# How to Write an AI Acceptable Use Policy (Free Template)

> A free AI acceptable use policy template you can copy: approved tools, what data staff may paste, who reviews output and what to do after a mistake.

Source: https://learn.ynteractive.com/content/blog/ai-acceptable-use-policy-template · Updated 2026-10-21 · Free from Stepthrough (https://learn.ynteractive.com)

Quick answer

**Short answer:** to write an [AI acceptable use policy](https://learn.ynteractive.com/content/glossary/ai-acceptable-use-policy) for a small business, decide eight things (approved tools, data that never goes in, allowed uses, banned uses, a human review rule, how to report mistakes, who approves new tools and when you review it), write each as one or two sentences on a single page, test it on real documents, and have everyone sign it. The free [Roll Out a Team AI Policy in One Afternoon](https://learn.ynteractive.com/content/ai-acceptable-use-policy-claude) lesson builds one with you.

Last updated October 21, 2026

[Take the free module →](https://learn.ynteractive.com/courses/ai-at-work/5)Module 5 of the free [AI at Work: Start Here](https://learn.ynteractive.com/courses/ai-at-work) course, about 10 minutes. No account needed.

By [Robert Breen](https://learn.ynteractive.com/content/about) · Published October 16, 2026 · Updated October 21, 2026 · 9 min read

AI policy · AI governance · Data privacy · Small business

An AI acceptable use policy is a short written set of rules that says which AI tools your staff may use, what information they may and may not paste into them, who checks the output and what to do after a mistake. For a small team it fits on one page. Copy the template below, replace everything in [BRACKETS] with your own decisions, and have a lawyer or compliance person review it if your work is regulated. This is practical guidance, not legal advice. To build one with [Claude](https://learn.ynteractive.com/content/glossary/claude) in about ten minutes, try the free [Roll Out a Team AI Policy in One Afternoon](https://learn.ynteractive.com/content/ai-acceptable-use-policy-claude) lesson.

This page is for owners, office managers and operations or HR leads at teams of about 5 to 50 people. If you want the bigger picture first, read the [AI governance starter kit](https://learn.ynteractive.com/content/explainers/ai-governance-for-small-business). If you want AI to write a first draft for you, use the [staff AI use policy prompt](https://learn.ynteractive.com/content/prompts/ai-use-policy-draft-prompt).

## How do you write an AI acceptable use policy for a small business?

Seven steps, about an afternoon of work for a team of 5 to 50:

1. **List the AI your team already uses.** Ask everyone, including AI features inside tools you already pay for. That list is where your approved-tools rule starts.
2. **Pick the approved tools and accounts.** Name each tool and the plan or account type, such as a business plan with a company login.
3. **Sort your data into levels.** For example public, internal and confidential, and write down which level may go into which tool.
4. **Write the eight rules.** Use the template below and fill in every [BRACKET] with a real decision.
5. **Test the "never paste" list.** Run it against three real documents your team handles and fix anything unclear.
6. **Get it reviewed.** The owner and one other person read it; a lawyer or compliance person reviews it if your work is regulated.
7. **Roll it out and set a review date.** Walk the team through it for ten minutes, collect signatures and put the next review date in rule 8.

Here is what each rule covers, with a small-business example:

| Rule | What it decides | Small-business example |
| --- | --- | --- |
| 1. Approved tools | Which AI tools and accounts staff may use | "ChatGPT Business on your work login only" |
| 2. Data that never goes in | What must not be entered | "No client ID numbers, account numbers, health details or passwords" |
| 3. Allowed uses | What AI may help with | "First drafts of emails, meeting summaries, spreadsheet formulas" |
| 4. Not allowed | What AI must not do | "No final decisions about people, no tax or legal advice to customers" |
| 5. Review rule | Who checks output before it leaves | "A person reads every AI draft before it goes to a customer" |
| 6. Mistakes | How to report a slip | "Tell the office manager the same day; no blame for quick reports" |
| 7. New tools | Who approves new AI tools and features | "Ask the owner before signing up or turning on an AI feature" |
| 8. Updates | When the policy is reviewed | "Every six months and whenever we add a tool" |

## What goes in an AI acceptable use policy?

A small-business policy needs eight rules: approved tools, data that never goes in, allowed uses, forbidden uses, a human review step, how to report a mistake, who to ask and when it gets updated. Each rule is a sentence or two. The point is that every person on the team gives the same answer when someone asks "can I put this in ChatGPT?".

The [AI acceptable use policy](https://learn.ynteractive.com/content/glossary/ai-acceptable-use-policy) glossary page explains the idea with a law-firm example, and [AI policy](https://learn.ynteractive.com/content/glossary/ai-policy) covers how it fits with the rest of your rules.

## What does a copy-and-paste AI acceptable use policy look like?

Here is a one-page template. Replace each [BRACKET], delete any rule you have not decided yet, and keep the rest short.

```text
[COMPANY NAME] AI ACCEPTABLE USE POLICY
Effective [DATE]. Owner of this policy: [NAME AND ROLE].

1. Approved tools. You may use only these AI tools for work: [LIST TOOLS AND THE PLAN OR ACCOUNT TYPE]. Use your work login, never a personal account.
2. Data that never goes in. Do not enter [LIST: for example client names with account numbers, ID numbers, health details, passwords, unreleased financials]. If you are unsure which level a document is, treat it as the higher one.
3. Allowed uses. AI may help with [LIST: for example first drafts of emails, meeting summaries, outlines, spreadsheet formulas].
4. Not allowed. AI must not [LIST: for example make final decisions about people, give legal, tax or medical advice to customers, send anything to a customer without a person reading it].
5. Review rule. A person reads every AI draft before it leaves the company. You are responsible for what you send, including any fact, date, price or promise in it.
6. Mistakes. If you paste something you should not have, or send something wrong, tell [NAME OR EMAIL] the same day. You will not be blamed for reporting quickly.
7. New tools. Ask [NAME] before you sign up for any new AI tool or turn on an AI feature inside a tool we already use.
8. Updates. We review this policy every [HOW OFTEN] and whenever we add a tool.

I have read and understand this policy.
Name: ________  Date: ________
```

## What do you fill in for each rule?

Four of the blanks take real work: the tools list, the data classes, the review rule and the mistake rule. Decide these first and the rest is easy.

- **Approved tools.** Name each tool and the plan or account type, such as a business plan with a company login. As of October 2026, [OpenAI](https://learn.ynteractive.com/content/glossary/openai), Anthropic and Google say their business plans don't train on your data by default, which is a common reason to require them; check each vendor's current terms. Say plainly whether personal accounts are allowed for work. The [Use AI at Work Without Leaking Client Data](https://learn.ynteractive.com/content/safe-ai-at-work-what-not-to-paste) lesson shows why account type matters.
- **Data that never goes in.** Sort your documents into levels such as public, internal and confidential, then list what each level may do. The [data classification](https://learn.ynteractive.com/content/glossary/data-classification) glossary page explains the levels, and the free [Know What Never Goes into AI](https://learn.ynteractive.com/content/what-not-to-put-into-ai-data-classification) lesson walks through sorting your own files.
- **Review rule.** Say who reads AI output and when. For customer-facing messages, a person always reads the draft before it is sent.
- **Mistake rule.** Make reporting easy and blame-free. The free [Someone Pasted Client Data into AI](https://learn.ynteractive.com/content/client-data-pasted-into-chatgpt-what-to-do) lesson walks through the first hour after a mistake, so your rule can point to real steps.

## Try it free, step by step

**Roll Out a Team AI Policy in One Afternoon using Claude**. Your team already uses AI, with or without rules. Have Claude write a one-page acceptable use policy from your rules, check the parts that matter, then get the announcement email and a 5-question… You do every step yourself in a practice copy of Claude, it checks your work as you go, and “Do it for me” finishes any step you get stuck on. Free, and nothing touches your real accounts.

[Start the free lesson](https://learn.ynteractive.com/modules/claude-team-ai-policy)

[Or read the full step-by-step guide](https://learn.ynteractive.com/content/ai-acceptable-use-policy-claude)

## How should the template change for different teams?

Keep the eight rules and change the lists. Three common variants:

- **Office team.** Short approved-tools list, one data rule for client files, and a review rule for any email that goes to a client. Most offices can use the template almost as written.
- **Law firm, accounting firm or consulting office.** Add a rule that nothing about a client matter goes into a tool that has not been approved for client work, and that a senior reviewer approves client-facing drafts. The free [Roll Out a Team AI Policy in One Afternoon](https://learn.ynteractive.com/content/ai-acceptable-use-policy-claude) lesson builds a policy like this with Claude, using Northfield Consulting Group, a made-up firm.
- **Small shop or field team.** Keep it to one screen: which tool, never paste customer payment details, and read every text or email before you send it. Put it where people will see it, such as next to the time clock.

## How do you roll the policy out?

Decide the blanks, have the owner and one reviewer read it, then walk the team through it for ten minutes and collect signatures. A policy nobody has read protects no one.

1. Fill in the template with real decisions, not wishes.
2. Test the "never paste" list against three real documents your team handles.
3. Hold a short meeting. Show one good example and one mistake.
4. Keep signed copies and put the policy somewhere everyone can find it.
5. Add a reminder to review it on the date you wrote in rule 8.

Before you write rule 2, read [Is it safe to paste client data into ChatGPT?](https://learn.ynteractive.com/content/blog/is-it-safe-to-paste-client-data-into-chatgpt) for what to strip out. For a plain-English list of what staff can safely paste into ChatGPT, see [Team AI Policy: What Staff Can Paste Into ChatGPT](https://learn.ynteractive.com/content/blog/team-ai-policy-what-staff-can-paste-into-chatgpt). The [shadow AI](https://learn.ynteractive.com/content/glossary/shadow-ai) glossary page explains what happens when people use AI tools the company has not approved.

## Key takeaways

- An AI acceptable use policy for a small team fits on one page and has eight rules.
- The hardest parts are the approved tools list, the data that never goes in, the review rule and the mistake rule.
- Use work accounts, not personal ones, and make reporting a mistake easy and blame-free.
- Test the rules on real documents before you roll them out, and review them on a set date.
- Have a lawyer or compliance person review the final policy if your work is regulated.

## Frequently asked questions

**Where can I get a free AI acceptable use policy template?**

Copy the template on this page. It covers approved tools, what staff may paste, who reviews output and what to do after a mistake, with [BRACKETS] for your own decisions. To draft one with AI instead, use the free Claude team AI policy lesson.

**How do I write an AI acceptable use policy for a small business?**

Keep it to one page and decide eight things: which AI tools are approved, what data never goes in, what AI may help with, what it must not do, who reads every draft before it goes out, who to tell after a mistake, who approves new tools and how often you review the policy. Copy the template above, fill in the brackets, and have everyone who uses AI sign it.

**Do small businesses need an AI acceptable use policy?**

If anyone on your team uses AI with customer, client or employee information, yes. Even a one-page policy prevents the most common mistakes, such as pasting ID numbers into a free chatbot or sending an AI draft nobody read.

**What should an AI acceptable use policy ban?**

Ban what you cannot undo: entering the data you listed as never allowed, sending AI output to customers unread, using personal accounts for client work and letting AI make final decisions about people. Keep the list short enough that people remember it.

**Who signs an AI acceptable use policy?**

Every person who uses AI for work signs or acknowledges it, and the owner or a senior manager approves it. If your work is regulated, ask a lawyer or compliance person to review it before you roll it out.

**How often should you update the policy?**

Review it on a set schedule, such as every six months, and any time you add a new AI tool or turn on an AI feature in a tool you already use. Write the schedule into rule 8 so it actually happens.

## Free lessons in this post

- [Roll Out a Team AI Policy in One Afternoon using Claude](https://learn.ynteractive.com/content/ai-acceptable-use-policy-claude): Your team already uses AI, with or without rules. Have Claude write a one-page acceptable use policy from your rules, check the parts that matter, then get the…
- [Use AI at Work Without Leaking Client Data using ChatGPT](https://learn.ynteractive.com/content/safe-ai-at-work-what-not-to-paste): Turn off model training, strip a tenant's bank details and address out of a prompt, then catch the two promises ChatGPT made up before the reply goes out.
- [Know What Never Goes into AI: a Four-Level Data Cheat Sheet using ChatGPT](https://learn.ynteractive.com/content/what-not-to-put-into-ai-data-classification): Sort office data into Public, Internal, Confidential and Restricted, take the Restricted part out by hand, then have ChatGPT redact a client email and catch the mix-up…
- [Someone Pasted Client Data into AI: Contain It in One Hour using ChatGPT](https://learn.ynteractive.com/content/client-data-pasted-into-chatgpt-what-to-do): A new hire pasted a client payroll export into ChatGPT. Delete the chat, delete the memory it left behind, turn off training, then write the incident note, the client…

## Watch it in a free lesson: ChatGPT: Keep Client Data Safe, Set Up Your Team's Data Controls in 10 Minutes

### ChatGPT: Keep Client Data Safe, Set Up Your Team’s Data Controls in 10 Minutes: video walkthrough

Full walkthrough · 3:05 · with captions

A client asks if their files go into ChatGPT. Answer with confidence: set the data controls, memory, Temporary Chat and shared links, then hand your team a one-page AI policy. The whole lesson narrated step by step, recorded in Stepthrough’s simulated practice environment.

[Watch it with chapters and the full transcript](https://learn.ynteractive.com/content/chatgpt-data-controls-protect-client-data#watch)

From the free lesson [ChatGPT: Keep Client Data Safe, Set Up Your Team's Data Controls in 10 Minutes](https://learn.ynteractive.com/content/chatgpt-data-controls-protect-client-data)

## Related terms

Plain-English definitions, each with an example from a free lesson.

[AI acceptable use policy](https://learn.ynteractive.com/content/glossary/ai-acceptable-use-policy) · [Claude](https://learn.ynteractive.com/content/glossary/claude) · [OpenAI](https://learn.ynteractive.com/content/glossary/openai) · [AI policy](https://learn.ynteractive.com/content/glossary/ai-policy) · [Data classification](https://learn.ynteractive.com/content/glossary/data-classification) · [Data minimization](https://learn.ynteractive.com/content/glossary/data-minimization) · [Improve the model for everyone](https://learn.ynteractive.com/content/glossary/improve-the-model-for-everyone) · [Model card](https://learn.ynteractive.com/content/glossary/model-card)

[The full AI glossary](https://learn.ynteractive.com/content/glossary)

## Related prompts

- [AI data level sorting prompt](https://learn.ynteractive.com/content/prompts/ai-data-level-sorting-prompt): A copy-ready prompt that sorts your office's common documents into Public, Internal, Confidential and Restricted, with one AI…
- [ChatGPT settings checklist prompt](https://learn.ynteractive.com/content/prompts/chatgpt-account-settings-checklist-prompt): A copy-ready prompt that turns your plan and data rules into a one-page checklist of ChatGPT settings for staff, with a column…
- [IT incident report prompt](https://learn.ynteractive.com/content/prompts/it-incident-report-prompt): A ChatGPT prompt for an IT incident report: turn your log into a timeline, what was affected, how you contained it and what is…
- [AI assistant answer scorecard prompt](https://learn.ynteractive.com/content/prompts/ai-assistant-answer-scorecard-prompt): A prompt that checks four AI assistants' answers to the same task against your own facts and fills a scorecard, so you can pick…

[All free prompt templates](https://learn.ynteractive.com/content/prompts)

## Keep reading

- [How to Check If a Company Is SOC 2 Compliant](https://learn.ynteractive.com/content/blog/how-to-check-if-a-company-is-soc-2-compliant): How to check a vendor's SOC 2 claim: ask for the report, then check the type, dates, auditor, scope, opinion and exceptions. A checklist for small offices.
- [How to Choose a Private AI Tool for Your Business](https://learn.ynteractive.com/content/blog/how-to-choose-a-private-ai-tool-for-work): How to choose the right private AI solution: business plans vs self-hosted models, five questions for vendors, and what major plans say about training.
- [AI Automation for HR Teams: 12 Questions Answered](https://learn.ynteractive.com/content/blog/ai-automation-for-hr-teams-faq): How HR teams use AI for a handbook agent, leave replies that don't overpromise and a team AI policy, with the guardrails each one needs.

[All blog posts](https://learn.ynteractive.com/content/blog) · [All free tutorials](https://learn.ynteractive.com/content)