AI Transformation · Glossary

AI Acceptable Use Policy

Updated October 25, 2026

An AI acceptable use policy, also called an AI use policy or a company AI policy, is the written document that sets how people may use artificial intelligence (AI) tools at work, and who answers for the output. In one practitioner's policy structure, built in an MIT (Massachusetts Institute of Technology) Professional Education course (October 2025), a working shape rather than a standard, it covers employees, contractors and partners who research, develop, deploy or use AI, and it names large language models (LLMs) and generative systems explicitly. It is one part of AI governance: the document, not the whole system around it, which the What is AI governance? article covers.

A written policy is an advisory control: it makes the right behavior likelier and guarantees nothing. An AI vendor's public playbook (Anthropic, August 2026) states the general principle: a rule that must always hold needs a check that runs outside anyone's discretion. Many policies presented as enforced are advisory in this sense: a written standard, a prompt instruction, a training module. That is not nothing; the error is presenting it as a guarantee.

What makes an AI policy hold?

Clauses that name a mechanism, an owner and a review cadence, the test that structure scores a policy on, backed by checks that run on their own. Teams describe the problem as "shadow AI": tools and client data used outside anything security has approved. In practice, the first gaps tend to be that nobody can list which AI tools are in use and nobody owns the hallucination problem. A policy that holds:

1. Covers the parts templates miss. In that structure, most templates miss a register of AI tools in use, human sign-off at every stage, a hallucination clause, and review that scales as the system does.
2. Writes an honest hallucination clause. It says the risk of an AI hallucination, a fluent, confident answer that is false or invented, is reduced by process, not solved, and names what gets checked and by whom. A clause promising accuracy is unwritable.
3. Names AI systems as tools, with a named human owner for each AI-produced output. Where a person must check output before it takes effect, the policy names that human in the loop.
4. Moves must-hold rules into automated gates. In the same vendor playbook, a gate can allow, ask or block, and a block gives the reason and the route to approval. A gate that blocks with no remedy turns into a workaround.

Have counsel review the policy. Settle it before an AI pilot puts the tools into real work, and if you commission an AI readiness assessment, ask it to start with the tool register.