An AI acceptable use policy your team will follow.
Your people already use AI at work, with or without a policy. We write the rules with you in plain words: which tools, which accounts, what never goes in and who checks the work. Then we train every role on them.
Reviewed by Alvin Chikaeze, Founder Updated
Company work in approved accounts, clear answers about what can go in, and one person who says yes to new tools.
What is an AI acceptable use policy?
An AI acceptable use policy is the short set of rules that tells employees which AI tools they may use for work, in which accounts, what information never goes into them and who checks the work before it leaves the company. A good one fits on a few pages, names your actual tools and approvers, and gives people a fast way to ask for a new tool. FlowChainLabs writes it with your leaders, fits it to the plans you pay for, from Microsoft Copilot and ChatGPT to Claude and Gemini, and trains every role on it with their own work. The outline on this page is the template we start from.
Prefer to look first? Take the free business assessmentAt a glance
- Who it is for
- Companies whose people use AI tools for work, approved or not, and leaders who need the rules settled.
- What you get
- A policy in plain words, an approved tool list with the accounts to use, a way to ask for new tools and training for every role.
- What it covers
- Approved tools and accounts, information that never goes in, checking the work, saying when AI helped, new tools, training and review.
- Tools it covers
- Microsoft Copilot, ChatGPT, Claude, Gemini and any other AI tool your company approves.
- Who owns it
- One named person on your team, with leadership signing it.
- Where we work
- On-site across Dallas-Fort Worth and virtually across the United States.
- How to start
- A free strategy call about the AI tools your people use today.Schedule a strategy call
Should you download an AI policy template, have a lawyer write one or build it with your team?
A template gives you headings, and a lawyer gives you legal language. Neither names your tools, sorts your information or teaches your people the rules. A policy built with your team and trained on its own work is the one people follow.
| Question | A downloaded template | A policy from your lawyer | A policy built with your team and trained |
|---|---|---|---|
| What you get | Headings and sample rules. | Legal language that protects the company. | Plain rules naming your tools, your information and your approvers, taught to every role. |
| Names your tools and accounts | No, you fill them in. | Sometimes. | Yes, plan by plan, with the sign-in each team uses. |
| How people learn it | An email with an attachment. | A signature on a form. | Practice in training, on each role's own work. |
| When a new tool comes out | You edit it yourself. | Another review. | One named owner decides, through a request path people know. |
| Choose it when | You need a first draft today. | You handle regulated data and need legal language. | You want people to follow the rules and use the approved tools. |
Why do employees put company data into AI tools nobody approved?
Because the work is due and nobody gave them a better option or a clear rule. The pattern repeats across companies: a few seats bought for whoever asked first, everyone else on personal accounts, and a policy that amounts to one line about being careful.
- Customer details pasted into a personal account to write an email faster.
- Financial statements uploaded to a free tool for a quick analysis.
- A one-line policy that says what not to do and never what to do instead.
- Requests for a new tool that go to nobody.
- Every AI site blocked, which pushes the work onto personal phones.
What goes in an AI acceptable use policy?
These sections, in this order. Copy the outline, then fill each one with your own tools, information and names.
- Approved tools and accounts: each tool, the plan and the sign-in. Company work happens in company accounts only.
- Information that never goes in: passwords, access keys and anything the law or a client contract keeps out of outside tools.
- Information that needs an approved tool: customer records, employee records, financials and anything marked confidential.
- Information that is fine in approved tools: public information, everyday drafts and internal documents marked for general use.
- Checking the work: a person checks every fact, figure, name and quote against the source before it leaves the company.
- Decisions that stay with a person: pricing, hiring, legal and medical advice, and anything sent to a regulator.
- Saying when AI helped: when to tell a customer or a colleague that AI drafted something.
- New tools and new uses: one person to ask, a short request form, and an answer by a date the policy sets.
- Training: everyone covered by the policy is trained on it, and new hires in their first week.
- Owner and review date: who keeps the policy current and when it is next reviewed.
- When something goes wrong: who to tell, how fast, and what happens next.
How do you write an AI use policy people follow?
Start from what people already do, not from a blank page.
- List the AI tools people use today, approved or not. Ask without blame and people will tell you.
- Pick the approved tools and accounts, so every rule has a yes next to the no.
- Sort your information into three groups: never, approved tools only, and fine in approved tools.
- Write the rules in plain words, short enough to read in one sitting.
- Give people a fast way to ask for a new tool, with one person who decides.
- Train every role on the rules with its own work, then review them when a tool or plan changes.
What should you check 30 days after the policy goes out?
Whether the work moved, not whether people signed. Check these four things.
- Company work in approved accounts, and a list of who still uses a personal one and why.
- Questions about the policy, and the rules that need clearer words.
- Requests for new tools, and how fast each one got an answer.
- Use of the approved tools, against the seats you pay for.
How does the policy connect to training?
A policy nobody practices is a document nobody follows. In every training session, each role works through the rules on its own work: what goes in, what stays out and how to check the answer. That is when the policy becomes a habit.
Connected to the rest
of your business.
Planning a workshop for your team?
Tell us about the team and the work you want to cover. We reply by email within one business day, and you do not need to book a call first.
FlowChainLabs
12222 Merit Drive, Suite 130
Dallas, TX 75251
hello@flowchainlabs.com
Questions before
the next step.
Can we use an AI policy template?
Yes, as a start. A template gives you the headings. The rules have to name your tools, your accounts, your information and your approvers, or people will not know what applies to them. The outline on this page is a good first draft.
What should an AI policy for employees include?
Approved tools and accounts, the information that never goes in, the information that needs an approved tool, how work gets checked, which decisions stay with a person, when to say AI helped, how to ask for a new tool, training, an owner and a review date.
Should we ban AI tools at work?
Ban personal accounts for company work, and give people an approved tool that does the job. Blocking alone pushes the work onto personal phones, where nobody can see it.
Do the AI companies train their models on our data?
On their business plans, Microsoft, OpenAI, Anthropic and Google each say they do not use your company's data to train their models by default. Personal accounts follow different rules, and some use chats for training unless the person turns it off. That is why the first rule is company work in company accounts.
Who should own the AI policy?
One named person, often in operations, IT or HR, with leadership signing it. The owner answers questions, approves new tools and updates the policy when the tools change.
How often should an AI policy be updated?
Whenever a tool, a plan or a vendor's terms change, and at a set review date at least twice a year. AI tools change faster than most policies, so the review date goes on the first page.
Is an AI policy a legal document?
It is a working set of rules for your people. Have your attorney or compliance lead review it, especially if you handle health, financial or client-confidential information. We write it in plain words so people follow it, and fit it to the rules you already have.
Do you run AI risk reviews or governance programs?
No. Formal risk reviews and governance frameworks are work for a governance advisor. We write the day-to-day use policy, train your people on it and build the checks into the work.
How much does an AI acceptable use policy cost?
The policy comes with team training, priced by the number of people and roles. You get a clear proposal after a free strategy call, before anything starts.
How do we get started?
Schedule a strategy call. Bring the list of AI tools your people use today, approved or not, and we will show you what the first version of the policy should say.
Settle the rules before the next paste.
Bring the AI tools your team uses today to a strategy call. We sort what is approved, what never goes in and what to check 30 days after the policy goes out.
