AI acceptable-use policy template

A ready-to-adapt acceptable-use policy for Copilot and public AI tools — clear rules your staff will actually follow, without banning the tools that help them.

Banning AI tools rarely works — staff use them anyway, just without guardrails. A short, clear acceptable-use policy is what keeps the productivity while controlling the risk. This template is ready to adapt to your organisation; here's the thinking behind it.

What a workable AI policy covers

• Approved tools — which AI tools are sanctioned (for example Microsoft 365 Copilot) and which public tools are allowed or off-limits.
• Data rules — information that must not be entered into unapproved public AI tools unless expressly authorised and appropriately protected: client data, personal information, credentials, source code, or anything under NDA.
• Human accountability — AI output is a draft; a named person owns and checks the result.
• Disclosure — when AI use should be flagged, such as in client-facing deliverables.
• Practicalities — who to ask, how to request a new tool, and what happens if the rules are broken.

The goal is a one-page policy people will actually read and follow — specific enough to be useful, short enough to stick. The template gives you the structure and sensible defaults; you adjust the approved-tools list and data rules to fit your environment.