AI Governance
What Is an AI Acceptable-Use Policy?
- Approved tools
- Data rules
- Consequences
Short answer
An AI acceptable-use policy (AUP) is a short internal document that says which AI tools employees may use, with which accounts, what data they must never enter, and how to request a new tool. It works when it is specific, short and backed by controls and training.
Maskflare Engineering Updated
What is an AI acceptable-use policy for?
Most companies already have an IT acceptable-use policy, written before generative AI. It says nothing about pasting a customer complaint into a chatbot. An AI-specific policy fills that gap. It answers the questions people actually have: can I use ChatGPT, which version, what can I paste, and who do I ask?
It is also evidence. If a regulator, customer or auditor asks how you manage staff use of AI, a dated policy with named owners and a record of training is the first thing they will want to see. Under the GDPR, for example, you need to show you apply data minimization and appropriate security to personal data, and an AUP is part of that story. This is not legal advice.
What should it contain?
| Section | What to write | Example |
|---|---|---|
| Scope | Who and what it covers | All staff and contractors, any AI tool including built-in features |
| Approved tools and accounts | Named tools and which account type to use | Company ChatGPT workspace yes; personal accounts no |
| Data rules | What must never be entered, with examples from your work | Customer IBANs, patient names, unreleased financials, API keys |
| Conditional data | What needs a reason or approval | Contract terms may go to the approved assistant with a stated purpose |
| Output use | Checking and attribution | Review AI-written code and legal text before use |
| Requesting a tool | How, and how long it takes | Form to IT, answer within a stated time |
| Reporting and consequences | What to do after a mistake | Tell the security team; honest reports are not punished |
Examples carry the policy. "Do not share confidential data" means different things to different people. "Do not paste customer names, IBANs or health details" does not.
What are the common mistakes?
- Banning everything. It moves AI use to phones and personal accounts, where you see nothing. Name approved tools instead.
- Writing for lawyers. If it takes twenty minutes to read, people sign it and forget it. One to two pages is usually enough.
- No route to a yes. If asking for a new tool takes months, people stop asking. Say how long an answer takes.
- Punishing honest reports. People who fear consequences hide mistakes, and you lose the chance to contain them.
- Never updating it. New tools appear every month. Review it at least quarterly and date it.
- No enforcement at all. A policy with no control behind it describes a hope.
How does the EU AI Act come into it?
The AI Act doesn't require an acceptable-use policy by name. Article 4 requires providers and deployers to take measures to support the AI literacy of their staff and others operating AI systems for them. It has applied since 2 February 2025 and was reworded by the Digital Omnibus (Regulation (EU) 2026/1744), which does not require guaranteeing a specific level of literacy for any individual. A clear policy plus training and records is a common way to show you took measures. The high-risk rules for Annex III systems now apply from 2 December 2027. Details are on the EU AI Act page. This is not legal advice.
How do you enforce it?
Training and trust do most of the work, but some rules are easy to check automatically. Maskflare can turn parts of a policy into controls on managed devices:
- Approved and blocked tools: AI app discovery shows which AI apps are used, and you mark each approved, tolerated or blocked. Blocked apps show a message with your policy link and the approved alternative.
- Company versus personal accounts: Maskflare can tell company workspaces from personal accounts in ChatGPT and Claude, so "company account only" can be checked. See what is BYOAI.
- Data rules: masking replaces personal data and secrets with tokens before the prompt reaches the provider, using 574 detectors, and secrets can be blocked outright.
- Conditional data: warn and justify turns "may be shared with a reason" into a prompt and a record.
Discovery and coaching need the desktop agent on managed devices. Maskflare doesn't write your policy, track staff training or assess whether your AI systems are high-risk; those stay with your compliance and HR teams. For the wider picture see what is AI governance and what is AI usage control.
A short starting outline
- Purpose, in one sentence, and who owns the policy.
- The approved tools list and the account to use for each.
- Five to ten concrete examples of data that must never be entered.
- How to ask for a new tool, and how long the answer takes.
- What to do after a mistake, and a promise that honest reports are welcome.
- Review date and version.
Frequently asked questions
How long should an AI acceptable-use policy be?
One to two pages is usually enough. Longer policies tend to be signed and forgotten. Put the detail in an appendix or training and keep the policy itself readable.
Do we need an AI policy if we ban AI tools?
Yes. Staff will still meet AI features inside tools they already use, and a ban without monitoring tends to push use out of sight. A policy that names approved tools and a request route works better.
Is an AI acceptable-use policy required by law?
Not by that name. The EU AI Act requires measures to support AI literacy, and the GDPR requires appropriate organizational measures for personal data. A policy is a common way to meet both. This is not legal advice.
Can software enforce the policy?
Parts of it. Tools can detect AI apps in use, block unapproved ones and mask sensitive data. Rules about judgment, such as checking AI output, still depend on people.
Who should own it?
Usually security or compliance, with input from legal, HR and a few business teams. Name one owner so there is somebody to ask and somebody who updates it.