The AI Acceptable Use Policy Every Growing Company Needs

A 70-person company buys AI licenses for the sales team on a Monday. By Friday, finance is using a free chatbot to summarize a vendor contract, an account manager has uploaded a client spreadsheet to a transcription tool, and nobody can say which of these is allowed. No one broke a rule, because there was no rule to break.

An AI acceptable use policy fixes that. It is a short document that tells staff which AI tools they may use, what company data may go into them, and who to ask when the answer is unclear. It is the cheapest control a growing company can put in place, and it should exist before the rollout, not after the first incident.

Why a policy comes before the tools

Staff adopt AI faster than companies write rules for it. When no approved option exists, people use personal accounts and free tools to get their work done, and company data goes with them.

IBM's 2025 Cost of a Data Breach research found that organizations with a high level of unsanctioned AI use paid about $670,000 more per breach than organizations with little or none. The same research found that only 37% of organizations had policies to manage AI or detect unsanctioned use. Roughly one in five organizations reported a breach tied to shadow AI. These are averages across organizations of all sizes, so treat the dollar figure as a signal of direction, not a forecast for your company.

NIST points the same way. Its Generative AI Profile (NIST AI 600-1, published July 2024) lists data privacy and information security among the 12 risks specific to or worsened by generative AI, including leakage of personal or sensitive data. A written policy is the first step in managing both.

What a good AI acceptable use policy covers

Keep the policy to two or three pages. A policy nobody reads protects nobody. Cover these eight areas, in plain language.

1. Approved tools

List the AI tools the company has reviewed and allows, by name and by account type. "Our Microsoft 365 Copilot license" is an approved tool. "Any free chatbot" is not. State that work use requires a company-managed account, not a personal one.

2. Data rules

This is the most important section. Sort company information into simple tiers and say what each tier may do:

Data tier	Examples	AI tool rule
Public	Published web copy, marketing text	Any approved tool
Internal	Meeting notes, draft plans	Approved tools only
Confidential	Client data, contracts, financials	Only tools with approved data terms
Regulated	Health, payment, personal records	Not permitted unless security approves

Three or four tiers is enough. If staff cannot tell which tier a document falls in within a few seconds, the tiers are too complicated.

3. Permitted and prohibited uses

Say what AI is good for at your company: drafting, summarizing, brainstorming, code assistance. Then name the uses that need a human decision, such as hiring screens, performance reviews, legal advice, or anything sent to a client without review.

4. Human review

AI output can be wrong, and it can sound sure while being wrong. Require a person to check anything that reaches a client, a regulator, or a financial record, and make clear that the person who sends it owns it.

5. Vendor review

Before a new AI tool becomes approved, someone checks how the vendor handles data: whether it keeps prompts, whether it trains on them, where it stores them, and whether business accounts get different terms than free ones.

6. Security requirements

Approved tools should sit behind company sign-in with multi-factor authentication, so access ends when someone leaves. Connections that let an AI tool read email, files or calendars need approval, because they grant standing access to a lot of data.

7. Reporting

Tell staff what to do if they paste something they should not have. Make the path simple and free of blame. People who fear punishment hide mistakes, and a hidden mistake is the one that grows.

8. Ownership and review

Name one person who owns the policy and a date when it gets reviewed. AI tools and their terms change quickly, so a yearly review is the minimum. Twice a year is better.

Elevaire publishes a free AI acceptable use policy template that follows this structure, so you can edit instead of starting from a blank page.

How to roll it out in a week

A policy only works if staff know it exists and can follow it. A simple sequence works for a company of 25 to 200 people.

1. Day 1: Find out what is already in use. Ask staff directly, and check what shows up in sign-in logs and browser extensions. Expect surprises, and do not treat them as misconduct.
2. Day 2: Decide on the approved tools and the data tiers. Keep the first list short.
3. Day 3: Edit the template to match, and have leadership sign off.
4. Day 4: Brief managers first. They field the questions, so they need the answers before their teams do.
5. Day 5: Share the policy with all staff along with a 15-minute walkthrough and two or three real examples of what is and is not allowed.

After the first week, add the policy to new-hire onboarding and mention it in your regular security training.

Why a policy alone is not enough

A written policy sets the expectation. It does not stop a tired employee from pasting a client list into a free tool at 5 p.m. Pair it with controls that make the right behavior easy:

• A company-approved AI option that is as convenient as the free one
• Sign-in controls that tie approved tools to company accounts
• Web filtering or monitoring that flags unapproved AI services
• Limits on what connected AI tools can read in email and file storage
• Short, recurring training with real examples

Banning AI outright tends to push use out of sight. A policy that names good options and clear limits usually gets better compliance than a blanket no.

How managed security supports the policy

Most growing companies do not have anyone whose job is to write this policy, pick the controls, and check that they work. That is the gap Elevaire Managed Security fills. Elevaire manages the sign-in controls, email security, web filtering, device management and security training that make an AI policy enforceable, and it works alongside your existing IT provider or internal team rather than replacing it.

The policy itself, along with vendor assessments, risk decisions and leadership reporting, falls under virtual CISO work.

Example engagement: a 90-person consulting firm wants to roll out an AI writing assistant to every employee. Elevaire would inventory the AI tools staff already use, draft a data-tier policy with leadership, review the vendor's data terms, require company sign-in with multi-factor authentication, block the riskiest unapproved services, and cover the policy in the next round of security training.

For a quick read on where your company stands today, the free Security & AI Risk Scorecard takes a few minutes.

Frequently Asked Questions

Do we really need an AI policy if we only use one or two tools?

Yes. Even a small AI footprint raises the same questions about client data, vendor terms and who is accountable. A short policy now is easier to write than one built after an incident, and it gives you a clear answer when a client asks how your company handles AI.

What should an AI acceptable use policy include?

At minimum: approved tools, data rules by sensitivity, permitted and prohibited uses, human review requirements, vendor review, security requirements, a reporting path, and a named owner with a review date. The template linked above covers each of these.

How much does it cost to put an AI policy in place?

Writing a policy costs mostly time, and a template cuts that to days. Enforcing it takes controls such as managed sign-in, web filtering and training. Elevaire Managed Security is delivered with predictable monthly pricing and no hourly billing, so the controls do not turn into an open-ended project.

How does this work alongside our existing IT provider?

Elevaire works with your current IT provider or internal team. Your IT provider keeps running day-to-day systems, and Elevaire handles the security controls, policy and oversight around AI use. If you have no IT support at all, the Complete package brings in a vetted IT partner.

How do we get started?

Start by asking staff which AI tools they use today. Then pick a short approved list, sort your data into three or four tiers, and edit the template. If you want help with the controls and the rollout, book a Risk Snapshot and Elevaire will walk through where you stand.

How often should we update the policy?

Review it at least once a year, and again whenever you approve a new tool or a vendor changes its data terms. A named owner and a calendar date keep the review from slipping.