AI Acceptable Use Policy Template (.docx)
Download the AI Acceptable Use Policy Template (.docx)
Purpose: Give an organization a starting draft of an AI acceptable use policy that it can adapt, approve and publish, built from the AI Policy, Standards and Acceptable Use page and the controls it points to.
Audience: CISOs, AI governance committees, policy owners, legal, HR and compliance.
Before you rely on it: This is a template, not legal advice. Every [highlighted placeholder] is a decision for your organization, such as approved tools, data classes and approvers. Replace each one and have the policy approved by the right owner before you publish it.
What is in the document
| Section | What it holds | Built from |
|---|---|---|
| Front matter | Cover with document control, a how-to-use box and a table of contents | Written for the template |
| 1 to 3. Purpose, scope and definitions | What the policy covers and the terms it uses | AI Policy, Standards and Acceptable Use, AI Security Glossary and Taxonomy |
| 4. Rules for everyone who uses AI | Acceptable use, information you must not put into AI tools, public AI platforms, using AI output, uses that are not allowed, and reporting | AI Policy, Standards and Acceptable Use |
| 5. Rules for developers and builders | AI coding assistants, AI agents, and custom AI applications and models | AI Policy, Standards and Acceptable Use, Control Objectives Library |
| 6. Approval before use | The six review gates an AI tool, application or agent must pass, vendor assessment and privacy impact assessment | AI Governance Operating Model, AI-CTRL-007, AI-CTRL-013, AI-CTRL-014 |
| 7 to 13. Operating the policy | Monitoring and enforcement, roles and responsibilities, exceptions, training, breaches, review and related documents | AI Governance Operating Model, AI Risk Treatment Plan |
| Annexes A to C | A policy-to-control mapping, a quick reference card and a user acknowledgement form | Control Objectives Library |
How to use it
- Decide. Work through the how-to-use box and agree each placeholder with its owner.
- Adapt. Replace every placeholder, delete what does not apply and keep the source notes until review.
- Map. Check Annex A against the controls you have implemented.
- Approve. Have the governing body approve the policy, as the wiki's AI Governance Operating Model asks, and record it in the document control table.
- Publish. Publish the policy with the quick reference card in Annex B, and collect the acknowledgement in Annex C.
- Review. Review it on the cycle set in section 12, and when tools, laws or the controls change.
Licence and credit
The document is licensed under CC BY-SA 4.0, like the rest of the wiki. Suggested credit: "AI Acceptable Use Policy Template" by Nachiket Sathaye and Ankush Jain, AI Security Wiki, licensed under CC BY-SA 4.0. If you share an adapted version, say what you changed and release it under the same licence. Framework names, identifiers and short titles belong to their owners and are cited for mapping only.