Your staff are already using AI at work. Not the tools you approved — the ones they found. A marketing coordinator pasting a client list into a chatbot to draft outreach. A bookkeeper uploading a spreadsheet to summarise it. A manager asking a free tool to rank job applicants.
None of them think they are doing anything wrong, and mostly they are not. The problem is that nobody wrote down where the line is, so every employee is drawing it themselves, differently, and you will find out where they drew it during an incident.
A written acceptable use policy is the cheapest control available here. It is a document, not a project. Here is what belongs in it, section by section, and what we see go wrong in each.
Why a Verbal Understanding Is Not a Policy
Three things a document does that a conversation cannot.
It gives employees permission. Most people are guessing, and a surprising number have quietly stopped using tools that would genuinely help them because nobody said it was allowed. An unwritten rule suppresses the useful behaviour along with the risky one.
It gives you something to enforce. Discipline for violating a rule nobody published is difficult to defend, in an employment dispute and in a room with your own staff.
And it gives you something to show. Clients ask. Insurers ask. Anyone doing vendor due diligence on you asks, and increasingly they ask in writing. “We handle that informally” is a bad answer to give a customer whose data you hold.
Name the Tools, Not the Technology
The most common drafting mistake is writing rules about “artificial intelligence” in the abstract. Employees cannot apply that, because they do not think of the transcription feature in their meeting software or the summarise button in their inbox as artificial intelligence. They think of it as a button.
Write a list instead. Approved tools, named, with what each one may be used for. Then a short section on what to do about anything not on the list — who to ask, and how long an answer takes. Make requesting a new tool easy, because a slow approval process is how shadow usage starts.
If you have not settled which tools belong on that list yet, that is a separate exercise and worth doing deliberately rather than by default. Keep the list in a place that can be updated without reissuing the policy. An appendix or an intranet page referenced by the policy works; a list baked into a signed PDF does not, and will be out of date within a quarter.
The Data Rules Are the Whole Document
If you write nothing else, write this section. It answers one question: what may never be typed, pasted, or uploaded into one of these tools?
Be concrete. “Confidential information” means nothing to a staff member at 4pm on a deadline. Name the categories your business actually holds — client financial records, patient information, employee files, unreleased designs, anything under a customer NDA, source code, case files. List them explicitly, because the person reading this is trying to do their job, not parse your definitions.
Then explain the distinction that most people have never had explained: a consumer account and a business account are not the same product. Free and personal-tier tools frequently reserve the right to train on what you submit. Business and enterprise tiers generally contractually do not. This is the single most useful thing a policy can teach, and it is the reason the approved-tools list exists at all — not because the technology differs, but because the contract does.
Finish with the practical rule that covers the cases you did not anticipate: if the information would need an agreement in place before you emailed it to an outside company, it needs one before you paste it into a tool.
Hiring and Employment Decisions Need Their Own Clause
This is where California businesses have an obligation most have not registered.
Regulations under the Fair Employment and Housing Act, in effect since 1 October 2025, cover automated decision systems in employment. The definition is deliberately broad — any tool that assists or replaces human discretion in screening, ranking, or evaluating candidates. A manager using a general-purpose chatbot to sort a stack of résumés is inside that definition, whether or not anyone bought software for the purpose.
Two consequences for the policy. First, employment screening should be a named, restricted use rather than something left to a manager’s judgment. Second, the regulations carry a four-year record retention requirement for material related to those decisions — which means the relevant use needs to be visible and documented rather than happening in someone’s personal browser tab.
The same logic applies to performance reviews, promotion decisions, and disciplinary write-ups. Say plainly whether these tools may be involved, and if so, who reviews the output before it becomes a decision.
Disclosure, Review, and Who Signs Their Name
Three questions the document should answer without hedging.
Does work that goes to a client need to say it was assisted? Different businesses answer differently and both answers are defensible, but employees need to know which one is yours before they send something.
Who is accountable for accuracy? The answer should be the person who sends it, stated in those words. These tools produce confident, well-formatted, incorrect output — invented citations, plausible figures, misremembered contract terms. Whoever puts their name on the work owns every claim in it.
What gets a second pair of eyes? Anything going to a client, anything with numbers in it, anything with legal or regulatory content. A sentence is enough.
Enforcement Only Works If You Can See It
A policy with no visibility is a statement of hope. You do not need to monitor keystrokes, but you should know which of these services your network is reaching and who is signed in to them. Most businesses already have the telemetry to answer that and have never run the report.
Blocking everything is the wrong instinct. It drives people to their phones, where you have no visibility at all and no business-tier contract protecting the data. Approve a good option, make it genuinely easy to get, watch for what else appears, and treat a tool that keeps showing up as a signal that your approved list has a gap rather than that your staff are delinquent.
Review the document quarterly. This is one of the few policies where an annual cycle is too slow — the tools change faster than that, and so does what your people are doing with them.
Policy Questions, Answered
How long should this document be?
Two to three pages. Longer and nobody reads it, which defeats the purpose. The approved tool list lives separately so it can change without reissuing the policy.
Do we need one if we have not approved any tools?
Especially then. A business with no approved tools and no policy is not a business without AI use; it is a business with unmonitored AI use. The policy is what converts that into a decision.
Should employees sign it?
Yes. Acknowledgement at onboarding and again at each material revision, recorded the same way you record your other handbook acknowledgements.
Can we just tell people not to put company data into these tools?
You can, and it will be ignored within a month, because the tools are useful and the rule offers no alternative. A workable policy names what may be used and for what, rather than issuing a prohibition that quietly becomes optional.
Our staff use the version built into software we already pay for. Does that count?
Yes, and it is the most commonly missed case. Features embedded in tools you already license still process your data and still belong on the approved list, with their settings reviewed rather than assumed — the assistant bundled into Microsoft 365 being the usual example.
Who should own this document internally?
Usually operations or HR, with IT supplying the tool list and the visibility. Assigning it to IT alone tends to produce a technical document that the people it governs do not read.
Want a Draft to Start From?
We write these for the businesses we support — the policy itself, the approved tool list, the settings that make the business-tier protections actually apply, and the reporting that shows what is being used. It usually takes a couple of conversations rather than a project.
Call (213) 873-7620 or book a free IT assessment and we will show you what your network says is already in use.
Related reading: CCPA Compliance in 2026 · Dark Web Monitoring for Business