AI Acceptable Use Policy Template for Companies (Free, US)
An AI acceptable use policy tells employees which AI tools they may use for work, what they may and may not put into them, and how AI output must be checked before anyone relies on it. Below: who needs one, the clauses to include, a free sample policy you can copy into Word, an add-on for law firms, and common mistakes.
Drafting a company AI policy in Word? LexDraft drafts a first version from your plain-English description and reviews it with tracked-change redlines.Free plan: 5,000 generated words a month, no credit card.
Install free in WordLast checked: 23 October 2026. This page is general information about United States practice, not legal advice. Rules on AI, privacy, employment and sector regulation change quickly and vary by state and industry. Have counsel review your policy before you adopt it.
What an AI acceptable use policy is
An AI acceptable use policy (also called an AI usage policy or generative AI policy) is an internal company policy. It sets the rules for how staff use AI tools such as chat assistants, writing and coding assistants, and AI features built into software the company already uses. It is not a contract with customers and not a privacy notice, although it should be consistent with both.
Most policies answer five questions: which tools are approved, what information may go into them, what uses are off limits, who must review AI output and how, and who to tell when something goes wrong.
Who needs one
- Any company whose staff already use AI tools for work. If people are pasting text into public chat tools, a policy is how you set limits on confidential, customer and personal information.
- Companies that handle regulated data, such as health information, financial data or children's data, where sector rules decide what can be shared with a vendor.
- Companies that use AI in hiring or other decisions about people. Some laws already apply here. For example, New York City Local Law 144 requires a bias audit and notices before employers or employment agencies use an automated employment decision tool to screen candidates or employees for jobs in the city.
- Law firms and other professional firms, where professional conduct rules on confidentiality, competence and supervision apply. See the law firm add-on below.
Key clauses in an AI acceptable use policy
| Clause | What it covers |
|---|---|
| Purpose and scope | Who the policy covers (employees, contractors, temps) and which tools: standalone AI tools, AI features in existing software, and AI used on personal devices for work. |
| Approved tools | A list of approved tools and accounts, who keeps the list, and how to request a new tool. Company accounts only, not personal accounts, for work data. |
| Information rules | What may be entered into which tools, tied to your data classification: for example, public information in any approved tool; confidential, customer or personal information only in tools approved for it; some data (passwords, keys, special categories) never. |
| Prohibited uses | Uses that are banned outright, such as unlawful discrimination, impersonation, generating malware, and making final decisions about people without human review. |
| Human review | AI output is a draft. A named person checks it for accuracy, sources, bias and fit before it is used, published or sent. |
| Intellectual property | Do not enter third-party content you have no right to use; check outputs before publishing; note that purely AI-generated material may not be protected by copyright in the US. |
| Transparency | When staff must tell customers, colleagues or regulators that AI was used. |
| Vendor review | Security, privacy and contract checks before a tool is approved, including whether the vendor trains on your data and how long it keeps it. |
| Training | Required training before using approved tools, refreshed when the policy changes. |
| Incidents and reporting | How to report a mistake, such as confidential data entered into the wrong tool or a harmful output, and who handles it. |
| Monitoring and enforcement | That use of company systems may be monitored (as your law allows), and the consequences of breaking the policy. |
| Ownership and review | Who owns the policy and how often it is reviewed (for example every six or twelve months). |
A widely used reference for structuring AI governance is the NIST AI Risk Management Framework (AI RMF 1.0, January 2023), a voluntary framework. If you have staff or customers in the EU, also check the EU AI Act, whose AI literacy obligation (Article 4) has applied since 2 February 2025.
Free AI acceptable use policy template (sample text)
Copy the text below into Word and fill in the brackets. It is an original, general US sample. It is a starting point, not a finished policy: match it to your data classification, your approved tools, your industry rules and your employee handbook.
[COMPANY NAME] ARTIFICIAL INTELLIGENCE ACCEPTABLE USE POLICY
Effective date: [date]. Policy owner: [role, for example General Counsel or Chief Information Security Officer].
1. Purpose. This Policy sets the rules for using artificial intelligence ("AI") tools in [Company]'s business, so that we use them productively while protecting confidential information, personal information, and the people affected by our work.
2. Scope. This Policy applies to all employees, contractors and temporary staff ("Personnel") who use any AI tool for [Company] work, on any device. "AI tool" means any software that generates or analyzes text, images, audio, video or code using machine learning, including AI features in software [Company] already uses.
3. Approved tools. Personnel may use only the AI tools on the Approved AI Tools List maintained by [role], and only through [Company]-provided accounts. To request a new tool, contact [team or email]. Tools are approved only after review of their security, privacy and contract terms.
4. Information you may enter. (a) Public information may be entered into any approved tool. (b) Confidential information, customer information and personal information may be entered only into tools the Approved AI Tools List marks as approved for that category. (c) Never enter passwords, access keys, payment card numbers, government identification numbers, or [other restricted categories] into any AI tool. (d) Follow any customer contract or regulation that limits how specific data may be shared.
5. Prohibited uses. Personnel must not use AI tools to: (a) break any law or [Company] policy, including anti-discrimination and privacy laws; (b) make or carry out a final decision about hiring, promotion, discipline, credit, pricing or access to services for a person without review by an authorized human decision-maker [and any notices or audits required by law]; (c) impersonate a real person or create misleading content; (d) create malicious code or bypass security controls; or (e) [other prohibited uses].
6. Human review. AI output may be inaccurate, incomplete, out of date or biased. Personnel are responsible for any AI output they use. Before AI output is relied on, published, sent outside [Company] or added to a product, the person using it must check it for accuracy, sources and suitability. [For high-risk work, a second reviewer must approve it.]
7. Intellectual property. Do not enter third-party content that [Company] has no right to use. Check AI output for material that may belong to others before publishing it. Material created for [Company] using AI tools is [Company] work product to the extent [Company] can own it.
8. Transparency. Tell the recipient when AI generated a substantial part of content sent outside [Company] if [a customer contract, law or Company guideline] requires it. Do not claim AI output is human-written where that would mislead.
9. Training. Personnel must complete [Company]'s AI training before using approved tools and when this Policy changes.
10. Reporting. Report promptly to [team or email] if restricted information was entered into an AI tool, if an AI tool produced harmful or unlawful output, or if you think this Policy has been broken. Good-faith reports will not be held against you.
11. Monitoring and enforcement. [Company] may monitor use of its systems and AI tool accounts as permitted by law. Breaking this Policy may lead to loss of access and discipline, up to and including termination.
12. Review. [Policy owner] will review this Policy at least every [12] months and when laws, tools or business needs change.
Acknowledgment: I have read and will follow this Policy. Name: [__________] Signature: ____________________ Date: [______]
Not legal advice. Employment, privacy, monitoring and sector rules vary by state and industry; for example, some states restrict employee monitoring or require notice of it. Have counsel check the policy against your handbook and the laws that apply to you.
Add-on for law firms
Lawyers using generative AI also have professional conduct duties. ABA Formal Opinion 512 (29 July 2024) addresses them under the Model Rules. A firm AI policy usually adds:
- Competence: lawyers understand the capabilities and limits of the tools they use, and independently verify output, including every case citation, before relying on it.
- Confidentiality: before client information goes into a tool that could disclose it or use it outside the matter, the lawyer assesses the risk; the opinion says informed client consent is required before inputting information relating to the representation into a self-learning tool of that kind.
- Communication: when to tell clients that AI is being used on their matter.
- Fees: when billing hourly, charge only for time actually spent on the matter, including appropriate review of AI output. Flat or contingent fees must still be reasonable. Do not charge clients for learning a general-purpose AI tool you will regularly use.
- Supervision: partners and supervising lawyers set firm rules and training, and supervise lawyers and staff who use AI.
- Court rules: check local and judge-specific rules on AI disclosure or certification in filings.
State bars have issued their own guidance too, so check your jurisdiction's opinions. See also AI for solo lawyers.
Common mistakes in AI policies
- A blanket ban nobody follows. If staff need AI to do their jobs, a ban pushes use into personal accounts you cannot see. Approve tools instead and set information rules.
- Information rules that ignore your data classification. "Don't enter confidential data" is hard to apply unless it maps to the categories staff already use.
- No owner for the approved tools list. Tools and vendor terms change; someone must keep the list current.
- Forgetting AI features inside existing software. Many office, CRM and design tools now include AI. The policy should cover them.
- "AI output is reviewed" with no reviewer. Name who reviews what, especially for customer-facing and high-risk work.
- Ignoring hiring and HR uses. Screening, ranking or monitoring people with AI can bring in anti-discrimination, notice and audit rules.
- No review date. An AI policy written once and never updated goes stale quickly.
How to draft or review an AI policy in Word with LexDraft
LexDraft is a Word add-in from Microsoft AppSource. It opens as a side panel in Word 365 (Windows and Mac), Word 2021 and Word on the web, so the policy stays in the document you are already editing.
Describe your company's rules
Open LexDraft in Word and describe what you need in plain English: your industry, the tools staff use, your data categories, and the uses you want to ban. LexDraft asks a few clarifying questions, then writes a first draft into your document as editable Word text.
Review the draft
Run a review on the draft or on a policy you already have. LexDraft has four built-in playbooks (NDA, SaaS MSA, DPA and services agreement) and no dedicated AI policy playbook, so this runs as a general review. Findings are graded Critical, High, Medium or Low.
Check and accept the redlines
Run the defined-term and cross-reference checks, which are rule-based and run without AI. Accept or reject each proposed redline; accepted changes land as native Word tracked changes.
What LexDraft does not do: it does not give legal advice or tell you which laws apply to your company. LexDraft does not use your documents to train AI models (see security). You check every output before the policy is adopted.
Frequently Asked Questions About AI Policies
What is an AI acceptable use policy?
An AI acceptable use policy is an internal company policy that sets the rules for how employees and contractors use AI tools at work: which tools are approved, what information may be entered into them, which uses are prohibited, how AI output must be reviewed, and how to report problems. It is also called an AI usage policy or a generative AI policy.
Does my company need an AI policy?
If staff already use AI tools for work, a policy is the simplest way to set limits on confidential, customer and personal information and to make clear that AI output must be checked. No general US federal law requires every company to have one, but some laws apply to specific uses, such as AI used in hiring, and customer contracts or industry rules may limit how you share data with AI vendors.
What should an AI policy include?
Purpose and scope, the approved tools list and how to request a new tool, information rules tied to your data classification, prohibited uses, human review of output, intellectual property, transparency, vendor review, training, incident reporting, monitoring and enforcement, and who owns and reviews the policy.
Can employees use ChatGPT or other public AI tools at work?
That is a company decision. Many policies allow approved tools through company accounts and restrict what information can be entered, rather than banning AI outright. Check the vendor's business terms, including whether it trains on your data and how long it keeps it, before approving a tool for confidential information.
What laws apply to AI use at work in the US?
It depends on the use and the location. Existing laws on discrimination, privacy, consumer protection and sector regulation apply to AI as to any other tool. Some laws target specific uses: for example, New York City Local Law 144 requires a bias audit and notices before employers use an automated employment decision tool for jobs in the city. State AI laws are changing quickly, so have counsel check the ones that apply to you.
What do law firms need in an AI policy?
Law firms usually add rules on competence, confidentiality, client communication, fees and supervision. ABA Formal Opinion 512 (29 July 2024) addresses these duties for generative AI under the Model Rules, including verifying output and getting informed client consent before inputting information relating to a representation into a self-learning tool that could disclose it. Firms should also check state bar guidance and court rules on AI in filings.
How often should an AI policy be reviewed?
At least once a year, and whenever you approve a new tool, a vendor changes its terms, or a new law applies to you. Many companies review every six months because AI tools change quickly.
Can I use a free AI policy template?
Yes, as a starting point. Match it to your data classification, approved tools, industry rules and employee handbook, fill in every bracket, and have counsel review it before you adopt it.
Draft and review AI policies in Word
Describe your rules, get a first draft in your document, then review it with tracked-change redlines. You stay in Word, and you decide what changes.
Install LexDraft for WordThis page is general information, not legal advice. LexDraft does not give legal advice; review every draft with qualified counsel. Spotted something out of date? Email support@lexdraft.ai and we will fix it.