What is an AI acceptable use policy and what should it cover?
Short answer
An AI acceptable use policy tells staff which AI tools they may use, for what, and with which data. It should cover approved tools, prohibited data, human review of AI output, disclosure to customers where relevant, who approves new tools, and how to report problems.
The details
Keep it short enough that people read it, and pair it with a list of approved tools. Frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 can guide a fuller AI governance program as use grows.
What to do
- List approved tools and the accounts to use.
- Define data that must never be entered.
- Require human review before AI output reaches customers.
- Name who approves new AI tools.
- Review the policy at least once a year.
Terms explained
- NIST AI RMF
- The NIST AI Risk Management Framework is voluntary guidance for managing AI risks, organized into four functions: Govern, Map, Measure and Manage.
- Shadow AI
- Shadow AI is the use of AI tools inside an organization without approval or oversight from IT, security or compliance.
- ISO/IEC 42001
- ISO/IEC 42001 is the international standard that specifies requirements for an artificial intelligence management system (AIMS).
Sources
Related questions
Related Guides
GuideGRC
How to Write an AI Acceptable Use Policy for Your Team
Learn how to write an AI acceptable use policy for your team. Define approved tools, data classification boundaries, human review, and compliance steps.
Read more GuideAI Security
AI Agent Security: Implementing Least Privilege for Tools
Learn how to enforce least privilege for AI agent security. Control tool calling, scope data access, and prevent unauthorized actions in production.
Read more GuideAI Security
How to Conduct LLM Security Testing for Web Applications
Learn how to perform LLM security testing to identify prompt injection, sensitive data leakage, and insecure output handling before production deployment.
Read more GuideAI Security
10 LLM Security Risks Every Team Should Understand
Examine the top 10 LLM security risks affecting modern applications and learn concrete defensive controls to safeguard your data, models, and infrastructure.
Read more