Skip to content
How to Write an AI Acceptable Use Policy: A Practical Guide for Mid-Market Owners and Operators

How to Write an AI Acceptable Use Policy: A Practical Guide for Mid-Market Owners and Operators

2026-10-31 · By the Yellow Coop Team

Your team is already using AI, some of it on company accounts and some of it a sales rep pasting a customer contract into whatever chatbot was open in the next tab. The takeaway up front: a workable AI acceptable use policy answers four questions on about two pages: which tools are approved, which data can go into them, who checks the output, and who approves new uses. Write it so people can follow it on a busy Tuesday, not so it looks impressive in a binder.

Why this can’t wait

A few plain definitions first:

  • Acceptable use policy (AUP): the written rules for how staff may use a company tool or system.
  • Generative AI: tools like ChatGPT, Gemini, or Copilot that write text, code, or images from a prompt.
  • Confabulation: NIST’s term for what most people call “hallucinations,” the production of “confidently stated but erroneous or false content.”

Usage is not hypothetical. In a Pew Research Center survey of 5,119 U.S. adults conducted February 17–23, 2026 (published June 17, 2026), 38% of employed adults said they use AI chatbots for tasks at work. Pew’s earlier survey of 5,273 U.S. workers (October 7–13, 2024) found 9% used chatbots at work daily or a few times a week and 7% a few times a month. The questions differ, so read that as direction, not a precise growth rate.

Two well-documented incidents show what goes wrong without rules:

  • Data going out. In April 2023, Samsung’s semiconductor division found three cases where engineers uploaded sensitive company information, including meeting minutes and source code, to ChatGPT, according to The Korea Herald (May 3, 2023). Samsung then temporarily banned generative AI tools on company devices in another division and warned that violations could lead to discipline “up to and including termination of employment.”
  • Bad output coming in. In Mata v. Avianca (S.D.N.Y., June 22, 2023), Judge P. Kevin Castel, U.S. District Judge, sanctioned two lawyers and their firm $5,000 for filing fake case citations generated by ChatGPT. His point was not that AI is forbidden: “there is nothing inherently improper about using a reliable artificial intelligence tool for assistance. But existing rules impose a gatekeeping role on attorneys to ensure the accuracy of their filings.”

Swap “attorneys” for “anyone who sends work outside the building” and you have half of your policy.

The two-page AI acceptable use policy

1. Name the approved tools

List the AI tools staff may use for work, and require company-managed accounts rather than personal ones, so you control settings, see who has access, and can shut it off when someone leaves. Add a one-line process for requesting a new tool, or people will quietly route around the list.

2. Sort your data into traffic lights

Most policy failures are data failures. Keep the rules simple:

  • Green (fine in approved tools): public information, marketing drafts, general research.
  • Yellow (approved company tools only): internal documents, process notes, non-sensitive financials.
  • Red (never, unless a specific tool is approved for it): customer personal data, health or payment information, passwords and keys, source code, and trade secrets.

This maps to risks NIST names in its Generative AI Profile (NIST AI 600-1, July 26, 2024), including Data Privacy (leakage and unauthorized use or disclosure of sensitive data) and Intellectual Property, which includes “eased exposure of trade secrets.”

3. Require a human check before output leaves the building

Whoever sends it owns it. Anything going to a customer, regulator, court, bank, or production system needs review by someone qualified to spot errors. NIST lists confabulation as a core generative AI risk for exactly this reason. “The AI wrote it” is not a defense, as the Mata lawyers learned.

4. Say who approves new uses

Name one owner for the policy and new AI requests. A good request covers three things: what tool, what data, and what job it does. NIST AI 600-1 recommends organizations “establish transparent acceptable use policies for GAI” (action GV-1.4-002).

5. Cover contractors and mistakes

NIST AI 600-1 (action GV-6.1-010) also says to update acceptable use policies to address “contractors, consultants, and other third-party personnel.” Your bookkeeper and your outsourced developers count. Then add a no-drama reporting rule: if someone pastes red data into the wrong tool, they report it quickly to the policy owner. You want the mistake on Monday, not discovered by a customer in March.

Rolling it out without eye-rolls

  • Keep it short. If it needs a table of contents, it’s too long.
  • Show examples. “Summarizing a public article: fine. Pasting a customer’s contract into a personal chatbot account: not fine.”
  • Walk through it live. Thirty minutes with real questions beats an e-signature nobody reads. Review it twice a year or when you add a major tool.
  • Offer a yes, not just a no. Samsung’s ban came with a plan: the company said it was building internal AI tools for translation, document summaries, and software development. A policy that only bans things pushes usage onto personal phones.

Conclusion

An AI acceptable use policy is not a legal trophy. It’s a short set of rules on approved tools, data limits, human review, and approvals. Write it, explain it, and update it as your tools change.

If you’d like help, Yellow Coop’s Chief Information Security Officer work includes an AI use policy: which tools, which data, who approves, and our Chief Technology Officer work includes an AI adoption plan tied to hours saved and headcount, not demos. You can get that through Virtual advisory hours or a Fractional engagement of 1 to 4 days a week. Book a first call to figure out which fits.

Sources