Your team is already using AI. The question is whether there are rules around it. An AI acceptable use policy sets those rules: what tools are allowed, what data can go into them, and who is accountable. Most versions are shelfware. Here is how to write one that holds up.
Start with a reality check. If your policy bans AI outright, people will use it anyway and hide it. A workable policy channels use, it does not pretend to stop it.
What the Policy Is For
An acceptable use policy exists to prevent the predictable harms of unmanaged AI: sensitive data leaking into public models, decisions made by tools nobody vetted, and outputs used without review. It gives employees a clear answer to the question they are already asking: can I use this, with this data, for this task?
What to Include
- Approved tools. Which AI services are sanctioned, and the process to request a new one.
- Data rules. What information may and may not be entered into AI tools, especially personal data, client data, and anything confidential or regulated.
- Acceptable and prohibited uses. The tasks AI may support and the ones that require human judgment or are off limits.
- Review and accountability. Who reviews AI output before it is used, and who owns AI decisions in each area.
- Vendor and embedded AI. How AI inside the tools you already buy is treated, not just standalone chatbots.
Keep it readable. A policy people cannot understand is a policy people will not follow.
The Data Rule Is the Core
If you get one thing right, make it the data rule. The most common AI harm is simple: an employee pastes client data, source code, or personal information into a public tool to save time. Spell out clearly what may go into which tools. Give people a sanctioned option for sensitive work so the rule is realistic, not just restrictive.
Make It Enforceable
A policy nobody owns is a document, not governance. Name an accountable owner for AI use. Tie the policy to real approval and review steps. Train people on it and revisit it as tools and regulations change. An enforceable policy is short, specific, owned, and maintained.
Where It Fits in a Bigger Program
An acceptable use policy is one piece of AI governance, not the whole thing. It sits alongside an AI inventory, a risk assessment process, and reporting. If you are working toward ISO 42001 or aligning with the NIST AI Risk Management Framework, the policy is one of the artifacts those frameworks expect. Write it so it plugs into that larger structure.
Frequently Asked Questions
Should we just ban AI to be safe?
Banning it rarely works. People use AI anyway and hide it, which is worse. A policy that channels use toward approved tools and clear data rules manages the risk better than a ban.
Who should own the AI acceptable use policy?
A named, accountable owner with the authority to approve tools and set rules. Without an owner, the policy is not enforced and becomes shelfware.
How does this relate to ISO 42001?
The policy is one of the governance artifacts an ISO 42001 program expects. Writing it to fit a management-system approach makes later certification or alignment easier.
An acceptable use policy is a fast, high-value first step in AI governance. If you want it to hold up and fit a larger program, talk with a senior advisor at JBW Group.