We are implementing a "Generative AI policy" for employees. Who has templates for acceptable use?

Several reputable HR, legal tech, and compliance platforms offer free or adaptable templates for employee generative AI and acceptable use policies.

• Lattice AI Usage Policy Template : Focuses heavily on scope, purpose, governance, and ethical guidelines for employee usage.
• GC AI Acceptable Use Policy Template : Provides an 8-section breakdown specifically targeting approved tools, data privacy, and human oversight.
• AIHR Generative AI Policy Guide and Template : Offers a structured framework highlighting risk awareness, training, and step-by-step rollout.
• MangoApps Acceptable Use of AI Policy : Geared towards everyday workplace tool adoption, handling confidential data, and routine workflows.

Would you like me to outline the core sections your policy must include (like data privacy and human-in-the-loop review), or do you want help drafting specific rules for your industry?

Yes. There are several useful starting points, but I’d distinguish between authoritative frameworks and copy-ready employee policies.

Good sources for templates

• NIST — Best for the governance/risk foundation. NIST’s Generative AI Profile provides a risk-based framework you can use to validate your policy, although it isn't itself an employee AUP template.
• AI Scope Digital — Has a recent, employee-facing, copy-ready template covering approved uses, restricted data, human review, IP, security, high-impact decisions, disclosure, incidents, and governance.
• Strac — Provides a free AUP template plus an enforcement-oriented approach. Particularly useful if you're thinking about how to make the policy enforceable through technical controls rather than just having employees sign it.
• ChiefAI — Offers a straightforward 2026 template with an approved/limited/prohibited tool-tier model, data-handling rules, and employee scope.
• Layer3 Labs — A plain-English template aimed at small/midsize businesses, covering approved tools, prohibited data, human review, disclosure, IP, and employee acknowledgment.
• Open Security Architecture — Worth considering if your organization wants a more traditional IT acceptable-use policy with explicit NIST 800-53 control mappings.

What I'd put in your employee policy

I'd keep the employee-facing document to roughly 2–4 pages, with the detailed governance material elsewhere. At minimum:

1. Approved AI tools — what employees may use and how new tools get approved.
2. Data rules — exactly what may never be entered into AI systems (confidential information, credentials, personal/regulated data, source code, customer information, etc.).
3. Permitted uses — drafting, brainstorming, summarization, coding assistance, research, etc.
4. Prohibited uses — unauthorized decision-making, impersonation, confidential-data disclosure, bypassing security controls, etc.
5. Human review — employees remain responsible for checking accuracy, bias, citations, IP issues, and inappropriate output.
6. Disclosure — when employees must tell customers, colleagues, or other parties that AI was used.
7. Intellectual property/copyright — ownership and review of generated material.
8. Incident reporting — what to do if someone accidentally puts sensitive information into an AI tool.
9. Accountability and exceptions — policy owner, approval process, and consequences.
10. Review cycle — I'd make this at least annual, with interim updates when major tools or regulations change.

The key is not to make the policy simply say "use AI responsibly." The better templates turn that into concrete decisions employees can make: Which tool? What data? For what purpose? What human review?

If you tell me your company size, industry, and whether you're primarily Microsoft 365, Google Workspace, or mixed, I can also give you a ready-to-adopt Generative AI Acceptable Use Policy tailored to that environment.

Several reputable HR, legal, and tech organizations provide reliable, customizable templates and frameworks for employee generative AI and acceptable use policies.

• SHRM (Society for Human Resource Management) : Offers a customizable SHRM Generative AI Usage Policy Template that emphasizes workplace security, regulatory compliance, and responsible innovation.
• Lattice : Provides a comprehensive Lattice AI Usage Policy Template covering scope, governance, data usage guidelines, and compliance.
• AIHR (Academy to Innovate HR) : Outlines a detailed framework and breakdown via their AIHR AI Policy Template Guide focusing on data privacy, bias prevention, and accountability.
• The Future of Life Institute / Governance Frameworks : Often publish open-source corporate AI governance models focusing on safety and alignment.
• Your Corporate Legal / IT Security Counsel : Many enterprise software vendors (like Microsoft or Google Workspace) and cyber-insurance providers also supply baseline internal policy addendums regarding data handling.

If you'd like, I can:

• List the key sections your policy should cover (like data privacy vs. creative use)
• Help you draft a quick baseline policy tailored to your company

Let me know how you'd like to proceed.

Yes. There are several good starting points, and I’d favor established HR/security organizations over generic “free template” sites.

• shrm.org — probably the best starting point if HR owns the employee policy. SHRM also has broader AI governance templates.
• cloud.google.com — useful for the security/governance side. It specifically discusses building an internal GenAI AUP with guardrails.
• learn.microsoft.com — not an employee-policy template, but a useful source for prohibited uses, human oversight, and responsible-use language.
• policies.google.com — another useful reference for defining prohibited activities and privacy/IP boundaries.
• There are also free, editable AUP templates from smaller providers such as Layer3 Labs and Menturi if you want something you can copy/adapt quickly.

What I'd put in your employee policy

Rather than making it a broad "AI ethics" document, I'd make the employee-facing AUP very practical:

1. Approved AI tools — which services employees may use, and whether personal accounts are prohibited.
2. Data restrictions — what can never be entered into GenAI: confidential information, customer data, credentials, sensitive HR information, unpublished IP, etc.
3. Human review — employees remain responsible for checking accuracy, bias, security, and appropriateness.
4. High-risk uses requiring approval — hiring/termination decisions, legal advice, financial decisions, medical decisions, customer eligibility, etc.
5. IP/copyright — don't assume AI-generated material is automatically safe to use.
6. Disclosure/transparency — when employees need to disclose AI assistance to customers, colleagues, or regulators.
7. Security — prompt injection, malicious files/code, external sharing, and uploading company material.
8. Incident reporting — what to do if an employee accidentally submits restricted information.
9. Enforcement and exceptions — who approves exceptions and what happens after violations.
10. Review cycle — AI tools and regulations change quickly, so set a periodic review rather than treating the policy as permanent.

Google's guidance is particularly useful for the security/guardrail philosophy, while SHRM's template is more directly suited to the employee/HR policy.

If you tell me your company size, industry, and whether you're primarily using Microsoft Copilot, ChatGPT, Gemini, or several tools, I can point you to the closest template and explain what I'd change for your environment.

Several organizations publish Generative AI / AI Acceptable Use Policy (AUP) templates that can be adapted for employee rollout. Common starting points include:

For an employee-facing Generative AI policy, most mature templates include these sections:

1. Purpose and scope

   • Who the policy applies to (employees, contractors, interns)
   • What counts as a generative AI tool

2. Approved AI tools

   • Which tools are allowed
   • Whether company accounts/licenses are required

3. Data handling rules

   • What employees may enter into AI systems
   • Prohibited inputs (customer data, confidential information, credentials, source code, regulated data)

4. Acceptable use cases

   • Drafting and editing
   • Brainstorming
   • Summarization
   • Research assistance
   • Coding assistance (with review)

5. Prohibited uses

   • Uploading restricted data
   • Using AI output without review
   • Generating misleading content
   • Circumventing security controls

6. Human accountability

   • Employees remain responsible for accuracy, bias checks, confidentiality, and final decisions

7. Reporting and exceptions

   • How to request approval for new AI tools
   • How to report suspected misuse

8. Employee acknowledgment

   • Confirmation that employees read and understand the policy

A few additional sources worth considering for benchmarking:

• NIST AI Risk Management Framework — useful for aligning policy language with broader AI risk governance.
• ISO/IEC 42001 AI management system information — useful if your organization is building a more formal AI governance program.

If you are implementing this in a large enterprise, I would usually combine an employee AUP template with a separate AI governance standard (tool approval process, vendor review, data classification, security controls, and legal review).

Here are top web results for exploring this topic:

Security Scientist·https://www.securityscientist.net AI Acceptable Use Policy Template (ChatGPT & GenAI, Word)Do you know what ... Banning these tools is not realistic: staff are already using ... Frequently asked questions. What should a generative AI policy template ... Michalsons·https://www.michalsons.com Free generative AI acceptable use policy - Michalsons How to implement the generative AI AUP in your business. Rolling out a generative AI policy effectively requires careful planning: Involve key stakeholders: Get input from legal, compliance, IT, and d Dazychain·https://www.dazychain.com**Generative AI policy template** for in-house legal teams - Dazychain Generative AI policy template you can copy/paste, plus an implementation checklist and FAQs for safe AI use across your business. Tenable·https://www.tenable.com What is an AI Acceptable Use Policy (AUP)? | Tenable®5 essential elements of a generative AI policy. A strong AI use policy is clear, comprehensive and easy for everyone to understand. It replaces ambiguity with · 1. Scope and roles. This section define Facebook·https://www.facebook.com Hi! Does anyone know of a policy to avoid use of Gen AI or a Values ...... is a major concern, as it can lead to several risks, including misinformation and disinformation, privacy violations, and loss of intellectual property. What is a generative AI policy? Comprehensi WitnessAI·https://witness.ai AI Policy Template Guide: Build a Responsible AI Usage Policy Example 3: SMB Generative AI Policy. Audience: Startups and small businesses; Focus: Productivity, safe AI adoption; Key Elements: Guidelines on using ChatGPT for content creation; Restrictions on use University of North Alabama·https://www.una.edu**Generative AI Policy** - University of North Alabama Generative AI Policy. Guidelines for Responsible Generative AI Use: Balancing Innovation and Responsibility at the University of North Alabama. Purpose. The purpose of this document is to guide the re Layer3Labs·https://www.layer3labs.io AI Acceptable Use Policy Template (Free Word Download)A ready-to-edit generative AI policy template that governs how employees create content with AI. Covers ownership and copyright risk of generated work, ... Ethisphere·https://ethisphere.com AI Governance 2.0: Four Frameworks Worth Learning From ... Principles of Artificial Intelligence2. HCA Healthcare — Responsible AI Policy3. Baker McKenzie — Generative AI Policy Template4. IBM — Principles for Trust and Transparency in AIWhere to Go from Legal Nodes·https://www.legalnodes.com Generative AI Company Use Policy Guide + Template - Legal Nodes Download your free Generative AI Policy Template. Please note that this document is not legal advice and is for informational purposes only. DOWNLOAD. By submitting this form you agree with our privac

Several reputable compliance, legal, and technology organizations provide free, downloadable generative AI acceptable use policy (AUP) templates to establish clear employee guardrails.

Where to Find Free Templates

• Michalsons Generative AI AUP : A legally structured template focusing on copyright, mitigating output bias, intellectual property protection, and strict data privacy.
• data.org AI Policy Template : An open-source PDF template built around a practical "Do's and Don'ts" framework, mandating human review for AI-generated outputs.
• Zuva AI Policy Template : A template designed to outline procurement guidelines, continuous policy evaluation, and vendor contract risk terms.
• TechSoup AI Usage Policy Hub : Specifically geared toward nonprofits and social impact teams, addressing bias, equity, and regulatory alignment.

Core Sections to Include in Your Policy

When adapting a template, ensure it covers these critical buckets:

Immediate Implementation Steps

1. Draft a Tiers Matrix : Categorize use cases into Prohibited (e.g., pasting client data), Authorized with Review (e.g., generating code), and Permitted Freely (e.g., basic brainstorming).
2. Run a Cross-Department Review : Involve representatives from Legal, IT, HR, and Compliance to map the document against existing cybersecurity protocols.
3. Deploy Mandatory Employee Training : Instead of just sending an email, hold interactive webinars or workshops detailing exactly where your company's data boundaries sit.

Would you like me to help you draft a specific section of the policy (like a "Do's and Don'ts" table for data inputs), or do you want to outline a vetting process for new AI tools?

Yes. There are several usable templates, ranging from lightweight employee-facing policies to more formal governance documents:

• Aona AI — a current 2026 template covering approved tools, data classification, prohibited uses, accountability, incident reporting, and review cycles.
• Menturi — particularly useful if you want both a 1-page quick-start AUP and a more detailed version for audits/vendor reviews. It covers approved tools, sensitive data, human review, disclosure, and incident reporting.
• Layer3Labs — a fill-in-the-blank policy aimed at small/midsize organizations, with sections for approved tools, prohibited uses, data handling, human review, security, and review cadence.
• Security Scientist — offers an editable Word template specifically addressing employee use of ChatGPT and other GenAI tools, including data, approvals, IP, and review rules.
• Business-in-a-Box — a more conventional corporate-policy format, including approved/prohibited tools, confidentiality, output review, training, enforcement, and employee acknowledgment.

What I'd borrow for an employee policy

I'd keep the actual employee-facing policy to roughly 2–3 pages and make these rules unmistakable:

1. Approved AI tools — maintain a named list and an approval process for adding tools.
2. Data restrictions — clearly state what employees may not put into public or unapproved AI systems.
3. Human accountability — employees remain responsible for checking AI-generated content for accuracy, bias, confidentiality, and appropriateness.
4. Prohibited uses — e.g., making employment decisions, submitting confidential/customer information to unapproved tools, or using AI deceptively.
5. IP/confidentiality — address company IP, third-party content, and personal information.
6. Disclosure — specify when employees must tell customers, colleagues, or regulators that AI was used.
7. Incident reporting — give employees a simple way to report accidental disclosure or problematic AI output.
8. Tool/account requirements — preferably company-managed accounts rather than personal/free accounts.
9. Ownership and review — name the policy owner and review it periodically.

Those themes recur across the templates above and are more useful than simply saying "use AI responsibly."

If you're implementing this for a Canadian organization, I'd also make the privacy/data-handling language especially explicit rather than relying on a generic US-oriented template. The Canadian Cyber Security template is one starting point tailored to Canadian teams.

If you tell me your organization size and industry, I can also compare these templates and recommend which one is the best starting point.

Yes. There are several solid sources for employee-facing Generative AI acceptable-use policies. I’d shortlist these:

1. SHRM — probably the best starting point for an HR/employee policy. SHRM has a specific Generative AI Usage Policy Template, plus broader AI-governance templates.

2. Gartner — offers a configurable Policy Template for Acceptable Use of Generative AI, aimed more at organizations building formal AI governance programs.

3. Aona AI — has a current, employee-focused AI Acceptable Use Policy Template covering approved tools, data classification, prohibited uses, compliance, incident reporting, and policy review.

4. Layer3Labs — offers a straightforward free template that explicitly covers approved/prohibited tools, sensitive data, human review, disclosure, and IP.

5. Fisher Phillips — worth considering if you want the policy reviewed from an employment-law/privacy/IP perspective rather than treating it purely as an IT policy. A current comparison of available templates identifies its sample policy as particularly useful for legal considerations.

What I'd put in your policy

Rather than simply saying "don't put confidential information into ChatGPT," I'd structure the employee AUP around:

• Approved AI tools — which tools employees may use for company work.
• Data rules — what can/cannot be entered, mapped to your existing data-classification scheme.
• Permitted uses — drafting, brainstorming, summarization, coding assistance, research, etc.
• Prohibited uses — confidential/customer data, unauthorized decisions about employees/customers, illegal or discriminatory uses, etc.
• Human review — employees remain accountable for accuracy and appropriateness.
• IP/copyright — don't assume AI-generated material is automatically safe to use.
• Disclosure/attribution — when AI assistance needs to be disclosed internally or externally.
• Security — approved accounts, browser extensions/plugins, API use, and "shadow AI."
• Incident reporting — what to do if someone accidentally submits sensitive information.
• Enforcement and review — ownership, training, exceptions, and periodic updates.

One useful current template specifically recommends keeping the employee AUP to roughly 2–3 pages and making the rules operational rather than turning it into a long AI-governance document.

My recommendation: use SHRM as the HR/policy baseline, then supplement it with Gartner or a security-oriented template for technical controls. Have counsel/security review the final version before rollout, particularly if you handle regulated, customer, employee, or proprietary data.

Several major HR, legal, and tech organizations provide robust, customizable templates and frameworks for a workplace Generative AI Acceptable Use Policy (AUP).

Key Providers of Templates & Frameworks

• SHRM (Society for Human Resource Management): Offers a widely used Generative AI Usage Policy Template tailored for HR and compliance, emphasizing security, compliance, and responsible workplace innovation. They also provide a broader Simple AI Governance Policy Template.
• Enterprise HR & Compliance Platforms (e.g., Deel, Lattice): Deel offers a Free AI Acceptable Use Policy Template that helps organizations align with modern compliance standards (such as the EU AI Act). Lattice provides an AI Usage Policy Template focused on team onboarding and internal governance.
• Cybersecurity & IT Vendors (e.g., FRSecure, Tenable): FRSecure provides an AI Acceptable Use Policy Template targeting data handling and customer data protection.
• Legal and Policy Toolkits (e.g., Bloomberg Law, ToolkitCafe): Frequently updated legal resource kits offer sample language covering electronic communications and liability.

Core Sections Your Policy Should Include

Regardless of which template you start with, an effective policy typically covers these essential components:

1. Purpose and Scope: Explicitly state who the policy applies to (full-time employees, contractors, third-party vendors) and whether it covers company-issued devices or personal devices used for work tasks.
2. Approved vs. Prohibited Tools: Maintain a clear, accessible list of sanctioned enterprise tools (e.g., specific enterprise-tier LLMs) and explicitly forbid unvetted public tools to prevent "shadow AI" data leaks.
3. Data Classification & Privacy Rules: Define what can and cannot be entered into a prompt. Prohibit pasting source code, customer Personally Identifiable Information (PII), unreleased financial metrics, or trade secrets into public AI tools.
4. Human Oversight and Accountability: Require human review and verification for all AI-generated outputs, particularly for external communications, code deployment, legal/compliance documents, or HR decisions. Clarify that the employee remains fully accountable for the accuracy of the work.
5. Intellectual Property & Disclosure: Clarify ownership of AI-assisted work product and define when employees must explicitly disclose that AI was used to draft a document or asset.
6. Violation Consequences: Outline disciplinary procedures for unauthorized data exposure or policy breaches.

If you share your industry and company size , I can help you tailor which specific restrictions and data tiers your policy should prioritize.