Executive briefing: AI governance
AI Acceptable Use Policy: What the Board Should Sign Off
An AI acceptable use policy tells every employee which AI tools they may use, what data may go into them, when a person must check the output and who to ask. The board signs off the principles and risk appetite. The best policies fit on one page, use a traffic light for data and come with approved tools and training.
Correct as of 28 September 2026. Regulation and guidance change. If you are reading this later, check for updates before relying on it.
Read the full briefingIn brief
- An AI acceptable use policy answers four questions for every employee: which tools, what data, who checks and who to ask.
- The board signs off the principles and the risk appetite. Management owns the detail and keeps it current.
- A traffic-light rule for data (approved, controlled, prohibited) does more work than pages of prose.
- A policy without an approved tool drives use underground. Publish the two together.
- Primary guidance from the NCSC, the ICO and NIST points the same way: protect sensitive data, keep a person accountable and review the policy as the tools change.
Why the board should care
Staff are deciding for you
Without a policy, every employee sets their own rules for what goes into AI tools. The organisation still answers for the result.
Personal data carries legal duties
Where AI processes personal data, UK GDPR applies. The ICO expects accountability, a lawful basis and a data protection impact assessment where the risk is high.
A policy is evidence
When a regulator, auditor, insurer or customer asks how you control AI, a signed-off policy that staff have read is the first thing they want to see.
Full briefing
Read the full briefing
Free for executives. Confirm your work email once and every AIPEX executive briefing opens for 12 months.
- The full written briefing
Next step
Agree the policy with your leadership team
The Executive AI Strategy Day (£1,499 + VAT) agrees the approved tools, the data rules, named owners and the policy position with your leadership team, in one day. Prefer to talk first? A free 30-minute scoping call with a senior partner.
FAQ
Frequently asked questions
What is an AI acceptable use policy?
It is the rulebook for how employees, contractors and suppliers acting for you may use AI at work: which tools are approved, what data may go into them, which outputs a person must check, what is prohibited and who to ask.
What should an AI policy for employees include?
Ten sections: purpose and scope, approved tools, data rules, prohibited uses, human review, transparency, accountability, training, incident reporting and review. The data rules do most of the work and are clearest as a traffic light.
Is there a generative AI policy template we can use?
Templates are a starting point, not a policy. A copied template carries another organisation's risk appetite. Use one to check coverage, then decide your own approved tools, data rules and owners, and have the board sign off the principles.
Do companies need an AI policy?
If staff use AI, yes. Without one, every employee sets their own rules for what data goes into AI tools, and the organisation still answers for the outcome. A policy is also the first evidence of control that auditors, insurers and customers ask for.
Should employees be allowed to use ChatGPT at work?
That is a policy decision. Many organisations approve an enterprise AI tool with contractual protection and access controls, and restrict public tools to non-sensitive information. The NCSC advises against putting sensitive information into queries to public AI tools.
Who should own the AI policy in a company?
The board approves the principles and risk appetite. An executive AI lead owns the policy day to day, with legal, data protection, security and HR contributing. Each approved AI use should have a named owner who answers for it.
How often should an AI acceptable use policy be reviewed?
At least once a year, and early when something changes: a new tool or AI feature, a new use of personal data, a change in regulation or guidance, or an incident. NIST recommends updating generative AI acceptable use policies as technologies and third parties change.
Does the AI policy need to cover AI literacy and training?
Yes. A policy nobody has read is not a control. Record who has been trained and when. For organisations in scope of the EU AI Act, AI literacy duties have applied since 2 February 2025.
Correct as of 28 September 2026. This content reflects the law, official guidance and deadlines as published on that date. The EU AI Act and its guidance, standards and deadlines are still being amended and clarified. If you are reading this after 28 September 2026, check for later amendments, European Commission guidance and harmonised standards before relying on it. It is general information, not legal advice, and AIPEX accepts no liability for decisions taken on it without specific professional advice.
This briefing is general information on AI acceptable use policies. It is governance guidance, not legal advice. AIPEX is not a certification body. For decisions about specific AI systems, personal data or employment terms, take advice from qualified advisers.