← Where you standFree decision tool · Where you stand

AI Acceptable Use Policy Builder

Twelve short questions about your tools, your data and your rules produce a plain-English acceptable use policy your staff can follow. You can edit every clause before printing, and the draft ends with a list of the decisions you still have to make. No email required.

Listen to this briefing

The AI Acceptable Use Policy Builder

0:00

Why write the policy now

In many of the mid-market companies I speak with, staff already use ChatGPT or Copilot every day and nobody has written down what is allowed. The policy gets postponed because it sounds like a legal project. A first version only has to answer a few questions: which tools, which information, who checks the output, who approves a new tool, and where a mistake gets reported.

The cost of waiting shows up in breach data. In IBM's Cost of a Data Breach Report 2025, 63% of the breached organisations had no AI governance policy or were still developing one. I wrote about what separates a working policy from a decorative one in Governance Theatre Is What Fear Looks Like on a Slide.

This builder asks those questions one at a time and assembles the draft from clause blocks I use in client work. Each clause names the framework it rests on, so your legal and HR reviewers can check the reasoning.

How the draft is built

Twelve answers become ten sections and a list of open decisions

Your answers

  1. Your organisation3 questions
  2. Your data1 question
  3. Your tools3 questions
  4. Your rules5 questions

One question at a time. "Not decided" is an allowed answer.

The policy

  1. 1Purpose
  2. 2Scope
  3. 3Approved tools
  4. 4Information you may enter
  5. 5Prohibited uses
  6. 6Human review and disclosure
  7. 7Roles and new tools
  8. 8Reporting incidents
  9. 9Training
  10. 10Review of this policy

Open decisions

  • "We have not decided"Agree how much human review AI output needs, and who the second reviewer is for external work
  • "Not sure"Find out which AI accounts staff use and on what terms
  • "No one yet"Decide who approves new AI tools, and what they check before saying yes

The draft fills each one with a safe default until you decide.

Section headings and open-decision lines are the ones this builder writes. Every clause names the framework it rests on.

The output is a starting draft. Have it reviewed by your legal and HR advisers, and approved by your leadership, before you publish it to staff.

Build your draft

Twelve questions, one at a time

  • About 8 minutes
  • 12 questions in three parts: organisation, data and tools, rules
  • Editable draft with a printable PDF
  • Answers stay in your browser

If nobody in your organisation has decided something yet, say so. The draft fills that gap with a safe default and adds it to your list of open decisions.

Basis

What each clause rests on

Every clause block is traced to a published standard, framework or law. The wording of the clauses and the traffic-light ratings are my own drafting from applying these sources in client work, and none of the sources prescribes them.

Show the rules and their sources ▸
RuleSource
The organisation has a documented AI policy, aligned with its other policies and reviewed at planned intervalsISO/IEC 42001:2023 Annex A controls A.2.2 AI policy, A.2.3 Alignment with other organizational policies and A.2.4 Review of the AI policy Source →
Roles for approving tools and owning the policy are assigned, and staff have a way to report concernsISO/IEC 42001:2023 Annex A controls A.3.2 AI roles and responsibilities and A.3.3 Reporting of concerns Source →
Staff are trained and aware of the policy, and completion is recordedISO/IEC 42001:2023 clauses 7.2 Competence and 7.3 Awareness; NIST AI RMF GOVERN 2.2 Source →
Trustworthy-AI characteristics are written into policy, legal requirements are documented, and the policy is reviewed periodicallyNIST AI RMF 1.0, GOVERN 1.1, 1.2 and 1.5 Source →
AI tools are kept in an inventory, and third-party tools are covered by policy, including intellectual property riskNIST AI RMF 1.0, GOVERN 1.6 and 6.1; ISO/IEC 42001:2023 A.10.3 Suppliers Source →
Human oversight roles are defined, and incidents can be identified and sharedNIST AI RMF 1.0, GOVERN 3.2 and 4.3 Source →
Accountability, data, incident reporting, security and content provenance are considered together for generative AIIMDA and AI Verify Foundation, Model AI Governance Framework for Generative AI (30 May 2024), nine dimensions Source →
Personal data is protected by reasonable security arrangements, and notifiable breaches go to the PDPC within three calendar days of assessmentSingapore Personal Data Protection Act 2012, protection obligation (section 24) and data breach notification (Part 6A) Source →
Where AI supports decisions about individuals, the organisation can explain the decision and its use of personal dataPDPC Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems (1 March 2024). The guidelines cover recommendation and decision systems and do not address generative AI directly Source →
Personal data in the UAE and Saudi Arabia is handled under the national data protection lawUAE Federal Decree-Law No. 45 of 2021; Saudi Personal Data Protection Law (Royal Decree M/19), enforced by SDAIA Source →
The traffic-light ratings: amber only with an approved tool under enterprise no-training terms; identity numbers, secrets and price-sensitive information always redPractitioner judgement by Terence Kok. Not prescribed by any of the sources above. Tighten or loosen the ratings to your own risk appetite.

Annex A references are to the controls of ISO/IEC 42001:2023; clause references without an "A." prefix are to its management system requirements. NIST references are to the GOVERN subcategories in Table 1 of NIST AI 100-1.

Using the draft

How to take it to approval

  1. Fill in the [bracketed] placeholders and close the open decisions with the people who own them. Most take one conversation.
  2. Send the draft to legal and HR together. HR checks it against contracts and the disciplinary procedure; legal checks client agreements and data protection law.
  3. Have your chief executive or board approve it, and date it. ISO/IEC 42001 places the AI policy with top management for that reason.
  4. Publish it with the tool register, brief every team, and record who completed the training.
  5. Put the first review in the diary six months out. The first version will be wrong somewhere, and the review is where you find out.
Related governance tools

An acceptable use policy covers how staff use tools other people built. Once you start building or deploying agents of your own, rate each one with the Agent Risk Assessment Matrix. To check whether the management system around the policy would survive certification, use the ISO 42001 AIMS Readiness Checklist. To test whether your board could answer for AI use across the company, use the Board AI Oversight Checklist.

Go deeper

Policy review and staff briefing

The builder gives you a first draft. Settling the open decisions with your leadership team and briefing staff so the rules are used is work I do directly with clients.

Book a private session
Terence Kok
Before You Go

I wrote these clause blocks after seeing the same pattern in company after company: staff using AI every day, and leadership waiting for a complete policy before writing any of it. Two pages that people read will protect you more than forty pages in a shared drive. Answer honestly, especially where the true answer is that nobody has decided yet. The list of open decisions at the end is the page I would take to your next leadership meeting.

Terence Kok

Last updated 25 Oct 2026

More in Where you stand

Next in this group · Decision toolAI Use Case Prioritisation MatrixOf the use cases on the table, which do we fund first, and how much autonomy can each one have?Rank your use cases →
← All 8 in Where you stand