AI acceptable use rules for day-to-day decisions
An AI acceptable use policy is a concise operational document: it tells people what they may do, what conditions apply, what is prohibited, and where to ask or report. A broader AI governance policy also assigns procurement, risk, monitoring, training, incident, and revision responsibilities.
- Updated:
Acceptable-use example
Use AI only for authorized work and through tools approved for the intended activity and information. Approval of a product does not permit every feature, plug-in, model, input, or output.
Do not enter passwords, access tokens, confidential material, personal records, customer or student information, protected health or financial information, nonpublic source code, or unpublished third-party work unless the tool and use have explicit approval for that data.
Review output before relying on it. Check important facts, sources, calculations, code, security, bias, rights, accessibility, and suitability. A person remains accountable for decisions and communications; AI must not make an unauthorized consequential decision.
Do not use AI to deceive, impersonate, harass, bypass controls, create unlawful material, conceal a conflict, or misrepresent authorship or review. Follow applicable disclosure rules. Stop and report suspected exposure, unsafe behavior, or material error through the designated route.
Approved-use matrix
A short policy works best with a matrix people can scan. Replace these illustrative rows with approved organizational decisions.
- Public-information brainstorming — Allowed; approved account, human review.
- Internal non-confidential summary — Conditional; owner permission, approved tool, verify against source.
- Personal, customer, student, or confidential data — Approval required; documented privacy, security, contractual, and purpose review.
- Credentials, security secrets, or deliberate safeguard bypass — Prohibited.
- External publication — Conditional; factual, rights, brand, and disclosure review.
- High-impact recommendation — Approval required; expert assessment and meaningful human decision authority.
Acceptable use versus governance
Acceptable use answers “What may I do today?” Governance answers “Who selects tools, owns risk, approves exceptions, responds to incidents, monitors performance, trains users, and changes the rules?” Many organizations need both: a short front-line standard linked to a controlled governance policy.
Use the generator to assign responsibilities and add audience-specific sections. Workplace teams should also review Workplace AI Policy; educators should review the school and university templates.
Write your policy
Set rules by data, action, and consequence
Classify by data, action, and consequence. A summarization feature may be low risk for public text but unacceptable for privileged advice. A drafting tool may be useful internally but require extra review before publication. Approval should therefore state the intended use, data class, users, controls, and expiry or review trigger.
This template is not legal advice or an expert-reviewed policy. The cited NIST and ISO sources provide governance references; they do not certify the resulting policy.
Example wording
Approval record example
Frequently asked questions
What is the difference between an AI policy and acceptable use policy?
Acceptable use focuses on user behavior. A broader AI policy adds decision rights and management processes such as acquisition, risk assessment, monitoring, incidents, training, exceptions, and revisions.
Is an approved tool safe for all information?
No. Approval must account for the specific feature, account, data class, purpose, and controls. A service approved for public brainstorming may not be approved for customer records.
What should happen when someone enters sensitive data?
Stop further use, preserve necessary context securely, and report promptly through the incident route. The responsible team should assess containment, provider action, notification, and follow-up under existing plans.
Should prohibited uses include examples?
Yes. Concrete examples make rules more usable, but include a question and approval route because no list anticipates every feature or use.
Sources and references
These drafts have not been reviewed by a lawyer or subject-matter expert. Have your legal or policy team review them before use. They are not legal advice or proof of compliance.
NIST describes its AI Risk Management Framework as voluntary guidance for managing AI-related risks and incorporating trustworthiness into AI use.
Use it as a review reference when assigning owners and considering risks, safeguards, and ongoing oversight. This generator does not perform a NIST assessment.
UNESCO’s guidance emphasizes a human-centred approach, data privacy, and age-appropriate use of generative AI in education and research.
For school, university, and classroom policies, review student data, age restrictions, access, and the learning purpose of each permitted activity with the appropriate institutional owners.
Pangram’s classroom-policy article compares blanket restrictions with a tier-based approach that allows different levels of AI assistance for different assignments.
Use the examples to discuss classroom boundaries, then choose your own permissions in the generator. These approaches are options, not a requirement to adopt a particular rule.
Public reference selected for the ai acceptable use rules for day-to-day decisions page.
Read the original source in its own context. It does not replace qualified local review or establish that this draft is compliant.
Public reference selected for the ai acceptable use rules for day-to-day decisions page.
Read the original source in its own context. It does not replace qualified local review or establish that this draft is compliant.
References do not imply endorsement.