We are implementing a "Generative AI policy" for employees. Who has templates for acceptable use?

Yes. There are several useful starting points, ranging from formal governance guidance to ready-to-edit employee policies.

• NIST — AI RMF / Generative AI Profile. NIST is the strongest neutral foundation I’d use for the governance principles behind the policy. Its Generative AI Profile (NIST AI 600-1) identifies risks and suggested risk-management actions; it is designed to be adapted to an organization’s particular risk tolerance and use cases.
• Forcepoint — AI Acceptable Use Policy Template. A current, copy-and-adapt template covering purpose/scope, approved use, data handling, human review, and governance.
• NeedToKnowAI — AI Acceptable Use Policy Template. Particularly useful for an employee-facing policy: it covers employees/contractors, confidential and personal information, IP, and AI features embedded in other software—not just standalone ChatGPT-style tools.
• AI IQ — Free AI Acceptable Use Policy. A shorter template explicitly organized around what employees may use AI for, prohibited data, accountability for checking outputs, and incident handling.
• Workspace Migration Services — Acceptable Use Policy. More general than an AI-only policy, but its template explicitly includes generative-AI prompts/outputs alongside accounts, files, devices, and monitoring.

What I'd put in your employee policy

For a practical Generative AI Acceptable Use Policy, I'd make it relatively short and answer these questions clearly:

1. What AI tools are approved? Specify whether employees may use ChatGPT, Copilot, Gemini, Claude, embedded AI features, etc., and whether personal accounts are permitted.
2. What information may employees enter? Define categories such as public, internal, confidential, regulated/personal, and highly sensitive information.
3. What uses are allowed/prohibited? Examples: drafting, brainstorming, summarization, coding assistance, translation vs. making employment decisions, submitting unverified AI output to customers, or generating material that violates existing company policies.
4. Human review. Employees remain responsible for checking accuracy, confidentiality, bias, citations, and appropriateness before using AI-generated material.
5. Privacy, security, and IP. Address customer data, employee data, trade secrets, copyrighted material, credentials, source code, and ownership/licensing concerns.
6. Disclosure. State when employees must disclose AI assistance to customers, colleagues, regulators, or other stakeholders.
7. High-risk uses. Require additional approval for HR decisions, legal advice, financial decisions, safety-critical work, regulated activities, or automated decisions affecting individuals.
8. Incident reporting. Give employees a simple route for reporting accidental disclosure of sensitive information, harmful output, security problems, or suspected policy violations.
9. Approved-tool exceptions. Explain who can authorize a new AI service and what review is required.
10. Review/update cycle. AI tools change rapidly, so specify an owner and periodic review rather than treating the policy as permanent.

A good approach is to use NIST for the governance backbone and one of the employee-facing templates for the actual policy language. NIST explicitly says its framework is voluntary and intended to be adapted to an organization's goals, requirements, and resources.

If you tell me your company size, industry, and whether you're primarily using Microsoft 365/Copilot, Google Workspace/Gemini, ChatGPT, or a mix, I can draft a 1–2 page employee-ready Generative AI Acceptable Use Policy tailored to you.

Several reputable legal firms, human resources platforms, and data governance organizations offer free, adaptable templates and frameworks for employee generative AI acceptable use policies.

Where to Find Templates and Frameworks

• Fisher Phillips AI Policy Sample : Provides a legal-focused sample policy outlining restrictions on uploading confidential company data and using AI for automated employment decisions.
• Data.org Generative AI Policy Template : Offers a structured organizational template focusing on human-in-the-loop oversight, data privacy, and a clear "Do's and Don'ts" framework.
• Wizer AI Policy Kit : Provides a practical employee-facing policy template bundled with awareness training elements designed to bridge IT security and daily operations.

Standard Practices & Key Elements to Include

1. Data Privacy & Confidentiality : Explicitly ban entering proprietary source code, non-public financial data, personal identifiable information (PII), or trade secrets into public-facing AI tools.
2. Human-in-the-Loop Verification : Require mandatory human review for any AI-generated output (code, copy, legal/medical advice) to catch hallucinations, bias, or factual errors.
3. Prohibited Use Cases : Restrict using generative AI for high-stakes employment actions (hiring/firing), making definitive medical/legal decisions, or misrepresenting AI-generated work as entirely human-created where transparency is required.
4. Approved Tool Registry : List specific platforms your company has vetted and approved (e.g., enterprise-tier versions with data-privacy guarantees) versus banned tools.

Common Pitfalls to Avoid

• Overly Restrictive Bans : Total bans often drive employees to use unauthorized tools "under the radar" (shadow IT). Instead, focus on how and where tools can be safely used.
• Ignoring Vendor Data-Sharing Defaults : Failing to specify that free consumer tiers of AI chatbots may train on user inputs, whereas enterprise/paid tiers protect data privacy.
• Lack of Training : Implementing a written policy without explaining the why behind data leakage and hallucinations to your staff.

To help narrow down the right framework for your team, let me know:

• What is your industry (e.g., healthcare, tech, finance, education)?
• Do you plan to allow public AI tools (like ChatGPT/Claude) under specific conditions, or limit employees strictly to enterprise-licensed software?

Yes. There are several good starting points, ranging from government-issued policies to lightweight company templates.

• Massachusetts — Enterprise GenAI Policy: The Commonwealth published an enterprise policy covering acceptable use, risk management, transparency, accountability, and prohibited/high-risk considerations. It is particularly useful if you're a Massachusetts organization and want a public-sector-style baseline.
• City of Boston — GenAI Policy: A very practical employee-facing example. It covers employee accountability, unacceptable uses, human review, approved tools, and guidance for new use cases.
• Texas DIR — AI Acceptable Use Policy: The Texas Department of Information Resources explicitly provides its employee AI acceptable-use policy as a template/resource for other organizations.
• NIST: Rather than a ready-made employee policy, NIST's AI Risk Management Framework and Generative AI Profile are useful foundations for deciding what your policy should address.
• Commercial templates: There are several current, copy-and-adapt templates from vendors such as Forcepoint and others.

What I'd put in an employee policy

A practical policy usually needs only 8–10 sections:

1. Purpose and scope — who and what AI tools are covered.
2. Approved tools — which AI products employees may use for company work.
3. Data restrictions — what cannot be entered into AI systems (confidential information, credentials, sensitive personal data, client information, etc.).
4. Acceptable uses — drafting, brainstorming, summarizing non-sensitive material, research, coding assistance, translation, etc.
5. Prohibited uses — impersonation, deceptive content, unauthorized decision-making about employees/customers, and bypassing security controls.
6. Human review — employees remain responsible for checking accuracy, bias, confidentiality, copyright/IP issues, and appropriateness.
7. Disclosure/attribution — when AI assistance must be disclosed internally or externally.
8. Security and privacy — account requirements, plugins/extensions, personal accounts, retention, and incident reporting.
9. Third-party/customer work — restrictions imposed by contracts or customer requirements.
10. Governance — policy owner, exception process, training, and review cadence.

For an employee-facing policy, I'd use the Boston/Massachusetts policies as the substantive reference points but make the actual document much shorter—ideally 2–3 pages that employees can actually read.

If you tell me your company size, industry, and which AI tools you're allowing (e.g., ChatGPT, Copilot, Gemini, Claude), I can draft a ready-to-adopt employee Generative AI Acceptable Use Policy.

Several reputable HR organizations, law firms, and tech governance groups provide public or member-accessible templates for employee generative AI policies.

• SHRM (Society for Human Resource Management) : Offers a customizable SHRM Generative AI Usage Policy Template focused on core workplace security, compliance, and responsible innovation.
• Fisher Phillips : A prominent national employment law firm that provides a free, comprehensive Fisher Phillips Acceptable Use of Generative AI Tools Sample Policy PDF tailored for third-party tools like ChatGPT and Midjourney.
• Data.org : Provides a framework via the Data.org Generative AI Policy Template focusing heavily on human-in-the-loop collaboration, transparency, and data ethics.
• Protecto : Offers practical breakdowns and examples on the Protecto AI Acceptable Use Policy Guide detailing data classification rules (like blocking PII or source code).

If you'd like, I can help you draft a custom do's and don'ts list or outline specific rules for data privacy and human review tailored to your company's industry. Let me know what your primary concern is (e.g., data leaks, copyright, or output accuracy).

Yes. There are several solid starting points, and I’d favor SHRM if this is primarily an employee/HR policy, supplemented by a security/governance framework.

• shrm.org — probably the best-known HR-oriented starting point. It is specifically designed as a workplace generative-AI usage policy.
• shrm.org — newer (May 2026) and broader than an employee acceptable-use policy; useful if you're also establishing governance, ownership, approvals, and oversight.
• shrm.org — useful guidance on the actual rules. It discusses confidentiality, approved tools, human judgment, and avoiding an overly restrictive blanket ban.
• layer3labs.io — more IT/security-oriented, with sections for approved tools, prohibited data, human review, disclosure, IP, and employee acknowledgment.
• cpetoday.com — particularly useful if you're in a regulated/professional-services environment; it emphasizes approved enterprise tiers, a "never paste" data list, and human review.

What I'd put in your policy

Rather than simply saying "don't use ChatGPT," I'd make the policy answer seven practical questions:

1. What AI tools are approved?
2. What information may employees put into them?
3. What information is prohibited? — e.g., confidential company information, customer PII, credentials, trade secrets, unreleased financial information.
4. What uses are allowed, restricted, or prohibited?
5. When is human review mandatory?
6. When must AI assistance be disclosed?
7. Who approves exceptions and new AI tools?

SHRM's guidance specifically notes that organizations commonly prohibit putting confidential information into generative-AI services and recommends treating inputs cautiously rather than assuming the tool is private.

If you tell me your industry, approximate company size, and whether you use Microsoft 365/Copilot, Google Workspace/Gemini, ChatGPT Enterprise/Business, etc., I can also compare the best templates and give you a 1–2 page employee-ready policy tailored to your environment.

Several reputable legal, HR, and technology organizations provide free, customizable templates and guidelines for employee Generative AI acceptable use policies.

Here are the top sources offering reliable templates:

• Fisher Phillips — Offers a comprehensive legal perspective geared toward third-party tools (like ChatGPT or Midjourney) via their Fisher Phillips AI Policy PDF.
• Data.org — Provides a well-structured framework focusing on responsible human-AI collaboration, data ethics, and practical do's and don'ts through their Data.org Generative AI Policy Template PDF.
• MangoApps — Features an HR-centric framework designed for everyday workplace workflows, data privacy, and output reviews available at MangoApps Acceptable Use of AI Policy Template.
• SHRM (Society for Human Resource Management) — Frequently updates members with foundational workplace technology policies, including generic guidelines on generative AI implementation and data security.

If you'd like, let me know:

• Your industry or sector (e.g., healthcare, finance, tech)
• Whether you want a policy that is permissive (encouraging tool use) or restrictive (limiting public tool access)

I can help outline the core sections you should prioritize.

Yes. There are several good starting points, and I’d distinguish general employee acceptable-use policies from industry-specific templates.

• SHRM — Generative AI Usage Policy Template: probably the best first stop if this is an HR/employee policy. It provides a workplace-oriented template and is specifically designed around employee use of generative AI.
• Microsoft — How to create an AI policy employees can follow: useful as a framework rather than a copy-paste policy. It recommends covering approved tools, acceptable/prohibited uses, data protection, human review, training, and escalation.
• Montague Law — Generative AI Workplace Policy: a more comprehensive enterprise template covering approved tools, risk tiers, data classification, IP, employment decisions, procurement, security, and incident response.
• Layer3Labs — AI Acceptable Use Policy Template: a concise, editable template explicitly covering approved tools, prohibited data, human review, disclosure, and IP ownership.
• PertaMa Partners — AI Acceptable Use Policy: particularly focused on making the policy something employees can actually follow; it recommends keeping the employee-facing AUP to roughly 2–3 pages and emphasizes approved tools, confidential-data restrictions, and output verification.

What I'd put in your policy

For a typical company, I'd make the employee-facing policy relatively short and cover:

1. Approved AI tools — what employees may use and who approves new tools.
2. Acceptable uses — brainstorming, drafting, summarization, coding assistance, research, etc.
3. Prohibited uses — entering confidential/customer data into unapproved tools; generating deceptive content; circumventing security controls; making certain employment or business decisions without required human review.
4. Data handling — a very clear "never paste" list for PII, secrets, customer information, regulated data, source code, contracts, etc.
5. Human accountability — employees remain responsible for checking AI output for accuracy, bias, IP issues, and inappropriate content.
6. Disclosure/transparency — when employees need to disclose AI assistance to customers, regulators, or colleagues.
7. IP and copyright — don't assume AI-generated material is automatically free of third-party rights.
8. Security and privacy — use enterprise-approved accounts/configurations rather than personal/free accounts.
9. High-impact decisions — additional controls for hiring, firing, promotion, performance evaluation, credit, legal, medical, or other consequential decisions.
10. Incident/escalation process — who to contact if someone accidentally puts sensitive information into an AI system.
11. Training and acknowledgment — short mandatory training plus employee acknowledgment.
12. Review cadence — update the policy as tools and regulations change.

My recommendation: use SHRM + Microsoft as the baseline for a normal corporate employee policy, then add your organization's specific data-classification and security requirements. Don't simply adopt a generic template verbatim; the biggest value is making the "what can I actually paste into ChatGPT/Copilot/Claude?" rules unambiguous.

If you tell me your industry, company size, and whether you're mainly using ChatGPT/Copilot/Claude or several tools, I can also give you a ready-to-adopt 2–3 page Generative AI Acceptable Use Policy.

Several reputable legal, HR, and technology organizations provide free, customizable templates and guidelines for employee generative AI acceptable use policies.

• Fisher Phillips Sample Policy : A comprehensive legal sample policy from employment law firm Fisher Phillips that targets third-party tools like ChatGPT, Claude, and Midjourney.
• Data.org Generative AI Policy Template : A detailed framework focusing on human-AI collaboration, data privacy, and ethical guardrails.
• MangoApps Acceptable Use of AI Policy Template : An HR-focused template outlining rules for confidential business data, review standards, and approved workflows.
• SHRM (Society for Human Resource Management) : Offers guidance articles and compliance toolkits for members looking to draft internal AI rules and handbook additions.

Would you like me to outline the core sections every good generative AI policy should include (like data privacy, prohibited uses, and disclosure requirements) to help you customize one of these templates?

Several reputable organizations, legal firms, and tech platforms provide free, downloadable generative AI acceptable use policy templates that you can customize for your employees.

Where to Find Templates

• TechSoup AI Usage Policy : Offers an accessible policy framework tailored for nonprofits and small organizations, focusing on responsible use, data protection, and mitigating bias.
• Michalsons Generative AI Policy : Provides a comprehensive, free template covering scope, approved tools, data privacy, and copyright compliance.
• Witness.ai Policy Guide : Breaks down core structural components like data security, acceptable use cases, and IP ownership to help you draft your own framework.
• Dan Cumberland Labs Template : Offers a practical, startup-friendly roadmap and template that balances innovation with risk management.

Core Sections to Include

When adapting any template, make sure your final policy clearly defines:

• Scope and Approved Tools : Explicitly state which platforms are allowed (e.g., enterprise versions with data privacy) versus banned.
• Data Privacy & Confidentiality : Prohibit pasting customer PII, source code, or proprietary financial data into public models.
• Human Oversight : Require employees to review and verify all AI-generated facts, code, or content before publication or deployment.
• Intellectual Property : Clarify rules regarding copyright ownership and attribution for AI-assisted work.

If you'd like, let me know:

• Your industry (e.g., healthcare, finance, tech, nonprofit)
• Your company size

I can help you outline specific rules tailored to your regulatory environment.

Yes. There are several solid starting points, ranging from HR-oriented templates to security/compliance-focused ones.

Best places to start

• shrm.org — Probably the best fit if your policy is primarily employee-facing. It provides a practical workplace policy covering appropriate use of tools such as ChatGPT. SHRM also has a newer, more comprehensive shrm.org published in May 2026.
• aona.ai — A recent employee-focused template covering approved tools, data classification, prohibited uses, compliance, accountability, incident reporting, and review cycles.
• menturi.com — Particularly useful if you want both a short employee policy and a more detailed version. It addresses approved tools, confidential data, human review, disclosure, and incident reporting.
• layer3labs.io — A straightforward template emphasizing approved/prohibited tools, data that cannot be entered, human review, IP/confidentiality, and employee acknowledgment.
• makologics.com — Worth considering if you're a smaller organization and want something directly addressing ChatGPT, Copilot, Claude, Gemini, and similar tools.

What I'd include in your policy

I wouldn't simply adopt a generic "don't put confidential information into ChatGPT" policy. A good 2026 employee policy should clearly answer:

1. Which AI tools are approved — and who approves new ones.
2. What data employees may enter — e.g., public, internal, confidential, regulated/PII.
3. Prohibited uses — including making consequential employment decisions without appropriate human oversight.
4. Human review — employees remain accountable for AI-generated work and must verify material outputs.
5. Intellectual property/confidentiality — particularly customer data, source code, trade secrets, and copyrighted material.
6. Disclosure — when employees must identify AI-generated content to customers, colleagues, or the public.
7. Personal accounts — whether employees can use consumer/free AI accounts for company work.
8. Security — prompt injection, malicious files, credentials/secrets, and AI-generated code.
9. Incident reporting — what to do if confidential information is accidentally submitted.
10. Enforcement and exceptions — owner, approval process, violations, and review cadence.

For an organization starting from scratch, I'd use SHRM's employee-facing template as the HR baseline, then supplement it with the security/data-control language from a more technical AUP. Microsoft's current enterprise AI code of conduct is also useful as a reference for concepts such as human oversight, transparency, and restrictions on harmful or consequential uses.

If you tell me your company size, industry, and whether you use Microsoft 365, Google Workspace, or both, I can also give you a ready-to-adopt 1–2 page Generative AI Acceptable Use Policy rather than just a template list.