Example Co AI Acceptable-Use Policy
1. Purpose and scope
Example Co supports responsible AI use so people can draft emails, documents, and research notes with less busywork. This policy protects client information and sets clear expectations for safe, useful work. It applies to every employee, contractor, and intern who uses AI for Example Co business, whether they use a company device or a personal device for work.
2. Approved tools
Microsoft 365 Copilot and ChatGPT Team are approved for writing emails, documents, and research summaries. Use them only through Example Co company-managed accounts. Approval of a tool does not mean every input is allowed. Follow the data rules and the human review rules each time you use a tool.
3. Tools that need approval or are not allowed
Do not use a personal AI account for Example Co work. Free consumer versions of AI tools are not allowed for client work or internal company work. A browser extension that sends page content to an AI service needs approval before use. Any other tool, including an image generator or a meeting note taker, needs written approval from the Operations Manager before anyone uses it for work.
4. Data rules
Never enter client personal data into an AI tool. That includes a client name tied to a matter, an email address, a phone number, and any other detail that identifies a person. Never enter contracts, confidential proposals, financial results, passwords, access keys, or files marked confidential. Take out identifying details and use a generic placeholder such as Client A when a draft needs context. If you are not sure a detail is allowed, leave it out and ask the Operations Manager.
5. Human review
You are responsible for AI-assisted work. Before you use, send, or file any output, check it for accuracy, bias, and tone. Confirm names, dates, figures, and citations against a source you trust. Correct errors. Polished writing can still be wrong. Do not send AI output to a client until you have reviewed it.
6. Customer-facing and sensitive uses
Client emails, proposals, and deliverables need a person to review them before they leave Example Co. An AI tool must not talk to a client on its own. Hiring decisions, performance reviews, and pay notes stay with people. AI may help you outline a job post, and a person decides what is published and who is hired. Legal, financial, and tax content needs review by the person who owns that work before anyone shares it.
7. Disclosure and ownership
Tell a client when AI helped create a deliverable the client will rely on, unless the engagement letter already covers that use. You do not need to announce a routine internal draft. Work product created for Example Co belongs to Example Co. That includes text you accept from an AI tool. Do not paste Example Co materials into a personal AI account.
8. Security and accounts
Use your Example Co account for every approved tool. Do not share logins. Turn on multi-factor authentication where the tool offers it. Where a setting lets you turn off model training on company data, turn it off. Sign out of shared computers. If a device is lost or an account looks compromised, tell the Operations Manager the same day.
9. Reporting problems
If you enter sensitive data by mistake, or if AI output causes a problem for a client, tell the Operations Manager right away. Say what you entered, which tool you used, and who received the output. The Operations Manager will decide the next step, such as notifying the client or closing the account. Reporting quickly is part of following this policy.
10. Regulations
This example does not apply a named regulation. Example Co serves business clients in the United States. If a client contract or a privacy law later applies to an engagement, the Operations Manager will add a short note in this section and ask counsel to review it. This policy does not say that Example Co meets any law or audit framework.
11. Breaking the policy
People who do not follow this policy are subject to the same workplace rules Example Co already uses. Depending on what happened, that can include coaching, loss of access to a tool, or the end of an assignment or employment. The Operations Manager considers what was shared, whether anyone reported it promptly, and whether the person asked for help first. Questions about a rule are welcome before you act.
12. Owner and review date
The policy owner is the Operations Manager at Example Co. Send questions and tool requests to policy@example.com. Effective date: [Effective date]. Review this policy again 12 months after the effective date, or sooner if Example Co adopts a new AI tool.
13. Disclaimer
This policy was created with AI assistance as a starting template. It is not legal advice and does not create an attorney-client or consulting relationship. Laws and regulations vary by location and change over time. Please review this policy with qualified legal counsel before adopting it, especially if your company operates in a regulated industry.