Key Takeaway: Your employees are already using AI tools. The question is not whether to allow it. The question is whether you have a written policy that defines what is acceptable, what data can be shared, and what happens when someone crosses the line.

Your employees are already using AI tools. The question is not whether to allow it. The question is whether you have a written policy that defines what is acceptable, what is not, and what happens when someone crosses the line. Most businesses do not. Most will not have one until after the first incident that makes them wish they had.

This page provides a framework for building an AI acceptable use policy, explains what it needs to cover, and walks through the specific risks it is designed to address. A downloadable template is available below for organizations that want a starting point rather than a blank page.

Why Your Business Needs an AI Acceptable Use Policy Now

Research across multiple industry sources suggests that 80% of employees use AI tools their IT department has never approved. They are pasting client data into ChatGPT to draft proposals. They are uploading financial spreadsheets to free AI tools to build models. They are using AI coding assistants that send proprietary code to external servers. They are doing all of this without IT approval, without security review, and without any understanding of where their data goes.

This is not a future risk. It is a current exposure in most organizations. Every piece of sensitive data that leaves the organization through an unapproved AI tool is a potential breach, a potential compliance violation, and a potential liability. The AI acceptable use policy is the governance document that addresses this exposure before it becomes an incident.

What an AI Acceptable Use Policy Covers

A complete AI acceptable use policy addresses four areas.

Approved tools. A list of AI tools that employees are permitted to use for work purposes, with any conditions attached to each. This list should be maintained and updated as the AI landscape changes. Tools not on the approved list require explicit approval before use with work data.

Data classification rules. A framework that defines what categories of information can and cannot be shared with AI tools. At minimum, this should prohibit sharing personally identifiable information (PII), protected health information (PHI), payment card data, client confidential information, and proprietary business data with any AI tool that is not explicitly approved for that data type.

Use case guidance. Specific examples of acceptable and unacceptable AI use in the context of your business. Acceptable: using an approved AI tool to draft internal communications, summarize public information, or generate code for internal tools. Unacceptable: uploading client contracts to a free AI tool, using AI to generate content that will be presented as original research without disclosure, or using AI tools to process regulated data without compliance review.

Accountability and enforcement. Who is responsible for maintaining the approved tool list, who reviews requests for new tool approvals, what the process is for reporting suspected policy violations, and what the consequences are for violations. A policy without enforcement is a document, not a governance framework.

The Data Classification Framework

The most important component of an AI acceptable use policy is the data classification framework. Employees cannot make good decisions about what to share with AI tools if they do not know which information is sensitive.

A practical three-tier classification works for most SMBs.

Public information is information that is already publicly available or that the organization has explicitly approved for public release. This can generally be shared with AI tools without restriction.

Internal information is information that is not public but is not specifically sensitive. Internal communications, general business processes, and non-confidential operational data fall here. This can be shared with approved AI tools but should not be shared with unapproved tools or tools that use input data for model training.

Restricted information is information that is specifically sensitive: client data, financial records, personnel information, proprietary processes, regulated data, and anything subject to a confidentiality agreement. This should not be shared with any AI tool without explicit approval from IT and legal review.

The Approved Tool Evaluation Process

Before adding any AI tool to the approved list, evaluate it against these criteria.

Does the tool use input data to train its models? Many free AI tools use the data you submit to improve their models. That means client data you paste into the tool may become part of the training dataset that other users’ queries draw from. This is unacceptable for any restricted information.

Where is the data stored, and for how long? Understand the data retention policy of any tool before approving it for work use. Data that is retained indefinitely on external servers is a persistent exposure.

Does the tool have a business or enterprise tier with stronger data protections? Many AI tools offer enterprise versions with contractual data protection commitments, data isolation, and audit logging. For tools that employees are already using, the enterprise tier is often the path to making the tool acceptable rather than banning it.

What are the tool’s security certifications? SOC 2 Type II certification is the minimum standard for a business-grade AI tool. Tools without it should not be approved for use with anything beyond public information.

AI Acceptable Use Policy Template

The following framework can be adapted for your organization. Replace bracketed items with your specific information.

Policy Name: AI Tools Acceptable Use Policy
Effective Date: [Date]
Owner: [IT Manager / CISO / Operations Lead]
Review Cycle: Quarterly

Purpose. This policy establishes guidelines for the use of artificial intelligence tools by [Organization Name] employees in the course of their work. It is designed to protect client data, proprietary information, and the organization’s legal and compliance obligations while allowing employees to benefit from AI productivity tools.

Scope. This policy applies to all employees, contractors, and vendors who use AI tools in connection with [Organization Name] work, regardless of whether the tools are provided by the organization or used on personal devices.

Approved AI Tools. The following AI tools are approved for use with work data, subject to the data classification rules below: [List approved tools with any conditions]. All other AI tools require written approval from [IT Manager] before use with work data.

Data Classification Rules. Public information may be used with any approved AI tool. Internal information may be used with approved AI tools that do not use input data for model training. Restricted information (client data, financial records, personnel information, regulated data, proprietary processes) may not be shared with any AI tool without explicit written approval from [IT Manager] and [Legal/Compliance].

Prohibited Uses. Employees may not: upload client contracts, proposals, or confidential communications to any AI tool without approval; use AI tools to process payment card data, health information, or other regulated data without compliance review; present AI-generated content as original research or analysis without disclosure; use AI tools to circumvent security controls or access restrictions.

Approval Process. Requests to add new AI tools to the approved list should be submitted to [IT Manager] with the tool name, intended use case, and data types that will be processed. Approval decisions will be made within [5 business days].

Reporting. Employees who suspect a policy violation or who have inadvertently shared restricted information with an unapproved AI tool should report it to [IT Manager] immediately. Prompt reporting reduces risk and will be considered in any disciplinary review.

Enforcement. Violations of this policy may result in disciplinary action up to and including termination, depending on the severity and circumstances of the violation.

How Your MSP Should Help

If you have a managed service provider, they should be helping you build and maintain this policy, not waiting for you to ask. A competent MSP in 2026 provides AI governance as part of their strategic advisory function: identifying what AI tools are in use in your environment, assessing the risk of each, recommending an approved tool list, and helping you build the policy framework that governs it.

If your MSP has not raised the AI governance conversation with you, raise it with them. Ask what AI tools they have detected in your environment. Ask what their recommendation is for an acceptable use policy. Ask whether they have a template they use with clients. The answers will tell you something about the quality of the strategic advisory you are receiving.

Frequently Asked Questions

Do I need a lawyer to write an AI acceptable use policy?

For most SMBs, a well-structured internal policy does not require legal drafting. Legal review is advisable if your business operates in a regulated industry, handles significant volumes of sensitive data, or has contractual obligations to clients about data handling. The framework above is a starting point, not a legal document.

How do I enforce a policy when employees use personal devices?

The policy applies to work data, not to the device. An employee using a personal phone to paste client data into an unapproved AI tool is violating the policy regardless of the device. Enforcement depends on your ability to detect violations, which requires monitoring tools and a culture where employees understand the risk rather than just the rule.

What if an employee uses an AI tool before the policy is in place?

Address it as a training opportunity, not a disciplinary one, unless the use involved clearly sensitive data. The goal of the policy is to prevent future incidents, not to retroactively punish behavior that occurred before the rules were established.

About Brent Lacy: Brent Lacy is a technology advisor and the voice behind Rewired MSP. He helps MSPs operate with greater maturity and helps business owners make IT choices that make them more secure and more efficient. He is the author of Rewired MSP: Mastery, Scalability & Performance, vCIO Rewired: Virtually Conquering IT Obstacles, and Near Miss: Preventable IT Failures Threatening Your Business Security.

Related Reading

• AI for MSPs: Shadow AI, the Revenue Gap, and How to Lead the Conversation
• Your Employees Are Already Using AI. The Question Is Whether Anyone Is Watching.
• Shadow AI: What Unapproved Tools Cost Your Business
• When AI Becomes a Legal Liability: What US v. Heppner Means for MSPs
• Stop Selling AI Tools. Start With an AI Readiness Assessment.