AI Acceptable Use Policy
Sets the rules for how Your Organization workforce members use generative AI and other AI systems: approved tools, data that must not be entered, human review of output, intellectual property, and accountability.
Maps to ISO/IEC 42001:2023 A.2.2 · ISO/IEC 42001:2023 A.9.2 · ISO/IEC 42001:2023 A.9.4 · NIST AI Risk Management Framework 1.0 GOVERN-1.1 · NIST AI Risk Management Framework 1.0 GOVERN-1.2 · NIST AI Risk Management Framework 1.0 GOVERN-1.6
Read it now — the PDF opens either way.
Purpose
Generative AI and other AI systems can improve the quality and speed of work, but they can also expose confidential information, produce wrong or biased output, and create legal and intellectual property risk. This policy sets the rules that let Your Organization gain the benefits while keeping control of its data and its decisions.
Scope
This policy applies to all workforce members of Your Organization who use AI systems for company work, including chat assistants, code assistants, image and audio generators, meeting transcription and summarization tools, AI features embedded in other software, and AI services accessed through an API. It covers tools Your Organization provides and tools a person brings, whether free or paid. It does not govern the design and release of AI features in Your Organization's own products, which falls under the AI governance program and the Secure Development Lifecycle Policy.
6 more sections in the full template
Roles and responsibilities · Requirements · Exceptions · Enforcement · Evidence · Review cadence. Download the full document above, or open it in CMDash to fill in your organization name and effective date automatically.
Use this policy for real, not just on paper
“Open in CMDash” pre-selects the AI Acceptable Use Policy template the first time you create a policy — your organization name and today’s date fill in automatically, and it lands as a DRAFT you can edit before publishing.