Template, AI Governance
AI Acceptable Use Policy Template for Regulated Companies
Clause-by-clause sample wording you can copy, adapt and get signed off, written for teams in healthcare, life sciences, financial services and insurance.
An AI acceptable use policy template is a ready-made set of policy clauses that tells employees which AI tools they may use, what data may never go into them, and who must review AI output before it is relied on. The template below covers purpose, scope, an approved tools register, data classification, human review, regulated data, disclosure, IP, incident reporting, training, enforcement and review, each with sample wording you can adapt.
what it is
What an AI Acceptable Use Policy Is, and What It Is Not
An AI acceptable use policy is the short, enforceable document that sets the rules for how staff use generative AI tools at work. It sits under your information security and data protection policies, not beside them.
Most companies already have staff pasting work into chat assistants. The policy does not stop that by itself. What it does is draw three lines everyone can remember: which tools are approved, which data never leaves the building, and which outputs a person must check before anyone acts on them.
It is not your AI governance framework. A framework covers model inventory, risk tiering, validation and oversight for the AI systems you build or buy. The acceptable use policy covers people and everyday tools. You need both, and the policy should point to the framework rather than repeat it.
Whether you call it an AI use policy template or an AI usage policy template, the clauses are the same. This is a starting point, not legal advice. Have your legal, privacy and compliance leads review the adapted version before you publish it.
template clauses
The AI Acceptable Use Policy Template: Clauses and Sample Wording
Sample wording only, not legal advice. Have legal, privacy, HR and compliance review before adoption; monitoring and enforcement language in particular depends on your jurisdiction and employment terms. Copy each clause, replace the bracketed text, and delete anything that does not fit your business.
1. Purpose
Sample wording: "This policy sets the rules for using artificial intelligence tools at [Company]. Its purpose is to let employees use AI to work more effectively while protecting customer, patient and company information, meeting our legal and regulatory obligations, and keeping a person accountable for every decision."
2. Scope
Sample wording: "This policy applies to all employees, contractors, temporary staff and third parties working on [Company]'s behalf. It covers any AI tool used for company work, including chat assistants, coding assistants, AI features built into existing software, browser extensions and AI tools on personal devices."
3. Approved tools register
Sample wording: "Only AI tools listed in the Approved AI Tools Register may be used with company information. The register, maintained by [IT / Security], records each tool, the account type we pay for, the data classes it is approved for, and its owner. A tool is added only after security and privacy review, including a written vendor commitment on whether prompts and outputs are retained or used for model training. To request a new tool, submit [form/link]."
4. Data classification rules
Sample wording: "You may use Public information with any approved tool. Internal information may be used only with tools approved for Internal data. Never enter the following into any public or personal AI tool: customer or patient personal data, protected health information, account or card numbers, credentials and API keys, source code marked confidential, unreleased financial results, legal advice, or anything covered by a non-disclosure agreement. If you are unsure of a classification, treat the data as Confidential."
5. Human review of outputs
Sample wording: "AI output is a draft. Before you send, publish, file or act on it, a qualified person must check it for accuracy, completeness and tone. You are accountable for anything you submit, whether or not AI helped produce it. AI must not make final decisions about employment, credit, coverage, clinical care or legal matters without documented human review."
6. Regulated data rules
Sample wording: "Protected health information may be processed only in tools listed in the register as approved for PHI and covered by a business associate agreement. Customer financial data, including nonpublic personal information, may be processed only in tools approved for that class. Models that inform regulated decisions must go through [Model Risk / AI Governance] review before use."
7. Disclosure
Sample wording: "Disclose AI assistance where a customer, patient, regulator or court would reasonably expect to know, and wherever a law or contract requires it. Do not present AI-generated content as the personal work of a named expert. Customer-facing chat tools must tell users they are talking to an automated system."
8. Intellectual property and confidentiality
Sample wording: "Do not enter third-party confidential information or code you do not have the right to share. Review AI-generated text, images and code for possible copying of protected material before external use. Work product created with AI for [Company] belongs to [Company] under your existing employment or contractor agreement."
9. Incident reporting
Sample wording: "Report to [security contact] immediately if you entered restricted data into an unapproved tool, an AI tool produced harmful or discriminatory output that reached a customer, or you suspect an AI tool or account was compromised. Reporting quickly will not by itself lead to disciplinary action. Hiding an incident will."
10. Training requirement
Sample wording: "All staff must complete AI acceptable use training before receiving access to approved AI tools, and refresh it annually. Teams handling regulated data complete additional role-specific training."
11. Enforcement
Sample wording: "Breaches of this policy are handled under [Company]'s disciplinary policy and may lead to loss of tool access, disciplinary action up to termination, and, where the law requires, notification to regulators or affected individuals. [IT / Security] may monitor use of approved AI tools in line with our acceptable use and privacy policies."
12. Ownership and review cadence
Sample wording: "This policy is owned by [role]. It is reviewed at least annually, and sooner when we approve a new class of AI tool, when a relevant law or regulator guidance changes, or after a significant incident. Questions go to [contact]."
ai security policy
AI Use Policy Examples: Where Teams Usually Get Stuck
Reading other companies' AI use policy examples, the same gaps come up. These are common gaps in AI use policies.
A ban with no approved alternative
A policy that only says "do not use AI" produces shadow AI: staff use personal accounts on personal phones where you have no visibility. Publish an approved tool alongside the restriction, even if it starts with a single assistant for one team.
Treating the AI usage policy as a security policy
An AI security policy covers technical controls: identity and single sign-on, logging, data loss prevention, retention settings and vendor security review. The AI usage policy covers behaviour. Keep them separate, cross-reference them, and make sure the register in the usage policy matches what security has actually configured.
No owner for the register
If nobody owns the approved tools register, it goes out of date within a quarter and staff stop trusting it. Name a role, not a person, and put the review in someone's objectives.
adapt healthcare
How to Adapt This Template for Healthcare and Life Sciences
In a hospital, health plan or life sciences company, the regulated data clause carries most of the weight. Name the specific tools approved for PHI and confirm a business associate agreement is in place for each one before staff use it. State that de-identified data must meet your organisation's de-identification standard before it goes into a tool not approved for PHI, and that staff may not de-identify records themselves on the fly.
Add a clinical line to the human review clause: AI output must not be entered into the medical record or used for diagnosis or treatment decisions without review by a licensed clinician. For life sciences, add that AI used in GxP processes follows your computer system validation procedures. Our HIPAA AI compliance requirements guide covers the underlying obligations in more depth.
adapt financial services
How to Adapt This Template for Financial Services and Insurance
Banks, wealth managers and insurers should tie the human review clause to model risk management. Any AI that informs credit, underwriting, pricing, claims, fraud or anti-money-laundering decisions is in scope for model risk review before use, not just the policy. Say so in plain words, and name the review body.
Add a communications line: AI-drafted client communications follow the same supervision, approval and record-keeping rules as any other client communication. Add a fairness line for insurance and lending: outputs that affect customers must be checked for unfair discrimination under your existing fair lending or unfair discrimination procedures.
rollout
Rolling Out Your AI Acceptable Use Policy
1. Inventory what is already in use
Ask teams which AI tools they already rely on. The register should start from reality.
2. Approve at least one tool
Give people a sanctioned route before you enforce restrictions, configured with single sign-on and logging.
3. Publish with training
Pair the policy with short, role-based training so staff see examples of allowed and prohibited use in their own work.
4. Measure and revise
Track register requests and incident reports, and revise the policy at the first scheduled review rather than waiting for a problem.
why kriv
Where Kriv AI Fits
Kriv AI is a governed-AI consultancy for regulated industries. We help teams turn a template like this into a policy that matches their actual tools, data classes and approval routes, then train staff on it. Our credentials: Claude Partner Network, Select partner · Services Track, and OpenAI Partner Network · Select tier.
The honest gap: we do not yet have a named, published case study for a policy engagement. Policy and governance work is scoped and priced after a short discovery call.
Related resources
Continue exploring
Straight answers
Frequently asked questions about AI Acceptable Use Policy Template for Regulated Companies
Can I use this AI acceptable use policy template as is?
You can start from it, but adapt it before you publish. Replace every bracketed placeholder, align the data classes with your existing classification scheme, and list the tools you actually approve. Then have legal, privacy, security and HR review it, because enforcement and monitoring language must match your employment terms and local law. This template is not legal advice.
What should never be pasted into a public AI tool?
At minimum: personal data about customers, patients or employees, protected health information, account and card numbers, passwords and API keys, confidential source code, unreleased financial information, privileged legal material and anything under a non-disclosure agreement. The safer rule for staff is simple: if a tool is not on the approved register for that data class, the data does not go in.
What is the difference between an AI acceptable use policy and an AI security policy?
The acceptable use policy tells people how to behave: which tools, which data, which checks. An AI security policy tells IT and security how to configure and monitor those tools: access control, logging, retention, data loss prevention and vendor security review. Small companies sometimes combine them, but keeping them separate makes each one easier to update and audit.
Should our AI usage policy ban public chatbots completely?
A full ban rarely holds. People move to personal devices and you lose all visibility. A better pattern is to approve a business-grade tool with single sign-on, logging and a written vendor commitment on data use, restrict public tools to public information only, and make the approval route for new tools quick enough that people use it.
How often should an AI acceptable use policy be reviewed?
At least once a year, and sooner when you approve a new category of tool, when a law or regulator guidance that applies to you changes, or after a significant incident. AI tools change faster than most policies, so many teams also review the approved tools register on a shorter cycle than the policy text itself.
Does a healthcare organisation need a separate AI policy for HIPAA?
Usually not a separate policy, but the healthcare version needs specific clauses: where HIPAA applies, tools that handle PHI usually need a business associate agreement, de-identification follows your formal standard, and AI output never enters the medical record or drives care decisions without clinician review. Those rules should reference your existing HIPAA privacy and security policies rather than restate them.
Who should own the AI acceptable use policy?
Ownership usually sits with the chief information security officer, the chief compliance officer or an AI governance lead, with legal and HR as reviewers. What matters more than the title is that one role owns both the policy and the approved tools register, and that the review date is written into the document.
Talk to the team that would do the work
Bring your requirements to a working session with the person who'll actually deliver.
Book a Discovery Call