An AI acceptable use policy is a short document that tells people what they may and may not do with AI tools, and what happens when something goes wrong. Most startups need one the first time an enterprise customer sends a security questionnaire, an investor asks about AI governance, or an engineer pastes production data into a chatbot.
The phrase covers two different documents. One is internal: the rules your own team follows when using AI at work. The other is external: the rules your customers accept when they use an AI feature in your product. This guide covers both, and the template below is written for the internal policy, with notes on the external one.
- Document type
- Internal policy, plus a customer-facing acceptable use clause
- Typical length
- Two to four pages; shorter is easier to follow
- Owner
- A named person, usually the founder, CTO or head of security
- Review cycle
- At least every six months, and whenever a major tool or law changes
- Not legal advice
- A starting point to adapt to your facts, tools and markets
Why a startup needs one
Customers ask for it
Enterprise procurement and security questionnaires increasingly ask whether you have an AI policy, how staff are trained and which tools touch customer data. A written answer shortens the deal cycle.
Data leaves the building
The most common AI incident at a startup is quiet: confidential code, customer records or contract text pasted into a public tool. A policy sets the line before the first incident, not after.
Regulators expect governance
The EU AI Act includes an AI literacy duty for organisations using AI, which the 2026 amendments softened into an obligation to take supporting measures. Frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 treat documented governance as a baseline.
Ownership and quality risk
AI output can be wrong, can reproduce third-party material and may have unclear copyright status. Someone has to be accountable for what ships.
What the policy should include
- 01
Purpose and scope
Say who the policy covers (employees, contractors, interns), which tools it covers (generative AI assistants, coding tools, AI features built into other software) and what it does not cover. Keep scope broad enough that new tools fall inside it automatically.
- 02
Approved tools and tiers
List the tools staff may use and the data each may receive. A three-tier model works well: approved for business data, approved for non-sensitive data only, and not permitted. Name an owner who reviews new tool requests.
- 03
Data rules
State what may never be entered into an external AI tool: personal data, customer confidential information, credentials and secrets, unreleased financials, privileged legal advice and source code, unless the tool is in the top tier. Link this to your privacy notice and data-processing terms.
- 04
Permitted and prohibited uses
Give concrete examples both ways. Drafting, summarising public material and brainstorming are usually fine. Automated decisions about people, impersonation, generating deceptive content and bypassing security controls usually are not.
- 05
Human review and accountability
Require a person to check AI output before it reaches a customer, goes into production or informs a decision about someone. The person who uses the output owns it.
- 06
Intellectual property
Cover use of third-party material as prompts, review of AI-generated code for licence issues, and how you treat ownership of AI-assisted work. Align with your customer contracts and open-source policy.
- 07
Transparency
Decide when you tell customers, candidates or users that AI was involved, and when content must be labelled. Some laws, such as the EU AI Act’s transparency duties, set specific rules for chatbots and synthetic media.
- 08
Training
Describe the onboarding and refresher training staff receive. A short annual session plus guidance at the point of use is enough for most startups, and the record doubles as evidence for customers.
- 09
Incidents and reporting
Tell people how to report a mistake: pasted data, a harmful output, a suspected leak. Make reporting blameless and fast, and link it to your breach-response process, because a personal data incident can carry notification deadlines.
- 10
Enforcement and review
State the consequences of breach in proportion, name the policy owner and set a review date. Record each version and approval.
Sort tools and data into tiers
Tier 1 · Approved for business data
Enterprise-licensed tools with a signed data-processing agreement, no training on your inputs, access controls and audit logs.
Tier 2 · Non-sensitive data only
Reviewed tools suitable for public or generic material. No personal data, customer information, secrets or source code.
Tier 3 · Not permitted
Unreviewed consumer tools, browser extensions and plug-ins, and any tool whose terms allow training on your inputs where you cannot opt out.
Plain-English template
Replace the bracketed items, delete what does not apply and have it reviewed against your contracts, tools and markets before you adopt it.
[Company] · AI acceptable use policy · Version 1.0
1. Purpose
[Company] uses AI to work faster and build better products. This policy sets the rules that keep customer trust, personal data and our intellectual property safe while we do so.
2. Who this applies to
All employees, contractors and interns of [Company] who use AI tools for company work, on any device. “AI tools” means generative AI assistants, AI coding tools, and AI features built into other software.
3. Approved tools
Use only the tools on the approved list maintained by [Owner]. Tier 1 tools may be used with business data. Tier 2 tools may be used only with public or non-sensitive information. Request a new tool through [channel] before using it.
4. Never enter
Personal data about customers, users or staff; customer confidential information; passwords, keys and tokens; unreleased financial information; privileged legal advice; and source code, unless the tool is Tier 1 and the task is approved.
5. Allowed uses
Drafting and editing text, summarising public material, brainstorming, writing and reviewing code in approved tools, and analysing data that has been de-identified.
6. Not allowed
Making or recommending decisions about hiring, pay, credit, access or discipline using AI alone; impersonating a person or presenting AI output as human work where this would mislead; generating deceptive or unlawful content; and bypassing security or licensing controls.
7. Check before you rely
AI output can be wrong or biased. A person must review it before it is sent to a customer, merged into production or used to inform a decision. You are responsible for what you use.
8. Intellectual property
Do not paste third-party material you are not entitled to use. Review AI-generated code for licence and security issues before it is merged. Follow [open-source policy].
9. Telling people
Where AI interacts with customers or generates content they will see, follow [transparency guideline]. Where law requires disclosure or labelling, we do it.
10. Report problems
If you paste something you should not have, receive a harmful or incorrect output, or suspect a leak, tell [contact] straight away. Reports made promptly are treated as learning, not blame.
11. Training, review and breach
Everyone covered completes AI-use training on joining and each year. [Owner] reviews this policy every six months. Breaches may lead to action under [disciplinary policy].
If you are writing the customer-facing policy
If your product includes an AI feature, your terms or a separate acceptable use policy for customers should prohibit unlawful, deceptive and harmful uses, such as generating malware, harassment, non-consensual imagery or content that infringes others’ rights.
It should also say what customers must not do to the service: reverse engineering, scraping or probing the model, circumventing safeguards or using outputs to train a competing model, if that is your position.
Finally, set out what you may do in response (warn, suspend, terminate), how customers can appeal or report abuse, and how the policy fits with your main terms of service and any third-party model provider’s usage rules, which you will usually have to pass through.
Roll it out in three weeks
01 · Week 1 · Find out what is actually in use
- Ask the team which AI tools they use today, including personal accounts.
- List every AI feature inside your own product and which model provider powers it.
- Note which of these touch personal data or customer content.
02 · Week 2 · Decide the rules
- Sort tools into the three tiers and name an owner.
- Check each Tier 1 provider’s terms on training, retention and data location.
- Draft the policy from the template and keep it to a few pages.
03 · Week 3 · Launch and train
- Get leadership sign-off and publish the policy where staff will find it.
- Run a short briefing with real examples from your own work.
- Set up the channel for tool requests and incident reports.
04 · Ongoing · Keep it alive
- Review every six months and after any major tool or law change.
- Keep a log of approvals, training and incidents for customer questionnaires.
- Align the policy with your privacy notice, security policy and customer terms.
Common mistakes
- Copying a long enterprise policy that nobody reads. A short policy that people follow beats a thorough one that they do not.
- Banning AI outright. People will use personal accounts instead, and you lose visibility. Approve good tools instead.
- Writing rules without naming a tool owner or a route to request new tools.
- Covering employees but not contractors, or forgetting AI features built into existing software.
- Promising customers controls in a questionnaire that the policy does not require or the team does not follow.
- Treating the policy as a one-off. Tools, terms and laws change faster than annual reviews.
FAQs
Is an AI acceptable use policy legally required?
There is no single law that says every company must have one. But several laws and frameworks expect governance, training and oversight of AI use, and customers and investors increasingly ask for it in due diligence. In practice, if you use AI with customer or personal data, you need one.
What is the difference between an AI policy and an AI acceptable use policy?
The terms are often used interchangeably. A broader AI governance policy may cover how you build, test and deploy AI products, while an acceptable use policy focuses on what people may and may not do with AI tools. Startups usually begin with the acceptable use policy and grow into the broader one.
Can employees use ChatGPT or similar tools at work?
That depends on your tiers. Many companies allow an enterprise-licensed tool for business data and restrict free consumer tools to non-sensitive tasks. What matters is that the rule is written down, the data limits are clear and people know how to ask for a new tool.
Does the policy need to mention the EU AI Act?
It need not cite the Act, but it should work with it. If you offer AI features in the EU or serve EU customers, the policy should support AI literacy measures and transparency practices, and your product teams should separately classify their systems under the Act.
Who should own the policy?
One named person with authority across product, engineering and operations: often the CTO, head of security or a founder. Legal review helps, but the owner must be someone who can approve tools and enforce the rules day to day.
How often should it be updated?
Review at least every six months and whenever you adopt a significant new tool, change model providers, enter a new market or a relevant law takes effect.
Related
Sources
Reviewed 12 October 2026. General information and a starting template, simplified for planning; not legal advice. Check current law and your own contracts before adopting any policy, and get advice for your facts.