AI acceptable use policy template, with the state laws it has to account for.

This policy sets the rules for using artificial intelligence (AI) tools at [Company]. It applies to all employees, contractors, interns and anyone else who works on [Company]'s behalf ("you"), on any device, whenever the work is for [Company].

"AI tool" means any software that generates text, code, images, audio or video, or that makes or recommends decisions, predictions or classifications, including chatbots, writing and coding assistants, transcription and meeting tools, and AI features built into other software.

[AI governance owner, e.g. Chief Technology Officer or Legal] owns this policy. Questions go to [contact email].

Use only AI tools on [Company]'s approved list at [link to list]. The list says, for each tool, which data may be used with it and for what purposes.

To request a new tool, submit [request form or process]. [AI governance owner] reviews the vendor's terms, data handling and security before approval. Do not sign up for an AI tool for work using a personal account.

Turn off settings that let a vendor train on [Company] data unless [AI governance owner] has approved it in writing.

Do not enter the following into any AI tool unless it is approved for that category of data: personal information about customers, applicants, patients or employees; health, financial or biometric data; passwords, keys or credentials; confidential business information; or information covered by a confidentiality agreement or legal privilege.

Public information and your own drafts that contain none of the above may be used with any approved tool.

If you are unsure whether data may be used, treat it as confidential and ask [AI governance owner] first.

You are responsible for anything you produce with AI as if you wrote it yourself. Check AI output for accuracy, completeness, bias and tone before you use or share it.

Do not let an AI tool make a final decision that affects a person's job, pay, credit, housing, insurance, health care, education or legal rights. A qualified person must review the relevant information and make that decision.

Verify facts, figures, quotations and citations against the original source. Do not cite a source you have not checked exists.

If a customer or member of the public communicates with an AI tool on [Company]'s behalf, such as a chatbot or voice agent, it must clearly identify itself as AI at the start, and whenever someone asks whether they are talking to a person.

When AI is used in providing a regulated professional service or health care, tell the client or patient in the way and at the time the applicable law requires. [AI governance owner] keeps the approved wording.

Do not tell anyone, directly or by implication, that AI-generated content was written or reviewed by a person if it was not.

Do not use any AI tool to screen, rank, interview, evaluate, promote, discipline or terminate candidates or employees unless [HR leader] and [AI governance owner] have approved that use in writing.

Before an approved tool is used, [HR] gives any notice, obtains any consent and completes any bias audit that the law where the person lives or works requires, and keeps a record of it.

A person, not the tool, makes every final employment decision, and can explain the reasons for it.

Do not create or share AI-generated or AI-altered images, audio or video of a real person without that person's written permission, or impersonate a real person's voice or likeness.

Label AI-generated or materially altered media in advertising or public communications where the law or [Company]'s brand standards require it, and never use it in a way that would mislead a reasonable person.

Do not remove watermarks, provenance data or AI labels from content.

Do not describe an AI tool, or its output, as coming from or endorsed by a doctor, nurse, lawyer, therapist, dietitian or other licensed professional unless a licensed professional actually provided or reviewed it.

Marketing claims about what [Company]'s AI can do must be accurate and supported, and approved by [Marketing and Legal] before publication.

Never use AI tools at work to: create sexual or intimate images of anyone; harass, threaten or deceive people; generate malware or bypass security controls; make decisions about people based on protected characteristics; or do anything that would be unlawful without AI.

Do not use AI to monitor, profile or infer the emotions, health or private characteristics of employees or customers unless [AI governance owner] and [Legal] have approved it in writing.

Do not enter third-party copyrighted material, source code or trade secrets into an AI tool unless [Company] has the right to do so.

Before publishing or shipping AI-generated material as [Company]'s own, check it does not reproduce third-party content and that the tool's terms let [Company] use it commercially.

Report to [AI governance owner / security contact] within [24 hours] if you: put data into an AI tool that this policy does not allow; see an AI tool produce harmful, biased or false output that reached a customer or employee; or learn of a complaint about [Company]'s use of AI.

Reports made in good faith will not lead to retaliation.

Everyone covered by this policy completes AI training when they join and [annually]. Teams using AI for hiring, health care, customer communications or decisions about people complete additional training.

[AI governance owner] reviews this policy at least once a year and whenever a new law, tool or use case requires it. Last reviewed: [date].

Breaking this policy may lead to loss of access to AI tools and disciplinary action, up to and including termination, in line with [Company]'s other policies.