Policy

AI usage policy

A short company policy for what employees may paste, upload, connect, automate, and review when using AI tools.

Copy template Read the usage policy playbook

Use For

Make the template part of an approval workflow.

Copy it into your internal wiki, ticket system, or policy document. Replace bracketed placeholders before sharing it with employees or customers.

Template handling rules

Do not paste real secrets, customer records, or private keys into the template.
Assign an owner and review date before relying on it.
Use the linked guide when the decision needs more context.

Copyable Template

AI usage policy

AI Usage Policy

Owner: [Name]
Applies to: [Team / company]
Last reviewed: [Date]

1. Approved AI tools
- Employees may use only approved company accounts for company work.
- Personal AI accounts may not be used for customer data, source code, financial data, contracts, credentials, or internal strategy.
- New AI tools, browser extensions, agents, and connectors require approval before use.

2. Data that must not be pasted or uploaded
- Passwords, API keys, tokens, private keys, session cookies, or recovery codes.
- Customer personal data, support exports, transcripts, files, or CRM records unless separately approved.
- Production logs, database dumps, payment data, legal documents, or confidential client work.
- Source code from restricted repositories unless the repository has been approved for AI-assisted work.

3. Allowed use
- Drafting internal notes, summaries, checklists, examples, and non-sensitive documentation.
- Explaining public documentation or non-confidential technical concepts.
- Editing approved low-risk text or code with human review.

4. Required review
- AI output must be checked by a human before it is sent to customers, merged into code, published, or used for decisions.
- AI-generated code must pass normal review, tests, CI, and secret scanning.
- Employees are responsible for verifying facts, citations, calculations, and policy statements.

5. Incident rule
- If restricted data is pasted, uploaded, exposed in a prompt, or included in AI output, stop using the workflow and report it to [contact].
- Rotate exposed credentials and remove affected files before reuse.

6. Review cadence
- Review approved tools, admins, connectors, and exceptions every [30/60/90] days.