When someone is asked to write "the AI policy", the first search turns up two kinds of document under almost the same name. One is long, written for leadership and assessors, and full of ownership and review. The other is a page or two telling people what they may and may not do. Both are needed because they do different jobs, and most of the trouble with AI policies comes from trying to make one document do both.
Two documents, two readers
The AI policy is the business's position, with eight sections set out in what an AI policy should contain, and the acceptable use policy is the version for the person at the keyboard. Because the second is written from the decisions in the first, the two differ in what they hold, who reads them and how you test them.
| AI policy | Acceptable use policy | |
|---|---|---|
| What it holds | What has been decided and who decided it; what may happen to each category of data; the approved tools and how a new one gets approved; where a person reviews the output; what gets recorded; who owns the policy and when it is next reviewed | What one person may do on an ordinary Tuesday, in language they can act on without asking anyone |
| Who reads it | Your leadership, a client sending an assurance questionnaire, an insurer and an assessor | Everyone who touches your information, including contractors and, for a charity, volunteers |
| The test | Can it answer an assessor's question with a document? | Can someone about to paste a client contract into a chat window tell from it in under a minute whether they may? |
Do you need both?
For a business of 50 to 500 people, usually yes, though not as two large documents. The common shape is one AI policy, owned by leadership, with a one-page acceptable use section that everyone reads and acknowledges. If you already have an IT acceptable use policy, the AI rules can sit in it as a section, provided the two say the same thing about accounts and data.
What does not work is the acceptable use page on its own. Without the decisions behind it, it fills with phrases such as "use AI responsibly" and "only use approved tools", and nobody can say which tools are approved or what responsible means for a client contract.
What the page your people follow contains
Seven things, each in a sentence or two:
- Which AI tools you may use for work, and on which accounts, with a link to the current list.
- What never goes into any of them, as a short named list.
- What needs a person to read it before it leaves the business.
- That personal accounts are not for work, and how to move existing work onto a company account.
- What to do if something goes wrong, or if a tool shows you something you should not be able to see.
- Who to ask when the page does not answer the question.
- A dated line the person signs to say they have read it.
Some example lines show the register it is written in. The decisions in them are examples and yours will differ:
- "You may use Copilot and Claude on your company account. You may not use any AI tool on a personal account for work."
- "Never put client documents, personal information about a named person, passwords or unpublished financial figures into any AI tool."
- "If an AI tool shows you a file you should not have access to, tell IT the same day. You will not be in trouble for reporting it."
The mistakes that push use out of sight
Only saying no
If the page says only what people may not do, the cautious stop using AI and the confident carry on where you cannot see them. Every acceptable use page needs at least one clear yes.
Writing for a lawyer
Because the person reading it is deciding in the moment whether to paste something, each rule has to make sense on the first reading and be written in the words that person would choose.
Treating past use as a breach
Most people started using AI before there were any rules, so the page should give them a route onto company accounts rather than a reason to hide what they have been doing.
Leaving people out
Contractors, temporary workers and volunteers handle the same information, and they are often the furthest from your systems.
Writing it once
The list of approved tools changes every few months. Link to it rather than copying it into the page, so the page stays true when the list changes, and review both on the date the AI policy sets.
Where this fits
Both documents come out of the same half-day with your leadership in Govern: the decisions go into the AI policy, and the acceptable use page is written from them in the same sitting.
If you hold ISO 27001, the page is also how you meet its acceptable use control for AI, as set out in what ISO 27001 expects once AI is in use. If you would rather have the whole thing written with you, the AI policy page explains how that works.