative AI tools (chat assistants, coding assistants, image generators, meeting note takers and AI features built into other software) for company work. It applies to employees, contractors and interns, on company or personal devices, whenever the work involves company information or is done on the company's behalf.

The goal is to let people use these tools productively while protecting customer data, confidential information, and the quality of what we ship.

## 2. Principles

1. **You own the output.** Anything you send, commit, publish or decide using AI help is your work. Check it as carefully as if you wrote it yourself.
2. **Data goes only where it is allowed.** Use the data classification in section 4. When unsure, do not paste it.
3. **Use approved tools for company data.** Tools not on the list in section 3 may only be used with public information.
4. **Be open about AI use where it matters.** Section 6 lists when disclosure is required.
5. **Ask when in doubt.** Contact {{policy_owner}}. Asking is always better than guessing.

## 3. Approved tools

| Tool | Approved for data up to | Account type required | Notes |
|---|---|---|---|
| {{tool_1_name}} | {{tool_1_max_classification}} | Company account via SSO | {{tool_1_notes}} |
| {{tool_2_name}} | {{tool_2_max_classification}} | Company account | {{tool_2_notes}} |

> Only list a tool after checking its terms: whether inputs are used for training, how long data is retained, where it is processed, and whether a data processing agreement is in place. Business or enterprise plans often differ from free and personal plans on these points, so name the plan.

Personal accounts on any AI tool may be used only with **Public** data, even if the same tool is approved with a company account.

To request a new tool, send {{policy_owner}} the tool name, plan, intended use and the data classes involved. You will get an answer within {{review_turnaround}}.

## 4. What data may go into AI tools

| Classification | Examples | Approved tools (company account) | Unapproved or personal tools |
|---|---|---|---|
| Public | Published docs, marketing site, open-source code | Allowed | Allowed |
| Internal | Internal wikis, non-sensitive meeting notes, most source code | Allowed | Not allowed |
| Confidential | Customer data, contracts, financials, unreleased product plans, security details | Only tools approved for Confidential, and only the minimum needed | Not allowed |
| Restricted | Passwords, API keys, private keys, payment card data, government IDs, health data, data under a customer contract that forbids third-party processing | Not allowed | Not allowed |

Before pasting, remove or replace names, emails and identifiers you do not need for the task.

## 5. Acceptable and prohibited uses

**Generally fine (with approved tools and allowed data):** drafting and editing text, summarizing internal documents, brainstorming, explaining code, writing tests, generating boilerplate, translating, analyzing anonymized or public data.

**Not allowed:**
- Entering Restricted data into any AI tool.
- Using AI output as the sole basis for decisions about people: hiring, firing, performance ratings, credit, or access to services.
- Generating content that impersonates a real person, or images and audio of real people without their consent.
- Presenting AI-generated legal, medical, financial or security advice to customers without review by a qualified person.
- Using AI to get around security controls, licensing terms or another company's terms of service.
- Connecting AI agents or tools to production systems, customer data or company accounts without approval from {{policy_owner}} and the system owner.

## 6. Quality, review and disclosure

- **Facts, numbers, citations, links and code must be verified** before they reach a customer or production. AI tools state wrong information confidently.
- **Code:** AI-assisted code goes through normal code review and CI. Reviewers should know when a change was largely AI-generated. Check that suggested dependencies exist and are the packages you intend.
- **Customer-facing content:** a person reviews it before it is sent or published. When a customer is talking to an automated AI system rather than a person, tell them.
- **Copyright and licensing:** do not ask tools to reproduce copyrighted material, and treat large verbatim code suggestions with care for license compatibility.

## 7. AI features we build into our product

Product features that send customer data to an AI provider follow our normal security and privacy review, plus:
- The provider and data flow are listed in our subprocessor list and privacy documentation.
- Inputs from users and third parties are treated as untrusted (prompt injection is in the threat model).
- There is an owner, an eval set, monitoring, and a way to switch the feature off.

## 8. Incidents

Report it to {{incident_contact}} within {{incident_report_window}} if you:
- pasted Confidential or Restricted data into an unapproved tool,
- notice an AI feature leaking data, producing harmful output, or being manipulated,
- find an AI-generated mistake that reached a customer.

Reporting quickly is what matters. Self-reported mistakes made in good faith will be handled as a learning issue, not a disciplinary one.

## 9. Acknowledgement

I have read this policy and will follow it.

Name: ______________________  Date: ______________

## Variables to fill

| Variable | What to put |
|---|---|
| `{{company_name}}` | Legal or trading name |
| `{{policy_owner}}` | Person or role, plus contact address |
| `{{effective_date}}` | Date the policy takes effect |
| `{{tool_N_name}}`, `{{tool_N_max_classification}}`, `{{tool_N_notes}}` | One row per approved tool and plan |
| `{{review_turnaround}}` | e.g. "five business days" |
| `{{incident_contact}}` | Security or IT contact |
| `{{incident_report_window}}` | e.g. "24 hours" |