AI acceptable-use policy template

What an acceptable-use policy for Copilot and public AI tools should cover — clear rules designed to be easy for staff to follow, without banning the tools that help them.

Banning AI tools can push use out of sight, without guardrails. A short, clear acceptable-use policy helps keep the productivity while controlling the risk. Here's what a workable policy covers, and the thinking behind it.

What a workable AI policy covers

• Approved tools — which AI tools are sanctioned (for example Microsoft Copilot, formerly Microsoft 365 Copilot) and which public tools are allowed or off-limits.
• Data rules — what must not go into AI tools: passwords and other credentials in any tool, and client data, personal information, source code or anything under NDA in tools the business hasn't approved for it.
• Human accountability — AI output is a draft; a named person owns and checks the result.
• Disclosure — when AI use should be flagged, such as in client-facing deliverables.
• Practicalities — who to ask, how to request a new tool, and what happens if the rules are broken.

The goal is a policy with a one-page staff summary that's easy to read and follow — specific enough to be useful, short enough to stick. Start with the structure above and adjust the approved-tools list and data rules to fit your environment.