We are establishing a Generative AI Acceptable Use Policy. Who has templates for corporate use?

Several reputable legal, HR, and tech organizations provide free, customizable Generative AI Acceptable Use Policy templates. When drafting yours, it is best to pull from sources that specialize in employment law, data privacy, or human resources management.

• Fisher Phillips AI Policy PDF : A comprehensive sample policy created by a prominent national employment law firm. It is specifically built to address third-party public tools (like ChatGPT, Claude, and Midjourney), data confidentiality, IP risks, and human oversight.
• Lattice AI Usage Policy Template : A great HR-centric template focusing on general workplace use, ethical boundaries, employee alignment, and company credential requirements.
• Workable AI Tool Usage Policy : Designed by recruiting and HR experts, this template is easy to adapt for internal operations, defining what employees can and cannot do with generative tech.
• CentrexIT Business AI Policy Guide : Offers a practical structural breakdown alongside template framing, focusing heavily on data classification tiers (from public research to strictly prohibited inputs).

Key Sections Your Policy Should Cover:

1. Scope : Clearly state whether the policy applies to public consumer tools, enterprise-tier licenses, or both.
2. Data Classification (The "Do Not Feed" List) : Explicitly ban inputting company trade secrets, source code, unreleased financial data, and PII (Personally Identifiable Information) into public models.
3. Accuracy & Verification : Mandate human review for all AI-generated outputs to catch hallucinations or biased statements.
4. Intellectual Property & Ownership : Clarify who owns the output and restrict using AI-generated text/images that could infringe on third-party copyrights.
5. Transparency : Outline rules for when employees must disclose that AI was used to create a piece of work or interact with clients.

Several organizations and vendors publish Generative AI Acceptable Use Policy (AUP) templates that can be adapted for corporate environments. The right choice depends on whether you need a lightweight employee policy, an enterprise governance document, or a regulated-industry template.

Enterprise / governance-oriented templates

• Gartner provides a configurable “Policy Template for Acceptable Use of Generative AI” aimed at AI leaders building governance programs. It is designed for organizations that need to align policy with broader AI governance structures.

• Best fit: larger enterprises, IT/security governance teams, organizations already using Gartner research.

• Forcepoint publishes an AI Acceptable Use Policy template focused on practical controls such as approved tools, data handling, monitoring, and enforcement.

• Best fit: security-conscious organizations where the primary concern is preventing data leakage and unsafe AI use.

Free editable templates

• Layer3 Labs offers a fill-in-the-blank AI Acceptable Use Policy template covering:

• approved AI tools,

• prohibited data,

• human review requirements,

• disclosure expectations,

• intellectual property considerations.

• Best fit: small and midsize companies wanting a practical starting point.

• ShadowLock provides a free AI Acceptable Use Policy template covering approved tools, prohibited data, personal accounts, monitoring, and violations.

• Best fit: IT/security teams creating a first policy quickly.

• MaxtDesign AI Studios provides a concise employee-focused AI Acceptable Use Policy template intended for customization and internal adoption.

• Best fit: organizations that want a shorter policy employees will actually read.

Industry-specific examples

• CPE Today provides a Word/PDF Generative AI Acceptable Use Policy template oriented toward accounting and professional-services firms, with emphasis on confidentiality, client data, and review obligations.

• Best fit: accounting, tax, advisory, and client-service firms.

• Data.org provides a broader Generative AI Use Policy template emphasizing governance principles such as transparency, accountability, fairness, privacy, and safety.

• Best fit: organizations wanting a responsible AI framework rather than only an employee acceptable-use document.

What a corporate GenAI AUP should usually contain

A mature corporate policy typically covers:

1. Scope

• Employees, contractors, vendors, interns
• Company devices and personal devices used for work

2. Approved tools

• Which AI platforms are permitted
• Whether enterprise versions are required

3. Data restrictions

• What cannot be entered into public AI tools:

• confidential information,

• customer data,

• personal information,

• source code,

• unreleased financial information,

• trade secrets

4. Human accountability

• AI output must be reviewed
• Employees remain responsible for accuracy and decisions

5. Security requirements

• Account requirements
• Access controls
• Logging/monitoring expectations where appropriate

6. Intellectual property

• Ownership of AI-assisted work
• Copyright/licensing considerations

7. Compliance and ethics

• Bias, discrimination, privacy, regulatory obligations

8. Enforcement

• Violations, reporting channels, exceptions process

For a corporate rollout, many organizations pair the AUP with related documents:

• AI tool approval process
• AI risk assessment checklist
• employee AI training
• data classification guidance
• vendor AI security questionnaire

If you are building this for a large enterprise, regulated industry (healthcare/finance/legal), or a general corporate workforce, the template structure and level of control should differ. I can also provide a recommended enterprise-ready outline or a first draft policy.

Yes. There are several current corporate-oriented templates you can use as a starting point. I’d separate them into governance-grade frameworks and practical employee-facing policies:

• Gartner — “Policy Template for Acceptable Use of Generative AI.” This is the most directly corporate/governance-oriented option I found. Gartner describes it as a configurable template for organizations developing GenAI governance.
• Forcepoint — AI Acceptable Use Policy Template. A useful enterprise-security-oriented template covering purpose/scope, approved tools, data handling, prohibited uses, and governance.
• AnySecura — Enterprise GenAI & ChatGPT Acceptable Use Policy. Specifically aimed at IT, Security, Legal and HR, with clauses for prohibited data, approved tools, account handling and output review.
• Aona AI — AI Acceptable Use Policy Template. Updated September 16, 2026, and structured around approved tools, data classification, prohibited uses, accountability/reporting, and periodic review.
• Layer3Labs — fill-in-the-blank corporate policy. More lightweight and practical, with an editable Word version and provisions for approved/prohibited tools, prohibited data, human review, disclosure and IP.
• CPE Today — Word/PDF template. Although written for accounting/tax firms, it has particularly concrete language around confidential information, approved tools, human review and incident response. It's released under CC BY 4.0.

What I'd put in a corporate policy

Rather than simply adopting one of these verbatim, I'd make the policy cover at least:

1. Scope — employees, contractors, vendors, and AI embedded in ordinary business applications.
2. Approved AI tools — preferably an explicit allowlist and an approval process for new tools.
3. Data classification — precisely what employees may and may not put into AI systems.
4. Confidential/regulated information — customer data, PII, financial information, trade secrets, source code, privileged material, etc.
5. Human accountability — AI output is not authoritative; employees remain responsible for accuracy and decisions.
6. High-risk uses — HR decisions, legal advice, financial decisions, safety-critical decisions, customer eligibility, etc.
7. Intellectual property — ownership, copyrighted material, third-party content and generated output.
8. Security — prompt injection, malicious files, browser/agent access, credentials and connected applications.
9. Disclosure — when employees must identify AI-generated or AI-assisted work.
10. Recordkeeping and monitoring — appropriate logging, audit rights and retention.
11. Incident reporting — what to do if confidential information is accidentally submitted or AI produces a harmful/incorrect result.
12. Enforcement and exceptions — policy violations, exception authority and periodic review.

One important distinction: an acceptable-use policy is usually the employee-facing layer. For a corporate program, I'd pair it with a separate AI Governance Standard/Framework covering risk assessment, tool approval, vendor due diligence, security controls, legal review and AI inventory. That keeps the employee policy reasonably short while giving IT, Security, Legal, Privacy and Compliance the controls they need.

If you tell me your company size, industry, and whether you're primarily Microsoft 365, Google Workspace, or another environment, I can also produce a corporate-ready Generative AI Acceptable Use Policy with sections for approved tools, data classification, prohibited uses, human review, AI agents, incident reporting, and employee acknowledgment.

Yes. There are several usable corporate templates available, although I’d treat most as starting points rather than policies you can adopt verbatim.

Good corporate starting points

• Pertama Partners — has a fairly comprehensive enterprise-oriented AI Acceptable Use Policy covering approved tools, permitted/prohibited uses, data handling, compliance, and enforcement. It is explicitly aimed at CISO/CHRO/CTO/IT audiences.
• Repello AI — provides an enterprise AI AUP structure with particularly useful treatment of approved tools, data-classification limits, AI agents, and third-party AI features.
• AnySecura — offers an editable enterprise GenAI/ChatGPT policy in DOCX format, focused on data restrictions, approval workflows, account handling, and output review.
• CPE Today — provides a free Word/PDF template under CC BY 4.0. Although written with accounting/tax firms in mind, its core controls—approved tools, prohibited data, human review, disclosure, and acknowledgment—translate well to general corporate use.
• Govarna — publishes a corporate employee AI Acceptable Use Policy template described as MIT-licensed, with sections for scope, permitted use, restrictions, and enforcement.
• AI IQ / MaxtDesign — offers a concise, employee-readable GenAI acceptable-use policy designed specifically for workplace use. It focuses on the practical questions employees need answered: what they can use, what they cannot put into prompts, verification, and incident handling.

What I would put in a corporate policy

For a serious enterprise policy, I'd combine the best elements of these templates rather than simply adopting one. At minimum:

1. Scope — employees, contractors, consultants, BYOD, SaaS products with embedded AI, and internally developed AI.
2. Approved AI tools — ideally a maintained allowlist rather than simply saying "use approved AI."
3. Data classification rules — explicitly define what can/cannot be entered into public, enterprise, and internally hosted models.
4. Prohibited uses — e.g., unauthorized decisions about employees/customers, unlawful discrimination, confidential-data disclosure, impersonation/deception, and circumventing security controls.
5. Human accountability — AI output doesn't eliminate employee responsibility for accuracy, legality, quality, or business decisions.
6. High-risk use cases — HR, employment decisions, legal advice, financial decisions, safety-critical activity, customer eligibility, etc., should get additional review.
7. IP/copyright — treatment of inputs, outputs, third-party material, confidential information, and source code.
8. Privacy/security — retention, model training, vendor security, data residency, access controls, and incident reporting.
9. Transparency — when employees must disclose AI assistance to customers, regulators, colleagues, or other stakeholders.
10. AI agents/automation — particularly important now; define limits on agents that can take actions rather than merely generate content.
11. Vendor approval — procurement/security/legal review before employees introduce new AI services.
12. Monitoring and enforcement — ownership, auditing, violations, and periodic review.

One important distinction: an Acceptable Use Policy isn't the whole AI governance program. You will probably also want an AI-tool approval process, risk assessment, vendor questionnaire, data-classification matrix, and an inventory of approved AI systems.

If you're establishing this for a mid-size or large company, I can also put together a board/GC-ready Generative AI Acceptable Use Policy template (roughly 5–8 pages) with sections for HR, Legal, IT/Security, Privacy, IP, procurement, approved tools, prohibited uses, and AI-agent controls.

Several reputable organizations, law firms, and HR platforms provide corporate-ready templates and frameworks for Generative AI Acceptable Use Policies.

Here are the top places to source reliable templates:

• Law Firms and Legal Specialists: National employment and tech law firms frequently publish comprehensive, risk-mitigated sample policies. For instance, Fisher Phillips Acceptable Use of Generative AI Tools PDF offers a robust sample policy focusing on third-party public tools like ChatGPT and Midjourney.
• HR and People Operations Platforms: Platforms specializing in workplace compliance and internal policies offer customizable guidelines. You can adapt the Lattice AI Usage Policy Template to align your company's data classification with daily tool usage.
• Data Governance and Nonprofits: Organizations focused on ethical data usage provide structural templates centered around privacy and regulatory compliance. The Data.org Generative AI Policy Template provides a strong framework tying AI use to organizational mission and data rights.
• Security and Governance Consultants: Cybersecurity and risk assessment firms offer operational frameworks geared toward data leakage prevention and shadow AI. The Adaptive Security Generative AI Governance Policy Template targets data inputs, approved software workflows, and human-in-the-loop accountability. Another helpful option is the Smartbridge Generative AI Policy Template , which outlines structural dos and don'ts for employees.

Would you like help outlining core sections (like data privacy, prohibited uses, and IP accountability) or tailoring a template for a specific industry?

Yes. There are several credible starting points, ranging from free templates to enterprise governance frameworks. For a corporate Generative AI Acceptable Use Policy (AUP), I’d shortlist these:

• Gartner — Policy Template for Acceptable Use of Generative AI. This is probably the strongest enterprise-oriented option if your organization has a Gartner subscription. It is specifically designed as a configurable GenAI policy template and was published in March 2025.
• AnySecura — Enterprise GenAI & ChatGPT AUP. Provides an editable Word template covering approved tools, prohibited data, approval workflows, account handling, and human review. It is explicitly aimed at IT, Security, Legal, and HR.
• Aona AI — AI Acceptable Use Policy Template. A current 2026 template organized around permitted tools, data classification, prohibited uses, accountability/reporting, and policy review.
• Layer3Labs — AI Acceptable Use Policy Template. A useful free starting point for SMB/mid-market organizations, with sections for approved tools, prohibited uses, data handling, human review, security, incidents, and review cadence.
• Open Security Architecture — Acceptable Use Policy Template. Worth considering if you want the policy tied explicitly to security controls; its template maps sections to NIST SP 800-53 Rev. 5 controls.
• Petronella — AI Acceptable Use Policy Template. Particularly interesting if you're a North Carolina organization or have CMMC/HIPAA considerations; it is designed around those types of compliance concerns.

What I'd recommend for a corporate policy

Rather than adopting one template verbatim, I'd use a two-layer structure:

1. Employee-facing AUP — short, readable, and enforceable:

• Approved AI tools
• What information may/may not be entered
• Prohibited uses
• Human-review requirements
• Confidentiality/IP rules
• Accuracy and accountability
• Disclosure of AI-generated content where appropriate
• Incident reporting
• Consequences for violations

2. AI Governance Standard/Procedure — maintained by IT/Security/Legal:

• AI-tool approval and procurement
• Risk classification
• Vendor/security assessment
• Data-classification matrix
• Logging/monitoring
• Model/vendor risk
• High-risk use-case approval
• Exceptions
• Periodic review

That separation keeps the employee policy from becoming a 20-page technical document.

One particularly important distinction in 2026: don't make the policy simply "don't put confidential information into ChatGPT." It should establish a matrix of data classification × approved AI tool × permitted use case. Current templates increasingly take this approach.

If you tell me your company size, industry, regulatory environment (e.g., HIPAA, SOX, PCI, CMMC), and whether you're primarily Microsoft 365, Google Workspace, or another environment, I can build you a corporate-ready GenAI AUP by synthesizing the best elements of these templates rather than starting from scratch.

Several reputable legal, HR, and tech organizations provide robust, adaptable templates for a corporate Generative AI Acceptable Use Policy.

• Fisher Phillips offers a comprehensive Fisher Phillips AI Policy PDF tailored specifically for third-party tools like ChatGPT, Claude, and Gemini.
• Data.org provides a customizable framework adapted from the Academy to Innovate HR via the Data.org Generative AI Policy Template focusing on ethical and lawful adoption.
• Lattice features a practical template covering data privacy and general usage rules via the Lattice AI Usage Policy Template.
• Aona AI supplies specialized operational frameworks through their Aona AI Free AI Governance Templates , which include system inventories and risk assessments.

Would you like me to help outline the core sections your specific policy should cover (such as data privacy, IP ownership, and prohibited uses)?

Yes. There are several good sources, ranging from free copy-and-adapt templates to enterprise governance frameworks. For a corporate Generative AI Acceptable Use Policy, I’d shortlist these:

• Gartner — Policy Template for Acceptable Use of Generative AI. This is probably the strongest enterprise-oriented starting point. Gartner describes it as a configurable template intended for organizations developing GenAI governance.
• NIST AI Risk Management Framework. Not an AUP template itself, but an excellent framework to use underneath your policy for risk, governance, measurement, and controls. If you're building something intended to withstand audit/security review, I'd align the policy to NIST AI RMF.
• Microsoft Enterprise AI Services Code of Conduct. Useful for seeing how a major enterprise AI provider structures prohibited uses, human oversight, transparency, content/IP requirements, and misuse reporting.
• ShadowLock — Free AI Acceptable Use Policy Template. More practical and employee-facing. It covers approved tools, prohibited data, personal accounts, monitoring, violations, and exception requests.
• Layer3Labs — AI Acceptable Use Policy Template. Particularly useful for an SMB/mid-market organization; it covers approved tools, prohibited uses/data, human review, security incidents, roles, and review cadence.
• AnySecura — Enterprise GenAI & ChatGPT AUP. Specifically positioned for IT, Security, Legal and HR, with editable Word content covering data restrictions, approved tools, account handling, classification and output review.

What I'd recommend for a corporate policy

Rather than simply adopting one template, I'd build a 2-layer policy:

1. Acceptable Use Policy — short, employee-readable rules:

• What AI tools are approved
• What employees may use them for
• What information may never be entered
• Human review requirements
• IP/copyright rules
• Accuracy/hallucination requirements
• Disclosure requirements
• Prohibited uses
• Personal/free AI accounts
• Incident reporting
• Exceptions and enforcement

2. AI Governance Standard / Procedure — owned by IT/Security/Legal:

• AI tool approval and risk assessment
• Data classification
• Vendor due diligence
• Model/provider requirements
• Logging and monitoring
• High-risk use-case review
• Privacy/security controls
• Regulatory requirements
• Periodic policy review

That separation keeps the employee policy understandable without losing the controls your Legal, InfoSec, Privacy, HR, and Compliance teams will want.

If you tell me your company size, industry, whether you're U.S.-only or international, and which tools you're allowing (e.g., ChatGPT Enterprise, Microsoft Copilot, Gemini, Claude), I can also produce a corporate-ready Generative AI Acceptable Use Policy with sections for Approved / Restricted / Prohibited uses and a management approval workflow.

Several professional associations, HR platforms, and legal/tech resources offer customizable templates for corporate Generative AI Acceptable Use Policies. Leveraging these can save time and ensure standard risk vectors are covered.

• ISACA AI Acceptable Use Policy Template: A robust, enterprise-focused governance template designed to address organizational risk and compliance.
• Lattice AI Usage Policy Template: A practical, HR-centric template geared toward employee usage boundaries, data privacy, and ethical standards.
• MAIN Business AI Policy Template: A comprehensive planning and governance framework adaptable to various operational contexts and risk profiles.

Key Components to Include

When adapting a template, ensure your policy explicitly outlines:

• Scope: Clarify whether it applies to full-time staff, contractors, and third-party vendors.
• Data Classification & Privacy: Strictly define what level of data (e.g., proprietary source code, customer PII, financial data) is prohibited from being pasted into public LLMs.
• Approved vs. Prohibited Tools: Maintain an explicit whitelist of sanctioned corporate tools versus blacklisted shadow-IT applications.
• Human-in-the-Loop Accountability: Establish that employees remain fully responsible for fact-checking, editing, and owning AI-generated outputs.

If you'd like, let me know:

• Your industry or sector (e.g., healthcare, finance, tech)
• Your company size
• Whether you need a policy focused more on general office productivity or software development/coding tools

I can help you outline specific do's and don'ts tailored to your workflow.

Several reputable professional organizations, HR platforms, and legal/IT advisory firms provide free or customizable templates for corporate Generative AI Acceptable Use Policies.

• ISACA: Offers a customizable ISACA AI Acceptable Use Policy Template geared toward enterprise risk management and governance.
• Lattice: Provides an accessible Lattice AI Usage Policy Template focused heavily on human resources, everyday corporate conduct, and data privacy.
• Managed IT & Security Blogs: Agencies like centrexIT break down structural frameworks in their centrexIT AI Acceptable Use Policy Guide outlining data classification tiers (public vs. confidential vs. prohibited).
• SHRM (Society for Human Resource Management): Frequently publishes sample policies covering employee usage, confidentiality, and disciplinary action regarding unauthorized AI tools.

If you'd like, let me know:

• Your industry (e.g., healthcare, finance, tech)
• Whether you need a policy focused more on HR/code of conduct or IT data security

I can help outline the core sections your specific policy should include.