AI Policy Template (2026): A Copy-Ready AI Acceptable Use Policy for Companies

TL;DR

• An AI policy template gives you a ready structure for the rules on how staff and software may use AI at work. Below is a complete AI acceptable use policy in 13 numbered sections you can paste, edit and publish this week.
• Keep it short and specific. Name the approved tools, say which data classes each may receive, list what is prohibited, and say who reviews AI output before it leaves the company.
• Write a section for AI agents. Agents act, so the policy must say what they may access, which actions need a named approver, and what gets logged.
• Sentra is the governed organization memory that makes the agent rules enforceable: agents see only what the person they act for can see, and a named person approves anything before it is sent.

What is an AI acceptable use policy?

An AI acceptable use policy is a company document that sets which AI tools employees may use, what data they may put into them, what uses are prohibited, and who checks AI output before it is relied on. An AI policy template is a pre-written version of that document you adapt to your company instead of drafting from a blank page.

Most companies need one now because staff are already using AI, with or without rules. Microsoft's 2024 Work Trend Index, a survey of 31,000 knowledge workers in 31 markets, found 75% used generative AI at work and 78% of those users brought their own tools. Only 39% of people using AI at work had received AI training from their company.

The gap shows up in breaches. IBM's Cost of a Data Breach Report 2025 found one in five organizations reported a breach due to shadow AI, and only 37% had policies to manage AI or detect shadow AI.

AI policy vs corporate AI policy vs generative AI policy

The terms overlap. Use whichever your legal team prefers, but know what each usually covers.

Most mid-sized companies do well with one AI usage policy that employees read, backed by a governance framework that the risk owners run. Our AI governance framework covers the second document.

Before you paste the template: five decisions

Make these decisions first. The template has a placeholder for each.

1. Approved tools. Which enterprise AI tools are licensed, and under which contract terms. Prefer tiers where the vendor contract excludes training on your inputs.

2. Data classes. Most companies use four: Public, Internal, Confidential, Restricted. Map each class to the tools allowed to receive it.

3. Prohibited uses. Start with the EU AI Act's prohibited practices if you operate in the EU, then add company-specific bans.

4. Agent rules. Which actions agents may take alone and which need a human approver.

5. Owner. One named person who approves exceptions and maintains the policy.

The AI acceptable use policy template

Copy everything from Section 1 to Section 13. Replace bracketed text. Keep the numbering so staff can cite clauses.

Section 1. Purpose

1. This policy sets the rules for using artificial intelligence (AI) tools and AI agents at [Company].

2. Its aims are to let employees use AI productively while protecting company, customer and employee data, meeting legal obligations, and keeping a human accountable for every decision.

Section 2. Scope

1. This policy applies to all employees, contractors, interns and temporary staff, on any device, when doing [Company] work.

2. It covers standalone AI tools (chat assistants, coding assistants, image and audio tools), AI features inside other software, AI agents, and any model accessed by API.

3. It applies whether the tool is paid for by [Company], free, or paid for personally.

Section 3. Definitions

1. AI tool: software that generates text, code, images, audio, analysis or decisions using machine learning.

2. AI agent: an AI tool that can take actions in other systems, such as sending messages, editing records or running code.

3. Approved tool: an AI tool listed in the AI Tool Register maintained by [Policy Owner].

4. Output: anything an AI tool produces.

Section 4. Approved tools

1. Employees may use only the approved tools listed in the AI Tool Register for [Company] work: [Tool A, enterprise tier], [Tool B, enterprise tier], [Tool C].

2. Employees must sign in with their [Company] account, not a personal account.

3. A tool not on the register may not receive any data above Public (Section 5).

4. To request a new tool, follow Section 9.

Section 5. Data classification rules

1. Public data (published website content, press releases) may be used in any approved tool.

2. Internal data (internal process docs, non-sensitive project notes) may be used only in approved tools.

3. Confidential data (customer data, contracts, financials, source code, unreleased product plans) may be used only in tools marked "Confidential approved" in the register.

4. Restricted data (credentials, payment card data, health data, government IDs, special category personal data, legally privileged material) must not be entered into any AI tool unless [Policy Owner] and [Legal] approve a specific use in writing.

5. Never paste passwords, API keys or access tokens into any AI tool.

6. When in doubt, treat data as the higher class.

Section 6. Prohibited uses

Employees must not use AI to:

1. Make or materially inform decisions about hiring, firing, promotion, pay, credit or access to services without the review process in Section 7 and approval from [HR or Legal].

2. Infer the emotions of employees or candidates in the workplace (except for approved medical or safety reasons), or categorize people by sensitive traits such as race, religion or sexual orientation from biometric data.

3. Create deceptive content, including impersonating a real person, or generate content that is unlawful, harassing or discriminatory.

4. Generate sexual content involving real people without consent, or any content sexualizing minors.

5. Bypass security controls, access data they are not authorized to see, or connect an AI tool to a system using someone else's credentials.

6. Present AI output as human-reviewed professional advice (legal, medical, financial, tax) without review by a qualified person.

7. Upload third-party content in breach of its license or confidentiality terms.

Section 7. Human review of AI output

1. The employee who uses AI output is accountable for it as if they wrote it.

2. Check facts, figures, citations and code before relying on them. AI tools can produce confident, wrong answers.

3. Output that goes to a customer, regulator, investor or the public must be reviewed by a person before it is sent.

4. Disclose AI use where a law, contract or customer requires it, and in [list contexts, e.g. published research, legal filings].

Section 8. AI agents and automation

1. Agents may be deployed only after [Policy Owner] approves an entry in the AI Tool Register stating the agent's owner, purpose, data access and permitted actions.

2. An agent may access only data that the person it acts for is already permitted to access in the source system. Shared or administrator service accounts must not be used to give an agent broader access.

3. Agents may read, summarize and draft without approval. Actions that send external communications, change customer or financial records, move money, change permissions or delete data require approval by a named person before execution.

4. Every agent action must be logged with the time, the person it acted for, the data it used and the approver, and logs kept for at least [six months / your retention period].

5. The agent owner must be able to pause the agent immediately.

Section 9. Vendor approval

1. New AI tools and AI features in existing software require review by [Security], [Legal] and [Policy Owner] before use with Internal data or above.

2. The review covers whether the vendor trains on our data, data retention and location, certifications (for example SOC 2, ISO 27001, ISO/IEC 42001), sub-processors, permission handling, and exit terms.

3. Approved tools are re-reviewed every [12] months and after any major change to the vendor's model or terms.

Section 10. Training

1. All staff in scope complete AI training within [30] days of joining and every [12] months.

2. Staff who build or approve agents, or who use AI in high-impact decisions, complete additional training.

3. [Policy Owner] keeps training records.

Section 11. Incidents

1. Report immediately to [security@company] if you entered data into a tool against Section 5, if an AI tool or agent produced harmful output that was sent, or if an agent took an action it should not have.

2. Reporting promptly will not by itself lead to disciplinary action.

3. [Security] triages the incident, pauses the tool or agent where needed, and records it in the incident log.

Section 12. Enforcement

1. Breaches of this policy may lead to loss of tool access and disciplinary action up to and including termination, in line with [HR policy].

2. Exceptions require written approval from [Policy Owner], are time-limited, and are recorded in the AI Tool Register.

Section 13. Review cadence

1. [Policy Owner] reviews this policy every [6] months, and sooner after a material incident, a new regulation or a new class of AI tool.

2. Version: [1.0]. Effective date: [date]. Approved by: [name, title].

How to roll the policy out

A policy nobody reads changes nothing. Ship it with three things.

• A sanctioned option that is good enough. People use shadow AI because it helps them. Give them an approved tool that does the job, or the policy will be ignored.
• A one-page summary. Lead with the data table and the prohibited list. Link the full policy.
• A discovery pass. Before enforcement, list what is already in use. MIT NANDA's State of AI in Business 2025 found workers at over 90% of surveyed companies used personal AI tools for work, while only 40% of companies had bought an official LLM subscription.

KPMG and the University of Melbourne's 2025 global study of more than 48,000 people found 66% of employees rely on AI output without evaluating its accuracy, and 56% have made mistakes in their work because of AI. Section 7 exists for that reason. Train it with examples from your own teams.

Where Sentra fits

Sentra is not a policy tool. It is the governed organization memory under your approved assistants and agents, and it makes Sections 5, 7 and 8 enforceable rather than aspirational.

Section 8.2 says an agent may see only what the person it acts for can see. Sentra does this by design: answers and actions respect each source's existing permissions, checked at query time against synced access lists, and a failed check counts as no access. Section 8.3 says external actions need a named approver. A named person approves anything Sentra raises or sends before it reaches anyone else.

Section 7 asks staff to check facts. Sentra knows when a fact became true and when it stopped being true, and cites the source, so an assistant drafting a customer reply uses the current price or policy, not the one replaced last quarter. Sentra connects email, chat, meetings, documents, ERP, CRM, HRIS and BI, and serves the same memory to ChatGPT, Claude, Copilot, Gemini and internal agents through REST and MCP. It holds SOC 2 Type II and ISO 27001 and deploys in the cloud, an isolated VPC or air-gapped on premises, which helps it pass the review in Section 9.

To see how it supports your AI policy, book a demo.

How to choose what goes in your version

• Small company, no agents yet: Use Sections 1 to 7 and 11 to 13. Add Section 8 when the first agent is approved.
• Regulated industry: Keep every section. Tighten Section 5 to name your regulated data types, and have Legal map Section 6 to your obligations.
• EU operations: Align Section 6 with the AI Act's prohibited practices and Section 10 with the AI literacy duty that has applied since 2 February 2025, per the European Commission.
• Heavy agent use: Expand Section 8 with action tiers per agent. See AI agent permissions.

FAQ