Free template

    AI Acceptable Use Policy Template

    Three documents that give your company a practical starting point for AI governance: an acceptable use policy employees will actually read, a governance policy for leadership and IT, and a risk assessment worksheet for each new AI use case. It covers the questions most policies skip, including what data can go into prompts, how to vet AI vendors, and how much access an AI agent should get. The governance policy maps to the NIST AI RMF functions and ISO/IEC 42001:2023, so it fits the frameworks your auditors and customers are starting to ask about.

    What's inside

    • An AI acceptable use policy with approved and prohibited uses, data classification rules for prompts, and an approved tools register
    • A governance policy covering AI inventory, risk tiering, approval workflow and logging, mapped to NIST AI RMF and ISO/IEC 42001
    • 17 vendor due diligence questions and specific least-privilege rules for AI agents, including human approval gates
    • A use case risk assessment worksheet with 11 common AI risks, likelihood and impact scoring, and approval sign-off

    Part A. AI acceptable use policy

    • Approved and prohibited uses
    • Approved tools register
    • Data classification rules for prompts
    • Intellectual property, human review and disclosure
    • Reporting, consequences and acknowledgment

    Part B. Generative AI and AI agent governance policy

    • AI inventory and risk tiering
    • Approval workflow
    • Vendor due diligence questions
    • Agent permissions and least privilege
    • Logging, testing and AI incident handling
    • Framework alignment to NIST AI RMF and ISO/IEC 42001

    Part C. AI use case risk assessment worksheet

    • Use case summary
    • Risk scoring, inherent and residual
    • Overall tier and decision

    Get the Word document

    Enter your work email and the download unlocks right here. No drip sequence.

    Frequently asked questions

    What is an AI acceptable use policy?

    A policy that tells employees which AI tools they may use, for what, and with which data. A good one names the approved tools, bans putting confidential or regulated data into unapproved ones, requires a human to review AI output before it is relied on, and says how to report a problem.

    Do we need a separate policy for AI agents?

    Yes, if agents can take actions rather than just answer questions. An agent with access to email, files or business systems needs its own identity, the least access it needs, a human approval step for risky actions and logging. Part B of the pack covers this.

    Which frameworks does the pack map to?

    The governance policy maps to the four NIST AI RMF 1.0 functions (Govern, Map, Measure, Manage) and to ISO/IEC 42001:2023, the AI management system standard.

    AI governance consultingAI Agent Security Report 2026Shadow AI: the security risk