Most employees already use AI at work, and a written policy gives them a clear way to do it well. PwC's 2026 Global Workforce Hopes and Fears Survey, which covered 49,364 workers, found that 64% used AI at work in the past 12 months. Daily use of generative AI rose from 14% to 22% in a year.
An AI acceptable use policy turns that activity into a shared set of rules. It names the approved tools, defines which data may enter them, and says who reviews the output. This post walks through the five sections to start with.
What is an AI acceptable use policy?
An AI acceptable use policy is a document that tells employees how they may use AI tools for company work. It covers the tools they use today, including the assistants built into email, documents, and meeting software. A short policy that people read works best.
Why write one now?
ISACA's May 2026 research, drawn from more than 3,400 digital trust professionals, found that only 38% of organizations have a formal, comprehensive AI policy. A written policy puts your company ahead of most and gives managers a concrete answer when an employee asks, "Can I use this?"
What belongs in the policy?
Goodwin Procter's September 2026 analysis recommends covering permitted and prohibited tools, rules for confidential and personal data, vendor diligence, human review of AI output, and consequences for violations. Here is how those become five sections:
Approved tools. List the AI tools employees may use, the account type for each, and where to request a new tool.
Data rules. Define what may go into an AI tool and what stays out. Customer records, employee information, financial data, and contract terms are common restricted categories.
Vendor terms. Confirm for each approved tool whether the vendor trains on your inputs, how long it keeps them, and where the data is stored. Our vendor questions post lists what to ask before you sign.
Human review. Name who checks AI output before it reaches a customer, a contract, a financial statement, or a regulator.
Consequences and a path for questions. State what happens when the policy is missed, and give employees one place to ask questions or report a concern.
How do you cover tools employees already use?
Start with a no-penalty inventory. Ask each department which AI tools it uses today, then sort the answers into approved, approved with conditions, and under review. Our post on shadow AI describes the no-penalty process that brings these tools into the open before you write a policy. As more tools gain agent features, add the five controls from our post on AI agent access to the policy.
Who owns the policy?
Assign one executive owner and one place to ask questions, and review the policy on a regular schedule because tools and vendor terms change. Goodwin reports that, in Deloitte's 2026 State of AI research, only 21% of organizations have a mature governance model for AI agents. A scheduled review keeps your policy current as agent features arrive.
How do you help employees follow it?
Training makes a policy usable. PwC found that 51% of workers say they have access to the learning resources they need, down from 59% the year before. A walkthrough of the policy with real examples from each department gives your team that access.
At AI Transformation Framework, the Governance and Strategy phase covers an AI governance policy with disclosure standards, data classification, and a shadow IT amnesty. The program also includes a governance toolkit.
Frequently asked questions
-
Any company where employees use AI tools benefits from written guidance, and a short version is a good place to begin.
-
The executive owner drafts it, and legal counsel and your IT lead review it before it goes to employees.
-
Review it on a set schedule, and again whenever you approve a new tool or a vendor changes its terms.
Next step
Ready to put a policy in place? Book a discovery call with AITF.
