Company AI Policy Builder

AI acceptable-use policy — working draft

Status: Draft for stakeholder review.

Scope: Employees and contractors using AI for company work. This template requires tailoring before approval.

1. Purpose and authority

Enable useful AI work while protecting people, company information, customers, systems, and intellectual property. The policy owner is the designated AI governance lead. Legal, privacy, security, HR, procurement, and business owners review topics within their authority. No legal requirement is asserted here; confirm applicable jurisdictions and obligations.

2. Allowed use

Use only tools on the current approved-tool list and only for work within their approved purpose. Public information and low-risk drafting may be used when no confidential, personal, customer, credential, or restricted data is included. Verify factual claims, citations, calculations, and generated code before relying on them.

3. Data rules

Do not assume a vendor's retention, training, access, or deletion terms. Confirm the specific product configuration with procurement, security, and privacy.

4. Uses requiring review

Seek documented approval before using AI for consequential employment, customer eligibility, legal, financial, safety, or other high-impact decisions; processing sensitive data; external commitments; customer-facing recommendations; or autonomous actions that change systems or records. A human owner must review outputs and be able to override them.

5. Restricted and prohibited uses

Restricted: unapproved tools, confidential data in unapproved environments, automated external communication, production changes, and AI-generated claims without verification. Prohibited: entering secrets; bypassing safeguards; impersonation or deception; fabricated evidence; unlawful discrimination; and delegating high-impact decisions without accountable human review. Confirm these choices with company stakeholders.

6. Coding and agents

Use approved coding tools and repositories. Review generated code, dependencies, licenses, tests, and security before merge. Agents must have least privilege, scoped data, logged actions, bounded autonomy, and a human approval step before consequential writes, external messages, purchases, or production changes.

7. Reporting and exceptions

Report suspected disclosure, unsafe output, or unauthorized action promptly through the existing security/privacy incident channel. Document exceptions with business need, data, tool, owner, controls, expiry date, and approver. Reassess expired exceptions.

8. Rollout and open decisions

Name policy owner and approvers; publish the approved-tool inventory and data-classification mapping; provide role-based examples and training; define acknowledgment and incident routes; review at least annually and after material tool, risk, or legal changes. Before approval, resolve jurisdictions, vendor terms, employee consultation duties, retention, enforcement, and the current tool inventory.

This is an illustrative draft, not a company-approved policy or legal opinion.