An AI acceptable use policy is an internal document that sets out which AI tools staff may use, for which tasks, with which data and on whose approval. A good one is more than a list of bans: it defines scope, owners, use-case approval, output accountability, training and a review cycle, and takes effect once signed off.
What happens when there is no policy
In most organisations AI arrived as a habit rather than a decision. Marketing drafts copy with it, sales summarises proposals, developers accept code suggestions and HR writes job adverts. Each team has its own tool and rules. What these uses look like when they are set up properly is covered in AI in B2B marketing and AI proposal writing.
The trouble is that nobody owns this patchwork. An employee who asks which tools are approved, who is accountable for a contract clause drafted by AI, or who reviews a new tool will not get a clear answer. When something goes wrong, there is no written rule to enforce.
We covered the data side, meaning what should never be pasted into ChatGPT-style tools, in our piece on ChatGPT and company data security. This article covers the document that carries those rules: its sections, owner, approval and rollout.
The cost of running AI without a policy
Türkiye's Personal Data Protection Authority (KVKK, which enforces Law No. 6698, the country's GDPR-style data protection law) described the situation in a March 2026 notice (our translation):
In particular, the fact that these tools are not always used within a clearly defined corporate strategy, policy or guidance framework, and that their use is in most cases shaped by employees' individual preferences to make their daily work easier, can make it difficult to monitor and manage generative AI tools at organisational level. (KVKK notice "Use of Generative AI Tools in Workplaces", 5 March 2026)
The policy gap shows up in breach data too. In IBM's Cost of a Data Breach Report 2025, 63% of breached organisations either had no AI governance policy or were still developing one. A policy should not be something rushed out after an incident.
Uncertainty also holds back the firms that have not started. In the OECD's 2025 D4SME survey, 67% of responding SMEs not using generative AI were unsure how to use it or what the risks were. A clear policy tells that hesitant majority which tool, task and limits apply.
Incidents are rising as well: the Stanford AI Index 2026 reports that AI incidents recorded in the AI Incident Database grew from 233 in 2024 to 362 in 2025. Banning tools one by one cannot keep up; you need a document that sets principles and process.
What an AI acceptable use policy should contain
Every section should answer a real question. The outline below suits most small and mid-sized companies and can also sit as an annex to your information security policy.
| Section | Question it answers | Common mistake |
|---|---|---|
| Purpose and scope | Who and which tools are covered? Contractors and interns too? | Saying "ChatGPT" and forgetting AI built into email, office suites and CRM |
| Definitions | What counts as generative AI, an agent, an approved tool, sensitive data? | Rules built on undefined terms, open to interpretation |
| Roles and responsibilities | Who owns, approves and enforces the policy? | Leaving it all to IT |
| Approved tools and use cases | Which tool may be used for which task? | A tool list with no distinction between tasks |
| Data rules | Which data class may go into which tool? | Vague wording not tied to a data classification |
| Output accountability and transparency | Who checks output, and when is AI use disclosed to clients? | Leaving room for "the AI wrote it" as an excuse |
| Prohibited uses | Where is AI never used? | Ignoring automated decisions about employees |
| New tools and exceptions | How does someone request a tool that is not listed? | No request route, which pushes people to shadow use |
| Incident reporting | What happens when the wrong data is entered, and who is told? | Punitive wording that makes people hide mistakes |
| Training and review | Who is trained, when, and how often is the policy revisited? | Writing it once and forgetting it |
The data rules section should rest on your data classification; how to set classes and owners is covered in our data governance framework guide. For use cases involving personal data, point the policy at a separate legal assessment covering lawful basis and cross-border transfer, as described in AI and KVKK personal data.
Approve use cases, not just tools: green, amber and red
The same tool can be harmless for one task and a serious risk for another. Tie each approval to a combination of tool, use case and data class, and sort use cases into three colours:
| Colour | Example use case | Condition |
|---|---|---|
| Green: allowed | Drafting from public information, general research, proofreading | Approved tool and a company account |
| Amber: conditional | Client-facing correspondence, summaries of internal documents, code suggestions, translation | Approved tool, human review, sources checked |
| Red: prohibited or specially approved | Hiring and performance decisions, credit or pricing decisions, health data, final contract wording | Only with a separate risk assessment and management sign-off |
Why amber cases need a human check is shown with examples in our article on reducing AI hallucinations. Decisions about staff deserve particular care on the red list; the limits on processing employee data are set out in employee personal data under KVKK.
Cases where AI does more than produce text, such as agents that act inside business systems, need their own clause. State which permissions an agent may hold, at which steps a person must approve its actions, and how its activity is logged; the checklist in our guide to AI agents for business can be lifted straight into the policy. Safeguards against instructions hidden in the documents or emails an agent reads are covered in prompt injection security.
Seven steps to write the policy and put it into force
- Map current use. Run a short survey with no disciplinary consequences to learn which team uses which tool for what. The policy should govern real use, not an imagined one.
- Name an owner and a small board. Give the policy one owner, supported by IT or security, legal or the data protection lead, and a business unit representative.
- Build the use-case matrix. Classify every use from the survey as green, amber or red and link approved tools to the matrix. Assess AI vendors with the questions in our third-party vendor security assessment guide.
- Open a request and exception route. Create a one-page request form for new tools or use cases and commit to a reasonable response time. Without a route, people will use tools without asking.
- Map technical controls to rules. Back the policy with mandatory company accounts, web filtering and data loss prevention rules; we explain how rules and controls line up in our guide to data loss prevention (DLP).
- Train and collect acknowledgement. Deliver short training built around real scenarios and record that staff have read the policy; linking it to your security awareness training programme keeps the effort manageable. How training fits with roles and job descriptions is covered in human–AI collaboration at work.
- Measure and update. Review at least once a year using requests, exceptions and reported incidents, and immediately when a new tool or a regulatory change arrives.
A note for companies that offer AI systems in the EU market or whose AI output is used in the EU: under the European Commission's AI Act timeline, the AI literacy obligation has applied since 2 February 2025. Step six's training records help here; when the act reaches Turkish companies is covered in our guide to the EU AI Act for Turkish companies.
Keeping the policy alive: a safe alternative and ongoing oversight
A policy only holds when it offers an alternative to what it forbids. "Do not paste client documents into external tools" has to come with "use this company assistant instead". The architecture of a permission-aware assistant that works on your own documents is explained in RAG for enterprise LLMs.
To keep the policy working, track three indicators: pending requests, exceptions granted for red use cases and incident reports. Zero reports is more likely to signal that people are reluctant to speak up than that nothing happened. Write the incident section so that good-faith reporting is never punished.
If you have not yet decided where AI should start in your organisation, work on the policy alongside an AI roadmap for your business. The priority use cases you choose there will shape the policy matrix; if you run an ISO 27001 management system, the controls fit within it.
How we approach this at Digital Bridge
We write policies from how a company actually works:
- Discovery and needs analysis. Through our cyber security consultancy we interview teams, map tools, account types and data flows, and draft the use-case matrix and policy together with you.
- Data protection and classification. With data protection compliance support we align personal data use cases with privacy notices, the data inventory and transfer assessments, and our data governance and quality work pins down data classes and owners.
- Pilot and a safe alternative. We pick one amber use case and pilot it with a small team. For sensitive documents we build an enterprise LLM assistant that respects permissions and cites its sources, running entirely on your own servers where required.
- Integration. We connect approved use cases to your ERP, CRM or intranet through AI integration, so staff reach the approved channel without hunting for a separate tool.
For ready-made tools, our own Smart360 product family enforces the policy's "who, with which data, how much" question inside the product. In SmartMail business email and SmartFiles, AI is a separate permission granted person by person; usage is counted against the organisation's monthly allowance shown in the panel, and in SmartFiles an administrator can switch the feature off entirely. SmartMail's audit log records actions taken by AI separately, as "System".
Next step
Do two things this week: send your teams a short survey asking which AI tools they use for which tasks, and place the answers in the green, amber and red table above. That table is your first draft. To refine it and choose a pilot use case, get in touch with us. More articles on the subject are collected in our Artificial Intelligence hub.