AI acceptable use policy: a free one-page template

This AI acceptable use policy template is one page long and written for small teams that use ChatGPT, Claude, Copilot or AI features inside other software.

In short:

The one-page template below is free to copy into Google Docs or Word. There’s no email form.
It covers ten points: who it applies to, approved tools, personal accounts, a three-level data rule, checking output, decisions about people, telling clients, training, mistakes and a review date.
It bans personal AI accounts for work. On ChatGPT Free, Plus and Pro, OpenAI may train on chats unless the person opts out, and on Claude’s consumer plans, Anthropic can keep chats for up to 5 years when training is allowed.
In the EU, Article 4 of the AI Act requires providers and deployers of AI systems to take measures to support their staff’s AI literacy. Since the July 2026 amendment, it doesn’t require any specific level. The European Commission says no certificate is needed, and suggests keeping an internal record of training.
National authorities supervise and enforce Article 4 from 2 August 2026.

The one-page AI acceptable use policy template

Replace everything in square brackets, delete the examples you don’t need, and keep it to one page.

This template is not legal advice. Check it with your own lawyer before you adopt it.

[Company name] AI acceptable use policy
Version 1.0, [date]. Owner: [name and role]. Next review: [date].

1. Who this covers
Everyone who works for [Company name], including contractors, when they use
AI tools for work. "AI tools" means chat assistants, coding assistants and AI
features inside other software.

2. Approved tools
Use only these AI tools for work, signed in with your company account:
- [for example: ChatGPT Business, Claude Team or Microsoft 365 Copilot]
- [AI features in software we already pay for]
To ask for a new tool, contact [owner]. We approve a tool only if its business
plan doesn't train on our data by default and we have signed its data
processing terms.

3. Personal accounts
Don't use personal or free AI accounts for work, even with names removed.
Don't install AI browser extensions or apps that aren't on the approved list.

4. Data rules
Green: public information, and drafts with no personal or client data.
  Any approved tool.
Amber: internal documents, client names, contracts, and personal data about
  staff or customers. Approved tools only, for the task in hand, and only if
  the client's contract allows it.
Red: [passwords and API keys, payment card numbers, health records, anything
  a contract says stays on our systems]. Never put these into a hosted AI
  tool. Ask [owner] about the self-hosted option.

5. Checking the output
You are responsible for anything you send, publish or decide with AI help.
Check facts, figures, names, quotes, links and code before you use them.
AI tools can write things that sound right and are wrong.

6. Decisions about people
Don't use AI to decide on hiring, pay, performance or credit unless a person
reviews the decision and [owner] signs it off.

7. Telling clients
Tell a client when AI helped produce work for them if their contract or our
terms require it.

8. Training
Everyone completes [a one-hour session] before using approved tools.
[Owner] keeps a record of who attended and when.

9. Mistakes
If you put data into the wrong tool, tell [owner] the same day. Reporting it
quickly will not count against you.

10. Review
[Owner] reviews this policy every [six months] and whenever we add a tool.

I have read this policy and will follow it.
Name: ____________  Signature: ____________  Date: ____________

Why is each rule in the template?

Approved tools and plans

The approved list names plans as well as products, because the same product handles your data differently on different plans. OpenAI’s enterprise privacy page says it doesn’t train on data from ChatGPT Business, Enterprise or the API by default. Anthropic says the same for its commercial products, which include Claude Team, Enterprise and the API. Microsoft’s Copilot privacy page says prompts, responses and Microsoft Graph data “aren’t used to train foundation LLMs.”

The second condition, signed data processing terms, matters for anyone who handles personal data. OpenAI offers its DPA for ChatGPT Business, Enterprise and the API, and Anthropic’s DPA is part of its Commercial Terms. If you’re choosing between Claude Team and ChatGPT Business, we compare them in Claude Team vs ChatGPT Business. If your developers use coding assistants, list those by name too. Our post on Claude Code for teams covers the cost and the first settings.

Data rules in brief

Three levels are enough for a small team to remember. Green goes anywhere approved, amber goes only into approved business plans, and red never goes into a hosted tool. Each vendor’s retention, training and residency terms by plan are in our post on putting confidential documents into ChatGPT, with a link to the vendor’s page for every cell.

Checking the output and decisions about people

The European Commission’s AI literacy Q&A answers this case directly. Asked whether a company whose employees use ChatGPT to write advertising text or translate needs to meet the AI literacy rule, it says: “Yes, they should be informed about the specific risks, for example hallucination.” Clause 5 puts that in writing. Clause 6 keeps a person in charge of decisions that affect someone’s job or money.

Training and the record

The same Q&A says “There is no need for a certificate. Organisations can keep an internal record of trainings and/or other guiding initiatives.” It also says no specific governance structure is required, so you don’t need to appoint an AI officer to meet Article 4. A one-hour session on your team’s own tasks, with an attendance list, is a reasonable start.

Why ban personal AI accounts?

The company can’t see, export or delete anything in a personal account, and the vendor’s terms for individuals apply instead of the business terms.

OpenAI’s help page on training says that on Free, Plus and Pro, “we may use your content to train our models,” unless the person turns off “Improve the model for everyone”. A thumbs up or down can still send the whole conversation for training after they opt out.
Anthropic’s consumer terms update says chats on Claude Free, Pro and Max are kept for five years if the person allows training.
Neither company’s DPA covers a personal account.

Banning personal accounts only works if staff have an approved tool that does the same job, so set that up first.

How do you find personal AI accounts without buying DLP software?

Most of these checks use admin consoles you may already pay for.

On Claude Enterprise, once you verify your email domain, admins can see every personal Claude account on that domain with its email address, plan type, creation date and last active date, and export the list as a CSV. An admin can then claim those accounts, and the people using them get 30 days to move their data across. Team plans can verify a domain and block new personal accounts, but can’t claim existing ones.
On ChatGPT Enterprise or Edu, an employee who already has a personal account under their work email may be asked to migrate it when they join the workspace. On ChatGPT Business, OpenAI’s onboarding article says employees can keep their personal workspace separate or merge it, and “admins cannot require a merge or deletion.”
In Google Workspace, the Admin console lists “Apps that have accessed Google data” under Security > Access and data control > API controls, and lets you block or limit each one (Google). Look for AI tools on that list.
In Microsoft Entra, go to Entra ID > Enterprise apps > All applications, pick an app and open Permissions. The User consent tab shows what individual people have granted it (Microsoft).
Check expense claims and company card statements for AI subscriptions.
Ask people directly, and promise that nobody gets in trouble for answering.

What do EU and UK teams need: AI Act Article 4 and ICO guidance

The original Article 4 in Regulation (EU) 2024/1689 required providers and deployers to “take measures to ensure, to their best extent, a sufficient level of AI literacy” of their staff. The Commission’s Q&A treats a company whose staff use ChatGPT at work as covered by that rule.

Regulation (EU) 2026/1744, the Digital Omnibus on AI, replaced that article. It was adopted on 8 July 2026, published in the Official Journal on 24 July 2026 and entered into force on the third day after publication. Article 4(1) now says providers and deployers “shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf,” and adds: “This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.” The Commission’s Q&A says supervision and enforcement apply from 2 August 2026, and that this job sits with national authorities, not the EU’s AI Office.

The AI Act is EU law. For UK teams, the ICO’s Guidance on AI and data protection is the place to start, with one caveat from the ICO itself: “Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change.”

For US teams that want a fuller structure later, NIST’s AI Risk Management Framework is voluntary and organised around four functions: govern, map, measure and manage. NIST says version 1.0 is being revised.

How do you roll it out in a week?

Monday: pick the approved tools and name an owner.
Tuesday: fill in the template and send it to your lawyer.
Wednesday: sign each vendor’s DPA, then set retention, feedback and domain settings.
Thursday: run a one-hour session on your team’s real tasks, and keep the attendance list.
Friday: everyone signs the policy. Put the review date in the owner’s calendar.

If you’d like help setting up the tools and running that first session, see our team rollout options.