AI acceptable use policy template for small teams
Decide how your team may use AI at work, and turn those decisions into a policy people can actually follow.
This free workbook walks you through eleven policy areas with suggested baseline wording, then assembles an employee-facing policy, an approved-tools appendix and a simple approval and rollout record.
6 worksheets · 11 policy areas · Approved-tools appendix · Not legal advice
The problem
Your team already has AI rules. They’re just unwritten.
Every person is deciding for themselves which tools to use, what to paste in, and how much to check. That works right up until it doesn’t.
Everyone uses a different tool, on a personal account
A client list gets pasted into a chatbot
AI-written copy goes out unchecked
Nobody knows who to ask, so nobody asks
A connected agent sends something it shouldn’t
Definition
What is an AI acceptable use policy?
A short set of workplace rules for using AI on company work: which tools are approved, for which tasks, with what information, who checks the output, and who to tell when something goes wrong.
For a small team it should fit on a few pages, and come with a clear list of which tools are approved for what.
What it covers
Eleven decisions, each with a sensible default.
Every area comes with suggested baseline wording. Keep it, or replace it with your own, then mark it reviewed. Only reviewed areas reach the issued policy.
In practice
Same AI. Different information.
From the workbook’s fictional example: what decides the answer is usually the information involved, not the tool.
Potentially allowed in an approved tool
Marketing outline
- Proposed use
- Brainstorm from published industry articles
- Information
- Public materials
- Expected rule
- A person reviews the outline before it is used.
Not allowed under the baseline rules
Client contact list
- Proposed use
- Upload contacts to a personal AI account
- Information
- Private customer records
- Expected rule
- No client list uploads without specific authorisation and safeguards.
The important part
Approving a tool isn’t approving everything.
The approved-tools appendix lists each tool with the account to use, the tasks it is approved for, and the most sensitive information it may handle. Anything not listed needs asking first.
Maximum data category
- 1Approved tool or service
- 2Approved account or workspace
- 3Permitted tasks
- 4Maximum data category
- 5Authorised users or roles
- 6Required safeguards
- 7Responsible owner
- 8Review date
How to build it
From decisions to an issued policy.
The workbook only reports the policy as ready for approval once every decision is complete. A readiness message is still not approval: that takes an authorised person.
- 01
Set the scope
Who the policy covers, the activities in scope, the owner, the approver, the dates and the contacts.
- 02
Decide the rules
Review all 11 areas. Keep the baseline wording or write your own, then mark each one reviewed.
- 03
List approved tools
Declare that no tools are approved yet, or record each tool with its accounts, tasks, data limits and safeguards.
- 04
Read the policy
The employee-facing policy assembles itself. Check it for clashes, gaps and wording that doesn’t fit.
- 05
Approve it
Record the management review and the formal approval by the person authorised to give it.
- 06
Roll it out
Share the policy and the appendix, record how and when, and schedule the next review.
Rollout & review
A policy nobody received doesn’t exist.
The last sheet records that the policy was reviewed, approved by the right person, shared with the team, and scheduled for its next review, with a change log for every version after.
This is a customisable template, not legal, privacy, employment or security advice. Confirm the requirements that apply to you before issuing it.
Release controls
- Employee policy reviewed in full
- Approved-tools appendix checked
- Alignment with existing policies and contracts
- Approval decision, approver and date
- Distribution method and date
- Acknowledgment, if your team collects it
- Next policy review date
The workbook
Write the rules down once. Keep them current.
Everything above is on this page for free. The workbook does the part a webpage can’t: assemble your decisions into an employee-facing policy, generate the approved-tools appendix, and track approval and review.
small-team-ai-acceptable-use-policy-template.xlsx
XLSX · 6 worksheets
Enter your email and we’ll send the template straight to your inbox. Free, no account, no card.
We may email you occasionally for feedback, or to tell you about new Cognardo resources. Unsubscribe any time.
Where it helps
Built for teams without a policy department.
Small businesses
A first AI policy without hiring a consultant to write one.
Agencies and consultancies
Clear rules for client data, before a client asks about them.
Startups
Set expectations early, while the team is still small.
Non-profits
Protect donor and beneficiary information while using AI to save time.
Teams adopting new tools
Approve a tool for specific tasks and data, not everything.
Annual review
Re-check the rules and the appendix as tools and risks change.
Keep it where you work
Share approved prompts, not just approved tools.
Once the rules are set, the next step is consistent, approved ways of working. Workbench is our browser extension for exactly that — keep prompts and context organised, fill the variables in a form, and run them without leaving ChatGPT, Claude or Gemini.
FAQ
Questions, answered.
What is an AI acceptable use policy?+
A set of workplace rules for how people may use AI for company work: which tools and accounts are approved, what tasks they may be used for, what information may and may not be entered, who checks the output, and who to ask or tell when something goes wrong.
Does a small team really need an AI policy?+
If anyone on the team uses AI for work, the rules exist already. They are just unwritten and different for each person. A short written policy makes the expectations clear, especially around client and personal data, before a mistake makes them clear for you.
Is this legal advice?+
No. It is a management tool with suggested baseline wording. Before you approve it, check your privacy, security, employment, contractual and sector requirements, and get qualified advice where they apply. Only your organisation’s authorised approver can issue the policy.
Can staff use their personal ChatGPT accounts for work?+
That is your decision to make, and the policy makes you make it. The baseline rule is to use only the tools and accounts listed in the approved-tools appendix. Approving a tool also means stating which tasks and which categories of information it may be used for.
What should employees never put into AI tools?+
Under the baseline rules: confidential, personal, sensitive or regulated information without documented authorisation, and client or third-party information unless that specific use has been authorised and the relevant contracts checked. When in doubt, don’t.
How do we handle AI agents and automations?+
Separately and carefully. Anything that can send messages, publish, spend money, change records or disclose data needs specific prior approval, least-privilege access, defined limits and human confirmation for consequential actions.
How often should the policy be reviewed?+
On the review date you set, and sooner whenever approved tools, working practices, client requirements or risks change materially. Update the approved-tools appendix whenever access, purposes or safeguards change, and tell staff.