AI acceptable-use policy
1. Purpose
This policy lets everyone at [Organization] use artificial intelligence (AI) tools to do better work, while protecting the information of our clients, employees and partners, our intellectual property and our reputation. It says which AI tools may be used, what information may go into them, and how their results are checked.
2. Scope
This policy applies to all employees, contractors, interns and anyone else who works with [Organization]'s information or systems ("you"). It covers every AI tool used for [Organization]'s work: chat assistants, AI features built into other software, coding assistants, agents that take actions, and AI models reached from code. It applies on [Organization]'s devices and on personal devices used for work.
3. Principles
- Approved tools only. Use AI only through the tools and accounts that [IT] has approved.
- Protect information. Share information with an AI tool only where section 5 allows it for that tool.
- You stay responsible. AI output is a draft. You are accountable for what you use, send or decide.
- Be open about it. Say when AI did substantial work that others rely on.
- Ask when unsure. Before sharing information or trying a new tool, ask [AI governance lead].
4. Approved AI tools
[IT] keeps the list of approved AI tools, the models each one offers and who may use them at [location of the approved-tools list]. Approved tools use work accounts, approved models, providers that don't train their models on our information, and the safeguards in section 5.
- Don't use personal AI accounts (for example a personal ChatGPT, Claude or Gemini account) for [Organization]'s work.
- Don't install browser extensions, plug-ins or apps that send work content to an AI service unless they are on the approved list.
- To request a new tool, model or use, contact [IT request channel]. [IT] answers within [5 business days] and records its decision.
5. What information you may use
Classify information as [Organization]'s information classification policy says. [If you have none, use the four levels below.]
| Level | Examples | In approved AI tools |
|---|---|---|
| Public | Published website content, press releases, public documentation | Allowed |
| Internal | Internal procedures, meeting notes without client details, drafts | Allowed |
| Confidential | Client information, contracts, unpublished financial results, source code, personal information about employees or clients | Only in tools approved for confidential information, with the safeguards they apply (for example, removing personal information before it reaches the model) |
| Restricted | Passwords, keys and other secrets; health, financial or government identifiers (such as social insurance or health card numbers); privileged legal information; information a contract forbids us to share | Never |
Personal information is any information about an identifiable person: treat it as Confidential at least. If you wouldn't be allowed to email a piece of information to the tool's provider, don't enter it in the tool.
6. Using what AI produces
- Check it. AI can be wrong, out of date or invented. Verify facts, figures, citations, code, and legal, financial or medical statements before relying on them.
- Review before it leaves. A person reviews AI-generated content before it goes to a client, is published, or is used in a decision about someone.
- Decisions about people. AI must not decide alone about a person (hiring, performance, credit, eligibility). Where a decision about a person is based exclusively on automated processing, Quebec's privacy law requires telling the person and letting them have it reviewed by someone. [Check with the privacy officer.]
- Intellectual property. Don't ask AI to reproduce protected works, and check that what you publish doesn't copy someone else's work. [Organization]'s rules on who owns work product apply to AI-assisted work.
- Labelling. Mark AI-generated content where [Organization]'s communication guidelines or a client require it.
7. Agents and automation
AI agents that act (send email, change records, run code, call other systems) need more care:
- Only [IT], or people it designates, build and publish agents, and only with approved tools.
- An agent gets the minimum access it needs. Actions that are hard to undo (payments, deletions, anything sent outside [Organization]) need a person's approval.
- Agents are tested before people use them, and every change to them is versioned and recorded.
8. Building with AI (developers)
- Applications and scripts reach AI models only through [Organization]'s approved gateway or accounts, never with personal API keys.
- Keys are issued by [IT], kept in [secret store], and never written into code or shared.
- New uses of AI in products or internal systems go through [Organization]'s review: a privacy impact assessment when personal information is involved (Quebec's privacy law requires one for new information systems that handle personal information) and a security review.
9. Records and monitoring
To protect information and manage costs, [Organization] records how approved AI tools are used: who used which tool and model, when, what it cost, and when a safeguard blocked or changed a request. [Organization] [does / does not] keep the content of requests. [Describe what is recorded, how long it is kept and who can see it, in line with the employee privacy notice.]
10. Roles
- Everyone: follows this policy and reports concerns.
- Managers: make sure their teams know the policy and have the approved tools they need.
- [IT]: approves and configures tools, keeps the approved list, applies the safeguards, monitors use.
- [Privacy officer]: advises on personal information, assessments and incidents.
- [AI governance lead]: owns this policy and decides on exceptions.
11. Exceptions
Ask [AI governance lead] for an exception in writing, with the reason and the safeguards you propose. Approved exceptions are recorded with an end date.
12. Incidents
If information was shared with an AI tool against this policy, or an AI tool put information at risk, tell [IT] and [privacy officer] right away at [contact]. Don't try to fix it yourself first. An incident involving personal information may have to be reported to the people concerned and to privacy authorities.
13. Training and acknowledgement
Everyone covered by this policy completes [Organization]'s AI training when they join and [every year], and confirms they have read this policy.
14. Breaches
Breaches of this policy are handled under [Organization]'s disciplinary policy, in proportion to the harm and the intent.
15. Review
[AI governance lead] reviews this policy at least [every six months], because AI tools change quickly, and after any significant incident.