How to Write an AI Acceptable Use Policy (Free Template)

An AI acceptable use policy is the plain-language document that tells employees which AI tools they can use and what data they can enter. This AI policy template covers the sections it needs. Your AI governance framework sets the rules behind it, and the policy turns them into daily dos and don'ts.

The two documents do different jobs. The framework decides how risk gets tiered and who signs off on what. The policy is what an employee actually reads before they paste something into a chat window. Skip the policy and the framework stays theoretical. Skip the framework and the policy has no structure behind it to fall back on when a new tool shows up.

Most companies that ask us for help here already have a governance conversation happening somewhere. What they are missing is the one-page artifact that turns that conversation into something an employee can actually follow on a Tuesday afternoon. That is what this template is for.

Why most companies do not have one yet

A May 2026 ISACA survey of more than 3,400 digital trust professionals found 38 percent of organisations have a formal AI policy. Thirty percent have a limited policy, and 25 percent have no active policy.

Cyberhaven's 2026 AI Adoption and Risk Report found 39.7 percent of all AI interactions involve sensitive data, counting prompts, copy-paste, and file uploads. The company's blog post on the findings names categories such as sales and go-to-market data, R&D content, and source code. Cyberhaven sells data security tools, so read it as vendor research rather than an independent study.

Put those two numbers together and the picture is straightforward: most companies have not written down where the line sits, and a meaningful share of what people are already pasting into AI tools crosses it. A written policy does not stop every mistake. It gives employees a clear answer when they are not sure, instead of leaving them to guess.

The gap is not usually bad intent. It is the absence of a document to check. An employee who is unsure whether a client contract can go into a drafting tool will usually guess rather than ask, especially if asking means tracking down whoever owns AI policy and waiting a day for an answer. The policy exists to make the right answer faster to find than the wrong one is to guess at.

The sections your AI use policy needs

This structure is our recommendation, built to fit on one or two pages rather than becoming a document nobody reads past the first section.

An approved tools list, with a clear way to request a new one, so people do not go around the policy because the list feels closed.

Data rules. What can and cannot go into an AI tool: client data, financial figures, source code, and personal information. This is the section employees will reference most, so it needs to be specific rather than general.

Required human review before AI-generated output goes to a client or into a decision about an employee. This is the backstop for every tier of the governance framework above medium risk.

Disclosure rules. When AI use needs to be flagged to a client, and when it does not. Silence on this point leaves individual employees to make the call alone, which is exactly the inconsistency a policy is meant to remove.

Consequences, stated plainly rather than left to be worked out case by case. A policy that never says what happens when it is not followed reads as optional.

A review date and version number, so the policy does not go stale as tools change. Tie this to the same review cadence as the governance framework so the two stay in sync.

What Canadian privacy guidance expects

This is general information, not legal advice. Confirm your obligations with counsel before you publish a final version.

The Artificial Intelligence and Data Act was part of Bill C-27. That bill stopped in committee when Parliament's session ended on January 6, 2025. Law firm Gowling WLG reports that Bill C-36, tabled in June 2026, does not contain AI-specific legislation. No federal AI statute has replaced AIDA in the sources we reviewed in October 2026.

The clearest signal comes from the Office of the Privacy Commissioner. Its principles for responsible, trustworthy and privacy-protective generative AI (December 2023) are guidance, not binding law. Four of them bear directly on a workplace policy.

Consent: valid and meaningful, and as specific as possible, rather than buried in a broad acceptable-use sign-off.

Privacy impact assessments, listed under the accountability principle, for any use case that touches personal information at scale.

Explanations: people affected by AI-supported decisions should be told how the decision was made, under the openness principle.

De-identified data: use anonymized, synthetic, or de-identified data rather than personal information where you can, which also simplifies the data rules section above.

Write your policy to meet that bar before a law arrives rather than after. Treating the OPC principles as the working standard, rather than waiting for binding legislation, is the more defensible position if a client or regulator asks what your company does today. Our privacy impact assessment service covers the assessment step if your use cases touch personal data directly.

A hypothetical data rules section

This example is hypothetical. It shows how short a usable data rules section can be, and it is the part of the policy most likely to get copied into other sections of your company handbook.

"Do not paste client names, contract terms, unreleased financials, or source code into any AI tool outside our approved list. If you are unsure whether something qualifies, ask before you paste it."

That is the whole section. Keep each section this short, because a policy people can remember is easier to follow than one they have to look up every time. A policy that reads like a contract gets signed once and ignored forever. A policy that reads like an instruction gets followed.

If your team ends up debating whether a specific scenario qualifies as restricted, that debate is useful information. It usually means the data rules section needs one more concrete example, not a longer paragraph of general language. Add the example, close the gap, and move on.

We built a downloadable Word template that covers every section above. Talk to our team to get a copy, or take our AI Readiness Scorecard first if you are not sure where your company stands.