The first part of the template, as it reads in Word. Blanks are shown as lines; the drafting notes sit in the margin of the file.
AI ACCEPTABLE USE POLICY
____________________ LTD (the “Company”) Version ____ Effective ______________ Policy owner: ____________________
1. Purpose and scope
1.1 This policy sets out how everyone who works for the Company (employees, contractors, interns and advisers) (“you”) may use artificial intelligence tools for work, so that the Company gets the benefit of AI while protecting its data, its customers, its intellectual property and its legal position.
1.2 “AI Tool” means any software or service that generates text, code, images, audio or video, or makes predictions or recommendations, using machine learning, including large language models, chatbots, AI coding assistants, AI meeting note-takers, transcription tools and AI features built into other software. It applies to tools provided by the Company and to personal accounts used for work.
2. Approved tools
2.1 You may use only the AI Tools in the “Approved” list in Schedule 1, and only for the purposes stated there. You must not use any other AI Tool for work, or any personal AI account for work, without approval from the Policy Owner.
2.2 To request a new tool, send the Policy Owner the name, the purpose, the data it would touch and a link to its terms and privacy information. The Policy Owner will assess it (and, where personal data or a high-risk use is involved, a data protection impact assessment) and tell you the decision.
3. What you must not put into an AI Tool
3.1 Unless the tool is approved for that category of data in Schedule 1, you must not enter: (a) personal data about customers, employees, candidates or other individuals; (b) special category data (health, race, religion, biometric, sexual orientation, trade union membership) or criminal offence data, in any tool; (c) customer or partner confidential information, or information covered by an NDA; (d) the Company’s trade secrets, source code, unreleased product plans, financial information or investor information; (e) passwords, API keys or security credentials; or (f) legally privileged material.