Free template
AI acceptable use policy template.
A free, plain-language AI policy template for small to large companies: which tools staff can use, what data can go in, who checks the output, and the hiring rules in Ontario and New York City. Copy it below or download it as a Word file.
Updated November 2, 2026 · By Jason, Founder, CGX · General information, not legal advice
How to use it
From template to your policy in an afternoon.
- List your approved tools. Fill in the table in section 3 with the AI tools and plans your company actually pays for.
- Replace everything in [brackets]. Names, contacts, approvers and review dates.
- Delete what doesn't apply. The Ontario and New York City hiring lines in section 7 only matter if you hire there.
- Get it reviewed. Have your legal or HR adviser check it against your contracts and the laws where you operate.
- Train people on it. A policy nobody has read doesn't change behaviour. Walk each team through it, with examples from their own work.
The template
AI acceptable use policy.
[Company name] AI acceptable use policy
1. Purpose
This policy explains how people at [Company name] may use artificial intelligence (AI) tools at work, so we get the benefits of AI while protecting our clients, our people and our information.
2. Who and what it covers
This policy applies to all employees, contractors and temporary staff who do work for [Company name].
It covers any AI tool used for company work, including stand-alone assistants such as ChatGPT, Claude, Microsoft Copilot and Gemini, AI features built into software we already use, browser extensions, and AI agents.
3. Approved tools
Only use the AI tools listed below for company work, signed in with your company account. Don't use personal or free accounts for company work.
| Tool and plan | Who can use it | Approved uses |
|---|---|---|
| [e.g. Microsoft 365 Copilot] | [e.g. all staff] | [e.g. email, documents, meetings, spreadsheets] |
| [e.g. ChatGPT Business] | [e.g. marketing and sales] | [e.g. drafting, research, analysis] |
| [Add a row per tool] |
4. What you can put into AI tools
- Never enter: passwords, API keys or other credentials; payment card or bank details; government ID numbers; health information; [client] personal information unless the tool is approved for it; anything covered by a confidentiality agreement unless [approver] has approved it.
- Only in approved business tools: internal documents, non-public company information and client work that doesn't contain the items above.
- Fine in any approved tool: public information, and your own drafts and notes that don't contain personal or confidential information.
- If you're not sure, ask [contact] before you paste.
5. Check everything before it's used
- A person must review AI output before it goes to a client, is published, or is used to make a decision.
- Check facts, numbers, names, quotes, links and sources. AI tools can state wrong information with confidence.
- You're responsible for work you produce with AI, the same as any other work.
6. Being open about AI use
- Tell [clients / your manager] when AI produced a significant part of a deliverable, where a contract, law or the client requires it.
- Label AI-generated images and media where the law, an industry regulator or a platform requires it, for example in advertising.
- Don't use AI to impersonate a real person or to create misleading content.
7. Hiring and decisions about people
- Get approval from [HR / legal] before using any AI tool to screen, assess or select job applicants, or to make decisions about employees.
- A person makes the final decision on hiring, promotion, discipline and pay. AI can assist but not decide.
- [Ontario employers with 25 or more employees: state in publicly advertised job postings whether AI is used to screen, assess or select applicants.]
- [New York City employers using automated employment decision tools: complete the required bias audit, publish the summary and notify candidates under Local Law 144.]
8. Intellectual property and confidentiality
- Don't upload content you don't have the right to use, such as third-party documents under licence or client material you aren't permitted to share.
- Check AI-generated content for material that closely copies someone else's work before you use it.
- Follow [Company name]'s confidentiality obligations to clients in every AI tool.
9. Security
- Don't connect AI tools, plugins, extensions or agents to company email, files or systems without approval from [IT contact].
- Report any AI-related mistake, data exposure or suspicious behaviour to [contact] right away.
10. Asking for a new tool
To request a new AI tool or a new use, send [contact] the tool name, plan, what you want to use it for and what data it would touch. [Approver] decides within [number] business days.
11. Training
Everyone completes [Company name]'s AI training before getting access to approved AI tools, and a refresher [every year].
12. Breaking this policy
Breaking this policy may lead to loss of access to AI tools and other action under [Company name]'s policies.
13. Review
[Policy owner] reviews this policy every [six] months, and whenever we add a major tool or the law changes.
Acknowledgment
I have read and understand this policy.
Name: ____________________ Signature: ____________________ Date: ____________
Questions
AI policies, answered.
What should an AI policy include?
At minimum: which AI tools are approved, what information must never go into them, who reviews AI output before it's used, when to disclose AI use, rules for hiring and decisions about people, security rules for connecting tools to company data, how to request a new tool, and when the policy is reviewed.
Does a small business need an AI policy?
We recommend one for any company whose staff use AI tools at work. Without one, people often use free personal accounts and paste in client or company information without knowing whether they should.
Is this template legal advice?
No. It's general information to help you start. Have your legal or HR adviser review your final policy against your contracts and the laws where you operate.
Do Ontario or New York employers have AI hiring rules?
Yes. Since January 1, 2026, Ontario employers with 25 or more employees must state in publicly advertised job postings whether they use AI to screen, assess or select applicants. New York City's Local Law 144 requires employers using automated employment decision tools to complete a bias audit, publish a summary and notify candidates.
How often should we update our AI policy?
The template suggests every six months, and whenever you add a major AI tool or the law changes. AI tools and their terms change quickly.
Can CGX write our AI policy for us?
The AI Readiness Assessment checks what your policy needs to cover, and the AI Onboarding Sprint includes an AI policy tailored to how your company works, plus training on it. Have your legal adviser review the final version.
Want the policy, the tools and the training done for you?
The AI Readiness Assessment includes a data, security and policy check, and the AI Onboarding Sprint sets everything up and trains your team.