AI Acceptable Use Policy

AI ACCEPTABLE USE POLICY

[ORGANIZATION NAME]

1. Document control

2. Policy status and scope

This policy states the Organization's selected internal rules for people who
use an AI system with Organization accounts, devices, funds, information, work
product, authority, or business processes.

It may cover standalone tools, embedded features, models, classifiers,
assistants, search or retrieval functions, content generators, coding tools,
agents, automation, and systems developed or operated by the Organization.
The approved-system and approved-use schedules control the actual scope.

This policy does not itself approve a vendor, account, system, model,
integration, data class, user, or use case.

Policy applies to: [________________________________]

Express exclusions: [________________________________]

Effective policy hierarchy and conflict route: [________________________________]

3. Organization-defined terms

These are internal definitions. Replace or qualify them when a controlling
source, contract, or other policy uses a different definition.

AI System: [________________________________]

Approved System: [________________________________]

Approved Use: [________________________________]

Input: [________________________________]

Output: [________________________________]

Restricted Information: [________________________________]

Material Decision or High-Impact Use: [________________________________]

Human Review: [________________________________]

Incident: [________________________________]

4. Current obligations and restrictions register

Before adoption, identify the requirements that apply to the Organization's
actual systems, roles, data, uses, people, and locations.

Do not treat a vendor statement, model output, generic law list, or another
organization's policy as the completed register.

5. Approved-system and use schedule

A user may proceed only when the system, account, configuration, role, data,
purpose, output destination, human review, and expiration shown below cover the
proposed activity.

Unlisted system or use request route: [________________________________]

Material-change reassessment triggers: [________________________________]

A system approved for one task or data class is not automatically approved for
another.

6. Before-use rules

Before entering information or requesting an action, the user must confirm:

☐ The exact system, account, configuration, role, and use are approved

☐ The user is authorized to use every input for the proposed purpose

☐ The input is limited to what the approved task needs

☐ Required redaction, de-identification, consent, notice, contract, transfer, and security controls are complete

☐ Provider retention, training, human-review, sharing, region, and deletion settings have been checked

☐ The required human reviewer and output destination are known

☐ The work can be stopped, corrected, or completed through the approved fallback

☐ The required record can be preserved without retaining unnecessary sensitive material

If any item is unresolved, stop and use the approval or help route.

7. Input and access restrictions

Never enter passwords, private keys, access tokens, authentication answers, or
another secret barred by the Organization's current security policy.

Personal, health, financial, workforce, customer, client, privileged,
confidential, trade-secret, export-controlled, source-code, investigation,
litigation, child-related, biometric, or third-party information may be used
only when the approved schedule expressly permits that data and every listed
control is active.

Removing obvious names does not by itself establish that information is safe
or outside an applicable restriction. Free text, attachments, images,
metadata, logs, combinations, and re-identification risk must be considered.

Approved secure alternative when the data is not permitted: [________________________________]

8. Prohibited conduct

Unless a separately approved use expressly authorizes and controls the
activity, users must not use an AI System to:

• obtain unauthorized access, bypass a safeguard, expose a secret, deploy
  malicious code, or conceal prohibited activity;

• fabricate evidence, records, identities, approvals, credentials, quotations,
  citations, test results, reviews, or events;

• impersonate a person or mislead a recipient about authorship, source,
  sponsorship, review, or material automation;

• harass, exploit, threaten, discriminate, defraud, or facilitate unlawful or
  unsafe conduct;

• make, communicate, or execute a Material Decision outside the approved
  testing, human-review, notice, explanation, challenge, and record controls;

• publish content, send an external communication, submit a filing, commit
  code, change a production system, transact, or take physical or digital
  action without the required authorization;

• evade a client, court, regulator, professional, academic, platform,
  procurement, labor, records, or contract requirement;

• train, fine-tune, evaluate, or improve a model with Organization or
  third-party information without approval; or

• connect an unapproved plugin, agent, tool, integration, account, retrieval
  source, or data store.

9. Output verification and use

AI Output is unverified until the review selected for the use is complete.
The accountable reviewer must use the evidence and standard appropriate to the
downstream task.

Review may include source checking, recalculation, testing, security and
privacy review, rights clearance, accessibility review, bias or performance
assessment, record creation, and confirmation of required disclosure.

Do not describe an Output as accurate, verified, original, confidential,
privileged, compliant, noninfringing, approved, or safe merely because a
system generated it or a person looked at it.

10. External use, decisions, and automated action

A user must not expand a reviewer role, automated permission, or system
integration beyond the approved controls.

11. Records, monitoring, and privacy

The Organization must complete the monitoring, records, workforce, privacy,
and security plan before relying on this policy as authority, notice, or
consent.

Do not retain unnecessary sensitive inputs or outputs merely “for audit.”

12. Incident and concern reporting

Stop the affected activity and contact [INCIDENT CONTACT] through
[REPORTING METHOD] for a suspected:

• sensitive-data submission or unintended disclosure;
• unauthorized account, access, plugin, integration, or automated action;

• harmful, discriminatory, deceptive, infringing, or materially inaccurate
  Output;

• Material Decision made outside approved controls;

• unexpected provider retention, training, sharing, region, or subprocessor;
• missing required record or inability to reproduce a material result;
• control failure, policy violation, complaint, or near miss; or
• other suspected legal, contractual, professional, security, or safety issue.

Preserve relevant evidence without spreading the information further. Follow
the approved incident lead's instructions for deletion, notification,
communication, correction, and escalation.

Good-faith reporting and nonretaliation source: [________________________________]

This policy does not create a universal statutory reporting or nonretaliation
right.

13. Training, consequences, and exceptions

Training required before access: [________________________________]

Refresher or change-triggered training: [________________________________]

Knowledge or practical assessment: [________________________________]

Consequences route under current policies, agreements, and law: [________________________________]

An exception requires a written owner, reason, exact system, use, user, data,
controls, approvers, start date, expiration, monitoring, and revocation
conditions. An exception cannot authorize conduct the approver lacks authority
to permit.

14. User acknowledgment

I acknowledge receipt of this policy and understand where to find the current
approved-system and use schedule, how to request approval, and how to report a
concern. My signature does not waive a right or replace any notice, consent,
agreement, consultation, or acknowledgment required by an applicable source.

Name: [________________________________]

Role: [________________________________]

Signature: [________________________________]

Date: [__/__/____]

15. Adoption checklist

☐ Organization, workforce, systems, accounts, data, uses, and exclusions identified

☐ Current obligations and restrictions register completed from verified sources

☐ Approved-system and use schedule completed

☐ Input, review, external-use, decision, records, monitoring, and incident controls approved

☐ Conflicts with contracts, collective arrangements, professional duties, and other policies resolved

☐ Training, exception, consequence, complaint, and nonretaliation routes approved

☐ Policy owner, approvers, version, effective date, and next review set

☐ Counsel and responsible teams approved the adopted policy

This template is provided for informational purposes only and does not constitute legal advice.