How to write a one-page AI use policy (with template)

A practical, plain-language AI acceptable-use policy template covering approved tools, data rules, human review, disclosure and reporting.

By the AiTrain editorial team · Reviewed under our editorial standards

Staff are already using AI, with or without permission. A short, clear policy protects your organisation while letting people get the benefit. Long policies go unread; one page is enough to start.

Key takeaways

• Cover five things: approved tools, data rules, human review, disclosure, and who to contact.
• Write in plain language with examples.
• Pair the policy with an approved tool and short training.
• Review it every quarter while the technology moves quickly.

The template

Copy and adapt. Replace bracketed text.

[Organisation] — AI Use Policy (version [x], [month year])

Purpose. We encourage staff to use AI tools to work more effectively, within the rules below.

1. Approved tools. You may use: [list approved tools and plans]. To request a new tool, contact [role/email alias]. Do not use personal AI accounts for work involving internal information.

2. Data rules. - Allowed in approved tools: internal documents and non-public business information needed for the task. - Never enter in any AI tool (unless a specific approved process exists): [personal data about customers, patients, students or staff; passwords and credentials; payment details; confidential client information covered by contract; legally privileged material]. - When possible, remove names and identifying details.

3. Human review. You are responsible for anything you produce with AI. Check facts, figures, citations and tone before sharing. AI must not make final decisions about people (hiring, performance, eligibility) without human review.

4. Disclosure. Tell [customers/readers/clients] when content is substantially generated by AI where [our standards/regulations] require it, and always when asked.

5. Intellectual property. Do not ask AI to reproduce copyrighted material. Check AI-generated content for similarity to existing work before publishing externally.

6. Security. Be cautious with AI tools connected to email, files or systems. Review any action before it is taken. Report suspicious behaviour to [security contact].

7. Questions and incidents. Contact [role]. Report mistakes quickly — we treat honest reports as learning, not blame.

Making it stick

• Launch with training. Walk through the policy with real examples in under an hour.
• Give an approved option on day one. Policies without a sanctioned tool push usage underground.
• Add a FAQ. Collect real questions in the first month and answer them in writing.
• Name an owner. Someone must review it quarterly.

Regulatory context

Some jurisdictions have specific AI rules. For example, the EU AI Act includes an AI-literacy obligation for providers and deployers of AI systems; see our AI literacy checklist. Sector rules — healthcare, finance, education, public sector — may add requirements.

This template is general information and not legal advice. Have it reviewed by someone qualified for your jurisdiction and sector.