We are establishing a Generative AI Acceptable Use Policy. Who has templates for corporate use?

Organizations typically source Generative AI Acceptable Use Policy templates from a mix of governance vendors, security firms, HR/legal template providers, and analyst firms. Some commonly referenced sources include:

Enterprise / governance-focused templates

• Gartner — Provides a configurable “Policy Template for Acceptable Use of Generative AI” aimed at organizations building formal AI governance programs. It is generally oriented toward enterprise AI leaders and governance teams.
• Microsoft — Many organizations adapt Microsoft’s AI governance guidance and responsible AI materials alongside internal acceptable-use policies, particularly where Microsoft Copilot is part of the environment. (A policy template may need to be assembled from governance guidance rather than a single AUP document.)
• NIST — The AI Risk Management Framework is not an acceptable-use policy template itself, but many corporate policies are structured around its risk-management concepts.

Free or low-cost editable policy templates

• shadowaipolicy.com — A copy/adapt AI acceptable-use policy template covering areas such as approved tools, prohibited data, accountability, and review requirements.
• shadowlock.io — Provides a free template covering approved tools, prohibited information, monitoring, exceptions, and violations.
• layer3labs.io — Provides a fill-in-the-blank policy covering scope, approved tools, prohibited uses, data handling, human review, incident reporting, and review cadence.
• govarna.com — Offers a more governance-oriented template emphasizing tool tiers, data isolation, approval workflows, incident reporting, training, and review cycles.

HR / employee-policy oriented templates

• firsthr.app — Provides an employee-facing acceptable-use policy style, including acknowledgment language and rules around approved AI tools, sensitive information, review, and accountability.
• csff.org — A simpler template focused on employee guidance, confidentiality, intellectual property, accuracy, and responsible use.

Consulting / professional services approaches

Many larger organizations also have their AI policy drafted or adapted by:

• Big Four advisory practices (AI governance, risk, compliance teams)
• Cybersecurity firms
• Outside counsel specializing in privacy, intellectual property, and employment law
• Internal combinations of Legal + Security + HR + Data Governance

What a corporate-grade GenAI Acceptable Use Policy usually includes

A mature policy typically covers:

1. Scope

• Employees, contractors, vendors
• Company devices and personal devices used for work

2. Approved AI tools

• Approved enterprise tools
• Personal/free AI accounts restrictions
• New tool approval process

3. Data handling

• What can be entered into AI tools
• Prohibited data (customer data, confidential information, credentials, regulated data, source code, etc.)

4. Human accountability

• Verification of AI outputs
• No unsupervised use for high-impact decisions

5. Intellectual property

• Ownership of AI-assisted work
• Copyright and licensing considerations

6. Security requirements

• Prompt injection risks
• Data leakage prevention
• Logging/monitoring expectations

7. Special use cases

• Software development
• Customer communications
• Marketing content
• HR/recruiting
• Legal/compliance documents

8. Governance

• Policy owner
• Review cycle
• Exception process
• Training requirements

For a mid-size or large company, I would generally start with a governance-oriented template (for example Gartner/NIST-aligned structure), then add employee-friendly language from an HR-style template so the final policy is both auditable and usable.

I can also provide a comparison matrix of these templates by enterprise readiness, cost, legal depth, and best fit (startup vs. regulated enterprise) if helpful.

Several reputable professional organizations, cybersecurity firms, and legal bodies provide baseline templates and frameworks for corporate Generative AI Acceptable Use Policies (AUP).

Major Sources for Templates

• SHRM (Society for Human Resource Management): Offers a widely used Generative AI Usage Policy Template tailored for workplace compliance, security, and HR considerations (note: full access typically requires a SHRM membership).
• Cybersecurity and IT Vendors (Tenable, SANS, etc.): Cybersecurity firms frequently publish implementation guides and structural frameworks. For instance, you can review structural breakdowns like Tenable's AI Acceptable Use Policy Guide to map out security guardrails.
• IAPP (International Association of Privacy Professionals): Provides an extensive collection of AI Governance Third-Party Resources and Tools useful for compliance, risk management, and data privacy framing.
• Open-Source & Legal Community Repositories: Many tech law firms and open-source governance groups (like Responsible AI networks) publish modular, copy-and-adapt Markdown templates on GitHub or legal blogs specifically for corporate legal adaptation.

Core Sections Your Policy Should Include

An effective corporate GenAI AUP typically covers these key components:

If you'd like, I can help you draft a custom outline or specific policy clauses tailored to your company. Tell me:

• What is your industry (e.g., healthcare, finance, tech)?
• Are you looking to completely block or actively encourage/sanction certain AI tools?

Organizations typically source Generative AI Acceptable Use Policy templates from a few categories: governance firms, security/compliance providers, industry associations, and analyst firms. Some options:

Enterprise / governance-oriented templates

• Gartner — Provides a configurable “Policy Template for Acceptable Use of Generative AI” intended for organizations building GenAI governance programs. It is aimed more at enterprise AI leaders than small businesses.
• NIST — While not a plug-and-play employee acceptable use policy, NIST AI governance resources are commonly used as reference material when aligning internal AI policies with responsible AI practices.

Free or low-cost editable templates

• shadowlock.io — A practical employee-facing template covering approved tools, prohibited data, personal accounts, monitoring, and exceptions.
• layer3labs.io — A fill-in-the-blank policy designed for small and mid-sized organizations; includes approved tools, prohibited uses, data handling, human review, and incident reporting sections.
• govarna.com — Provides an open-source style baseline with sections on tool tiers, data isolation, approval workflows, incident reporting, training, and review cadence.
• complyjet.com — Combines traditional acceptable-use policy topics (accounts, devices, monitoring) with AI-specific rules.

Industry/security-focused examples

• csff.org — A sample policy emphasizing security, intellectual property, confidentiality, and human review risks.
• tilsonhr.com — A corporate-style sample addressing scope, accountability, ethics, and employee responsibilities.

What a corporate-grade template should usually include

A strong enterprise policy generally covers:

• Scope: employees, contractors, vendors, interns, and third parties
• Approved AI tools and procurement/security review process
• Data classification rules (what can and cannot be entered into AI systems)
• Confidential information, customer data, regulated data, and intellectual property restrictions
• Human review requirements for AI-generated content
• Accuracy, hallucination, and decision-making risks
• Software/code generation rules
• Copyright and ownership considerations
• Disclosure requirements when AI is used externally
• Monitoring, auditing, and enforcement
• Exception process and policy review cadence

For a larger enterprise, I would generally start with a governance-oriented source (such as Gartner-style guidance), then adapt a shorter employee-facing policy from one of the operational templates.

If your organization is in a regulated industry (financial services, healthcare, government contracting, insurance, legal, etc.), the template should usually be customized rather than adopted verbatim.

Several reputable organizations, HR associations, and legal/governance groups provide foundational templates and frameworks for drafting a corporate Generative AI Acceptable Use Policy.

• SHRM (Society for Human Resource Management) : Offers a customizable SHRM Generative AI Usage Policy Template focusing heavily on workplace compliance, risk management, and security.
• Lattice : Provides a comprehensive Lattice AI Usage Policy Template that helps structure scope, governance, data-handling ethics, and monitoring procedures.
• National and Regional Business Associations: Organizations like the Mississippi Manufacturers Association / MAIN publish practical, updated AI Policy and Guidance Templates for Business covering privacy, cybersecurity, and human review guardrails.
• Industry-Specific Legal Resources: If you are in a specialized or regulated field (like law or finance), groups like Darrow offer tailored frameworks such as their Free AI Policy Template for Law Firms addressing confidentiality and professional responsibility.
• IT & Security Frameworks: Outlines and breakdowns by tech advisory groups (reviewed in roundups like MES Computing's AI Policy Frameworks ) help align your acceptable use policy with data governance and least-privilege IT controls.

To help narrow down which template style fits best, tell me:

• What is your industry (e.g., healthcare, finance, tech, retail)?
• Are you looking to completely restrict certain tools, or empower employees with safe integration?

Several organizations, HR associations, cybersecurity firms, and tech platforms provide free, customizable GenAI Acceptable Use Policy (AUP) templates tailored for corporate and enterprise use.

Where to Find Templates

• HR & Management Associations: The SHRM Generative AI Usage Policy Template offers clear guidelines focused on security, compliance, and workplace integration.
• Governance & Security Standards Bodies: ISACA’s AI Acceptable Use Policy Template provides a robust framework designed to mitigate enterprise risk and establish technical governance.
• Compliance & Tech Platforms: Companies like Deel’s AI Acceptable Use Policy Template and Aona AI's Enterprise AI AUP Template offer copy-ready, modern frameworks updated for current regulations.
• Cybersecurity Vendors: Firms such as FRSecure and Strac provide free guidelines that place heavy emphasis on data leakage prevention and handling customer information securely.

Core Components to Include

When adapting a template, ensure your policy explicitly covers:

• Scope: Whether it applies to all employees and contractors, and if it covers personal tool use on corporate devices.
• Approved vs. Prohibited Tools: A clear white-list of enterprise-sanctioned tools (e.g., corporate-tier ChatGPT Enterprise, Copilot, or Claude) versus banned consumer-grade interfaces.
• Data Classification & Prompt Hygiene: Strict rules prohibiting the input of Personally Identifiable Information (PII), Protected Health Information (PHI), financial records, source code, or trade secrets into unauthorized platforms.
• Human Oversight & Accountability: Requiring human verification of all AI-generated text, code, or calculations before external publication or critical decision-making.
• Review Cadence: Establishing a short review cycle (such as quarterly or semi-annually) given how rapidly AI capabilities and legal frameworks shift.

If you'd like, let me know:

• Your industry (e.g., healthcare, finance, legal, manufacturing)
• Your primary goal (preventing data leaks vs. encouraging productivity)

I can help outline the specific risk factors you should prioritize in your policy.

Yes. I found several corporate-oriented Generative AI / AI Acceptable Use Policy templates that could serve as a starting point. I’d separate them into “practical corporate templates” and “authoritative governance frameworks.”

Good corporate templates

1. Aona AI — AI Acceptable Use Policy Template
   A relatively enterprise-focused template covering scope, approved tools, data-classification rules, prohibited uses, accountability/reporting, and review. It was updated July 29, 2026.

2. Layer3 Labs — AI Acceptable Use Policy
   Particularly useful if you want an editable, plain-English corporate policy. It covers approved/prohibited tools, prohibited data, human review, disclosure, IP ownership, security, and incident reporting.

3. Business-in-a-Box — AI Acceptable Use Policy
   Provides an editable Word-based template covering approved tools, data classification, prohibited uses, accountability, and enforcement.

4. ShadowLock — Free AI Acceptable Use Policy
   A straightforward template aimed at IT/security/compliance teams. It explicitly addresses approved tools, prohibited data, personal AI accounts, monitoring, violations, and exceptions.

5. AI Governance Guide
   More governance-oriented than employee-handbook-oriented. It includes policy ownership, scope, permitted uses, and review requirements and can be useful for building the governance layer around an acceptable-use policy.

For a corporate policy, I'd recommend combining these with a governance framework

A strong enterprise policy shouldn't just say “don't put confidential information into ChatGPT.” I'd structure it around:

• Approved AI tools — including an approval/intake process for new tools
• Data classification — exactly what employees may enter into public, enterprise, and internally hosted AI
• Permitted use cases — drafting, summarization, coding, research, analysis, etc.
• Prohibited/high-risk uses — employment decisions, legal conclusions, autonomous customer decisions, etc.
• Human oversight — verification requirements and accountability for AI-generated output
• Privacy, confidentiality & IP
• Customer/third-party data and contractual restrictions
• Transparency/disclosure where appropriate
• Security requirements — accounts, plugins, integrations, API keys, uploading files
• Records/monitoring and incident reporting
• Roles and responsibilities — Legal, Security, IT, HR, business owners, employees
• Exceptions process
• Training and acknowledgment
• Review cadence — particularly important because the approved-tool landscape and regulations are changing quickly.

For legal departments, there are also specialized templates. The Maryland State Bar Association, for example, has separate templates for solo practitioners, midsize firms, large firms, and in-house legal teams, with provisions covering security, supervision, training, reporting, and audit.

My recommendation: use one of the corporate templates above for the employee-facing acceptable-use portion, but build it into a broader AI Governance Policy/Standard rather than adopting a generic template verbatim. That gives you a policy that can actually support Security, Legal, Procurement, HR, and IT controls.

If you tell me your company size, industry, and whether you're primarily using Microsoft Copilot, ChatGPT Enterprise, Gemini, Claude, or a mix, I can also identify the best 3 templates/frameworks for your situation and compare them section-by-section.

Several major HR organizations, legal tech groups, and enterprise research firms offer customizable corporate templates for a Generative AI Acceptable Use Policy (AUP). Prominent providers include the SHRM Generative AI Usage Policy Template , the Gartner Policy Template for Acceptable Use of Generative AI , and the ISACA Artificial Intelligence Acceptable Use Policy Template . Additionally, open organizational frameworks like the Data.org Generative AI Policy Template and regional legal resource hubs such as Michalsons Free Generative AI Policy provide free starting points.

Core Sections to Include in an AI AUP

When adapting these templates for your corporate environment, ensure the policy covers the following structural areas:

• Purpose and Scope: Define who the policy applies to (employees, contractors, vendors) and whether it covers personal devices used for work.
• Approved and Prohibited Tools: Explicitly list sanctioned enterprise tools versus banned public models to prevent shadow IT and data leakage.
• Data Classification and Handling: Prohibit pasting proprietary source code, financial records, or personally identifiable information (PII) into unvetted consumer AI platforms.
• Human Oversight and Accountability: Require mandatory human review (the "human-in-the-loop" rule) for all AI-generated content, code, or client-facing communication.
• Intellectual Property and Disclosure: Clarify ownership of AI outputs and establish rules for when and how the use of AI must be disclosed externally.

Would you like me to tailor a custom draft outline based on your specific industry (e.g., healthcare, finance, tech) or focus on a particular risk area like data privacy or IP?

Yes. There are several useful corporate-ready starting points, ranging from consulting-firm templates to free editable policies.

Best sources I found

What I'd recommend for a corporate policy

I wouldn't simply adopt one of the free templates verbatim. A strong corporate Generative AI Acceptable Use Policy should distinguish between:

1. Approved AI tools — e.g., enterprise versions sanctioned by IT/security.
2. Restricted tools — requiring security, privacy, legal, or business-owner approval.
3. Prohibited tools/use cases.
4. Data classification rules — what employees may put into public vs. enterprise AI.
5. Human-review requirements — especially for legal, financial, HR, customer-facing, and other consequential outputs.
6. IP/copyright and confidentiality.
7. Accuracy/hallucination requirements.
8. Use of AI in software development.
9. Customer/employee disclosure requirements, where applicable.
10. AI agents and autonomous actions — increasingly important and often missing from older templates.
11. Incident reporting and monitoring.
12. Exception/approval process.
13. Training and employee acknowledgment.
14. Governance ownership and review cadence.

Microsoft's current enterprise AI code of conduct is also worth examining as a source of specific prohibited-use and human-oversight concepts, particularly around consequential decisions.

If you're establishing this for a medium/large corporation, I'd use Gartner as the structural benchmark, then use one of the free templates (particularly Govarna or ChiefAI) as drafting material. That gives you a more defensible enterprise policy without making the employee-facing document unnecessarily complicated.

If you tell me your industry, approximate company size, and whether you're primarily using Microsoft Copilot, ChatGPT Enterprise/Business, Gemini, Claude, or multiple platforms, I can also identify the best template and compare the provisions you should borrow from each.

Several reputable HR, legal, security, and compliance organizations offer free and customizable corporate GenAI acceptable use policy (AUP) templates.

Where to Find Corporate GenAI Policy Templates

• SHRM (Society for Human Resource Management): Provides an extensive SHRM Generative AI Usage Policy Template and a broader SHRM AI Governance Policy Template tailored for workforce compliance, risk, and HR integration.
• Deel: Offers a downloadable Deel AI Acceptable Use Policy Template that includes both an annotated guidance version and a ready-to-customize version, structured to align with modern regulatory baselines like the EU AI Act.
• ISACA: Features a downloadable ISACA Artificial Intelligence Acceptable Use Policy Template focused heavily on audit, risk management, and enterprise governance.
• FRSecure: Provides a free FRSecure AI Acceptable Use Policy Template with a strong focus on information security, handling sensitive customer data, and vendor risk.
• TechSoup: Offers an TechSoup AI Usage Policy PDF which is exceptionally helpful if your organization leans non-profit or needs a simplified baseline.

Core Elements Your Policy Should Cover

Whichever template you adapt, ensure your final policy explicitly defines:

1. Scope: Who it applies to (employees, contractors, third-party vendors) and whether it covers company-issued or personal devices.
2. Approved vs. Prohibited Tools: A clear white-list of sanctioned enterprise tools versus a black-list or blanket prohibition of unvetted consumer-grade platforms.
3. Data Classification & Privacy: Strict rules stating that PII, PHI, trade secrets, financial records, and proprietary source code cannot be pasted into public/unapproved LLMs.
4. Human Oversight & Accountability: Mandating human review of AI-generated content before external publication, customer communication, or critical decision-making (e.g., HR or legal filings).
5. Incident Reporting: A fast path for employees to report accidental data exposure or shadow AI usage without fear of immediate punitive action.

Would you like help mapping out specific data tiers or defining approved versus prohibited use cases for your specific industry?

Yes. There are several useful sources, but they serve different purposes. For a corporate Generative AI Acceptable Use Policy, I’d start with a general business template and then map it to your security/privacy/compliance framework rather than adopting a vendor’s AUP verbatim.

Good sources to consider

1. Layer3Labs — general corporate AI Acceptable Use Policy

   • Specifically designed for businesses and employees using generative AI.
   • Covers approved tools, prohibited data, human review, disclosure, IP ownership, security, incident reporting, roles, and review cadence.
   • They provide an editable Word template.

2. Mako Logics — corporate AI Acceptable Use Policy

   • A practical template covering tools such as ChatGPT, Copilot, Claude, and Gemini.
   • Addresses confidential information, employee information, IP, compliance, and use on personal devices.
   • It explicitly notes that regulated industries need additional provisions.

3. Microsoft — Enterprise AI Services Code of Conduct

   • Not an employee AUP template, but useful as a benchmark for prohibited/high-risk uses, responsibility, reporting, and governance.
   • Microsoft says its current enterprise AI code is designed to align with emerging AI regulation, including the EU AI Act.

4. Wisconsin State Bar / Maryland State Bar — useful governance examples

   • Although designed for law firms, these are particularly good examples of how to translate broad AI principles into operational rules: approved tools, confidentiality, verification, human accountability, disclosure, and training.
   • The Maryland State Bar Association has four specialized AI policy templates.

What I'd recommend for a corporate policy

Rather than simply calling it an "AI policy," I'd structure it around three layers:

1. Acceptable use

• Brainstorming, summarization, drafting, translation, coding assistance, research assistance
• Approved enterprise AI tools
• Appropriate business use cases

2. Prohibited/restricted use

• Confidential, regulated, personal, or customer data in unapproved tools
• Credentials, secrets, source code, or security information
• Fully automated consequential decisions about employees/customers
• Fraud, deception, impersonation, or unlawful activity
• Circumventing security controls
• Generating material that violates company policies

3. Required controls

• Human review before consequential use
• Fact-checking and validation
• IP/copyright considerations
• Privacy and data classification
• Vendor/tool approval
• Disclosure where appropriate
• Recordkeeping and incident reporting
• Employee training
• Periodic policy review

A particularly important distinction is "approved AI tool" vs. "approved use case." For example, an enterprise version of an AI service might be approved for internal documents but not for regulated personal information or automated HR decisions.

If you tell me your company size, industry, geography (e.g., U.S. only vs. U.S./EU), and whether you use Microsoft 365/Copilot, ChatGPT Enterprise, Gemini, Claude, etc., I can identify the best template(s) and give you a corporate-ready policy structure mapped to NIST AI RMF / ISO 42001 and typical security/privacy controls.