# 01. AI acceptable use policy

> **Template.** Part of the open-source [AI App Policy Kit](https://www.puglieseweb.com/ai-policy-kit), version 1.0. Replace everything in [square brackets], delete what does not apply, and have the person who runs the business approve it. A starting point, not legal advice.

| | |
|---|---|
| **Business** | [Business name] |
| **Document owner** | [Name and role] |
| **Approved by, and date** | [Name], [date] |
| **Next review** | [Date, at most 12 months on] |

## Why this matters

Staff already use AI tools, with or without a rule. Without one, customer details get pasted into tools that keep them, and AI answers get sent to customers unchecked. This policy says which tools may be used, what may go into them, and who answers for what comes out.

## Who it covers

Everyone who works for [Business name]: employees, contractors and agency staff, on any device used for our work.

## The rules

1. **Use approved tools only.** The approved AI tools are listed below. To add one, ask [policy owner]. A tool is approved only after the supplier check in document 08.
2. **Use a work account.** Sign in with your [Business name] account, never a personal one, so the business controls the data and can remove access when someone leaves.
3. **Keep these out of any AI tool that is not approved for them:**
   - personal data about customers, staff or anyone else (names with contact details, health, money, identity documents);
   - passwords, API keys and access tokens;
   - contracts, pricing and anything a customer gave us in confidence;
   - source code, unless the tool is approved for code.
4. **You answer for the output.** Read and check anything an AI tool writes before you send it, publish it or act on it. "The AI said so" is not a reason.
5. **Check facts and figures.** AI tools state wrong things confidently. Check names, numbers, quotes, legal points and links against a source.
6. **Say when it matters.** Tell a customer when they are talking to an AI assistant rather than a person. Do not present AI-written advice as a professional's opinion.
7. **No decisions about people by AI alone.** Hiring, firing, pricing for one person, credit and complaints need a person's decision (document 13).
8. **Respect other people's work.** Do not ask a tool to copy a named person's or company's work, and do not upload material we have no right to share.
9. **Report mistakes quickly.** If you put something into a tool that should not be there, tell [policy owner] the same day. It is handled as an incident (document 06), not as a disciplinary matter by default.

## Approved tools

| Tool | Approved for | Not for | Account type | Approved on |
|---|---|---|---|---|
| [Tool name] | [For example drafting emails, summarising notes] | [For example customer personal data] | [Business plan, training on our data switched off] | [Date] |
| [Tool name] | [For example writing code] | [For example production secrets] | [Team plan] | [Date] |

## Checklist

- [ ] Every member of staff has read this policy and it is recorded (document 15).
- [ ] Each approved tool has training on our data switched off, or a contract that forbids it.
- [ ] The list of approved tools was reviewed in the last 12 months.
- [ ] Leavers lose access to every AI tool on their last day.

## References

- ICO, *Guidance on AI and data protection*.
- NCSC, *ChatGPT and large language models: what's the risk?*

---

AI App Policy Kit, version 1.0. © 2026 PuglieseWeb LTD, licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/): use it, change it and share it, with credit. The whole kit, and a free Software Health Check of your app against it: <https://www.puglieseweb.com/ai-policy-kit>