| An AI acceptable use policy sets staff and contractor rules for AI at work: approved tools and accounts, permitted tasks and information, output checks, approvals and reporting mistakes. A named owner keeps it current. |
Staff can reach a chatbot, a meeting assistant or an AI feature in their usual software in seconds. Without an AI acceptable use policy, each person decides for themselves which tool to use, what information to put into it and whether the result is ready to send.
This guide sets out what an AI acceptable use policy should cover, gives a starting framework and example wording you can adapt, and explains how to approve and roll out the rules. It is written for owners and managers, not for lawyers or IT specialists.
What should an AI acceptable use policy cover?
An AI acceptable use policy covers who the rules apply to, which tools and accounts are approved, what work and information each use allows, how outputs are checked, how staff ask for something new and what to do when a mistake happens. A named owner, an approval date and a review date keep it current.
It sits alongside your existing IT, privacy and confidentiality rules rather than replacing them. Older policies on devices and internet use say little about where prompts go, whether a provider keeps them, or who checks a draft before it reaches a client. The AI policy answers those questions for staff in plain language.
Clear rules help people use AI consistently instead of guessing. A sensible first step is to find out which tools and tasks are already in use, then give staff approved options, examples and a route for questions. Our guide to shadow IT explains how unapproved tools build up when that route is missing.
Overview of core AI acceptable use policy sections. Checking outputs, incident reporting and review also need rules.
A starting framework for your business
Use this AI acceptable use policy framework as a checklist of decisions to make and record. Adapt it to your tools, roles and obligations rather than copying a template unchanged.
| Policy section | What to decide and record |
|---|---|
| Scope and ownership | Who the policy covers, including managers and contractors; the policy owner, approval date and review date. |
| Tools and permitted work | The exact tools and work accounts, approved tasks, connected features and actions staff may use. |
| Information rules | Permitted data for each use, what needs explicit approval, and information prohibited in general-purpose AI chats. |
| Output and decisions | What must be checked, who checks it, and which decisions or actions need a separately approved process. |
| Approvals and exceptions | The named contact, request route and information needed before another tool or use can begin. |
| Mistakes and incidents | Who to notify promptly, what facts to record and which existing response process applies. |
| Rollout and review | Staff explanation, training, fair handling of breaches, scheduled review and triggers for earlier updates. |
Keep the staff rules short and put the detail, such as the list of approved tools, accounts, tasks and data, in a separate register that staff can find easily.
Example policy wording you can adapt
These clauses show the tone that works for staff: short, specific and tied to your register. Replace the bracketed roles with real names or positions.
Tools and data. “Use only the tools and work accounts in our approved register, for the tasks and data recorded there. Ask [policy owner] before using another tool, account, connection or action. Keep passwords, recovery codes and keys out of general-purpose AI chats.”
Checking and reporting. “Check facts, figures, sources and confidential information before sending or acting on AI output. You remain responsible for the work. Report accidental uploads, unexpected sharing or actions, and material errors promptly to [reporting contact]. Record the tool, account, time and information involved. Deleting a chat does not necessarily resolve the incident.”
Use examples from real roles in your business, with fictional information for training material.
Rules for approved tools and data
An AI acceptable use policy should approve a use, not a brand or a price tier. Each entry in the register should name the product, plan and work account, the permitted tasks and information, and the settings and connected features that apply.
Why is a paid business account not enough?
A business plan can offer better controls than a free consumer account, but it does not make every document safe to share. Whether a provider uses prompts for training, where it stores them, who can access them and when they are deleted are separate questions. Our AI data security guide explains how to check those points before approving a tool.
Which information needs explicit approval?
Client files, personal information, payroll, health records and confidential contracts need explicit approval for the specific information and task, after the relevant checks. A manager saying yes or a paid account is not enough if the use, the provider terms and your obligations have not been assessed. Removing names does not necessarily prevent someone being identified.
A traffic-light scheme can help staff remember the rules: permitted use, explicit approval needed and prohibited use. Treat those categories as business policy choices, not legal classifications or promises of safety.
Example categories. Your business decides what sits in each column, and an approved tool does not approve every task.
What about AI inside software you already use?
Your AI acceptable use policy should also cover AI features built into existing software, meeting tools, browser extensions and connected assistants. Approval of one chatbot does not authorise another account, plug-in, file connection or automated action.
Checking outputs and reporting mistakes
Under an AI acceptable use policy, staff should check sources, figures, confidential details and suitability before sending AI output or acting on it. The person using the tool remains responsible for the work, so the policy should say what checking means for common tasks.
Identify higher-impact decisions, such as those affecting customers, staff, money or legal positions, that need a separately approved process and an accountable person rather than an AI answer alone.
Give staff a clear route to report accidental uploads, incorrect outputs or unexpected actions, and say which existing incident process applies. Early reporting gives the business time to respond, so encourage it rather than relying on consequences alone.
How do you approve and roll out the policy?
Leadership approves the AI acceptable use policy and remains accountable for it. Name a policy owner who coordinates approvals, questions and review, with IT, privacy or other specialist input where needed.
Explain the reasoning when the policy is introduced, then practise common decisions with real examples. A signed acknowledgement alone does not show that people can apply the rules. Our AI training gives staff practice inside the tools, accounts and data rules you have approved.
Restrictions can be appropriate for particular tools, information or tasks. Where something is prohibited, tell staff how to request approval and whether an approved alternative exists. Handle breaches fairly and consistently.
Set a review date. Twice-yearly review can be a starting schedule, and changes to tools, provider terms, connected features, use cases or obligations, or an incident, should prompt an earlier update. Check insurance and client contract requirements against the actual documents rather than assuming what they expect.
How does the Privacy Act apply to AI use?
The Privacy Act applies when your business handles personal information using AI. Assess the purpose, safeguards and provider arrangements before approving that use. Whether it is an overseas disclosure depends on how the provider handles the information.
The Privacy Commissioner recommends a privacy impact assessment before using AI tools with personal information, updated as the use changes. A written AI acceptable use policy helps staff follow the approved arrangements; it does not replace the assessment. Our NZ Privacy Act compliance checklist covers the wider setup.
MBIE also publishes responsible AI guidance for businesses, which is useful background when deciding which uses to approve.
Help putting the rules into practice
Exodesk drafts AI acceptable use policy wording and the approved-tool register with you as part of our AI Solutions work, alongside tool assessment, access settings and staff rollout within the agreed scope. Your business approves its permitted uses and data rules, and specialist privacy or employment input may be needed for parts of the policy.
Choosing which uses are worth pursuing is covered in our AI adoption guide. Deciding which bots may read your public website is a separate question, covered in our guide to AI crawlers.
Exodesk has supported New Zealand businesses since 1989. Today, our Christchurch and Dunedin teams support businesses nationwide.
NEXT STEP
Need help putting your AI rules into practice?
Exodesk AI Solutions covers agreed work on policy wording, tools, access boundaries and staff rollout, with your leadership approving the rules.
See our AI training for practice inside the rules.
Frequently Asked Questions
What is an AI acceptable use policy?
It sets staff and contractor rules for AI at work: approved tools and accounts, permitted tasks and information, output checking, approvals and reporting mistakes. A named owner keeps it current.
Why does my business need an AI usage policy?
Clear rules help people use AI consistently and avoid guessing about work information. Start by checking which tools and tasks are already in use, then give staff approved options, examples and a route for questions.
What should an AI acceptable use policy include?
Cover scope and ownership, approved tools and work, information rules, output checks and decision limits, approvals, incident reporting, and rollout and review. Record the decisions for your business rather than copying a template unchanged.
Does the Privacy Act apply when staff use AI tools?
Yes, when personal information is handled. Your business must assess the use, safeguards and provider arrangements. Overseas disclosure rules depend on the circumstances. A policy helps implement those decisions but does not by itself establish compliance.
Can I ban AI instead of writing a policy?
Restrictions can be appropriate for particular tools, information or tasks. Explain what is prohibited, how staff request approval and whether approved alternatives exist. A clear policy also tells staff and contractors how those restrictions apply.
How long does an AI acceptable use policy need to be?
Keep the staff rules short and readable, with detail in an approved-tool register or supporting procedures. Length depends on the business and its uses. A one-to-three-page summary can be useful, but page count is not the measure of an adequate policy.
What data should staff keep out of AI tools?
Keep passwords, recovery codes and keys out of general-purpose AI chats. Client files, payroll, health records and confidential contracts need explicit approval for the information and task, after the relevant checks. A paid account alone does not provide that approval.
Who should own the AI policy inside a business?
Name a business owner who can coordinate approvals, questions and review. Leadership approves the rules, with IT, privacy or other specialist input where needed. The IT provider supports the agreed work rather than taking ownership of every business decision.
How often should the policy be reviewed?
Set a review date and revisit it sooner when tools, provider terms, connected features, use cases or obligations change, or after an incident. Twice-yearly review can be a starting schedule, rather than a universal requirement.
Can a managed IT provider help create the policy?
Yes. Exodesk can draft the policy wording and approved-tool register with you, and help with tool assessment, access settings and staff rollout within the agreed AI Solutions scope. Your business approves its permitted uses and data rules. Specialist privacy or employment input may be needed for those parts of the policy.
Contact us or call 0800 396 337 to talk about your AI rules.
