AI Acceptable Use Policy Writing and Rollout for Companies
AI acceptable use policy writing for companies whose staff use Claude, ChatGPT, Microsoft Copilot or Gemini. The policy tells your staff which AI tools they can use for work, what data stays out of them and who checks the output. We write yours from your client contracts and the AI tools your team already uses, set it up as admin settings in each assistant, and train every team on it.
What Your AI Acceptable Use Policy Covers
Your AI use policy, sometimes called a generative AI policy or an AI code of conduct, is written for the assistants your staff open every day. Each section names the tool, the data and the person responsible, in language a non-technical team can follow.
Approved Tools and Personal Accounts
Which AI tools and plans staff use for work, such as Claude Team, ChatGPT Business or Microsoft 365 Copilot, and the rule that client work happens in company accounts. It also sets what happens to personal AI accounts once SSO is required.
Data That Stays Out of AI Tools
A plain list of what never goes into a prompt, such as passwords, card numbers, patient records or files a client shared under NDA, with examples drawn from your own work.
Client Confidentiality Terms
How each client's NDA and contract terms apply to AI use, including clients who ask to be told when AI touches their work or who limit which tools you use.
Output Review and Disclosure
Who checks AI output before it reaches a client, which work needs a second reader, and when you tell a client or the public that AI helped produce it.
Connector Approvals
Who approves a connector that links an assistant to your CRM, files or email, which data it can reach, and which actions wait for a person to confirm.
IP, Incidents and the Policy Owner
Who owns AI-assisted work, how staff report sensitive data entered into the wrong tool, and the named person who owns the policy and approves changes.
Built From Your Contracts and the AI Tools Already in Use
Your staff may already use AI at work: personal ChatGPT or Claude accounts, Copilot Chat inside Microsoft 365, or Gemini in Gmail. We start by finding which AI tools are in use, who uses them and what goes into them. Then we read the client contracts that carry confidentiality, data or AI terms, and list the regulated data you hold, such as health, financial or personal information. Your policy is written from those three inputs, so every clause matches a tool your team recognizes.
Every clause traces to a tool, a contract or a data type.
A company AI policy works when staff see their own tools and their own clients in it. Discovery gives us the facts to write it that way.
Laws and Frameworks Your AI Governance Policy Maps To
Each clause cites the framework or law behind it, so your counsel can check the policy against the rules that apply to your business.
NIST AI Risk Management Framework
NIST's AI RMF sorts AI risk work into four functions: Govern, Map, Measure and Manage. The policy and its owner sit under Govern, and NIST AI 600-1 applies the framework to generative AI.
State Privacy Law and PIPEDA
Rules on personal information under state privacy laws such as California's CCPA, paired with PIPEDA where it applies to you, shape what staff can paste into a prompt and which tools may process it.
Sector Rules Your Counsel Names
Sector rules such as HIPAA for patient data or GLBA for customer financial data set their own limits on which AI tools can see that data and under what agreement.
Approved by Your Counsel
We write the policy and map it to these frameworks. Your own counsel reviews the text and approves it before it goes to staff, and we update the draft from their comments.
Turning AI Policy Clauses Into Admin Settings
Each clause gets a matching setting in the admin console of the AI tool it governs: SSO required for company accounts, an approved list of connectors, and retention and data loss prevention controls where the plan offers them.
Claude Team and Enterprise
Domain verification by DNS record, SSO with Require SSO turned on, and custom connectors added by Owners only. Enterprise adds SCIM, audit logs and custom data retention.
ChatGPT Business and Enterprise
SAML SSO, domain verification and admin roles on Business. Enterprise adds SCIM, role-based access, a connector registry and custom data retention policies.
Microsoft 365 Copilot
Purview DLP for Copilot, sensitivity labels and an oversharing assessment. Microsoft states Copilot only surfaces data each user already has permission to view, so permissions come first.
Gemini in Google Workspace
Admins can turn the Gemini app off, exclude Gmail, Drive, Calendar or Chat as sources, set chat auto-delete at 3, 18 or 36 months, and switch Gem sharing on or off, per Google.
Self-Hosted MCP Gateway
When connector traffic needs to stay under your control, we can deploy a self-hosted MCP gateway between the assistant and your systems that checks each user's access and logs every tool call.
Settings Register
A record that pairs each policy clause with the setting that enforces it, so the policy owner sees which settings change when a clause changes.
Training Staff on the Policy and Collecting Acknowledgment
Staff follow an AI usage policy they have seen applied to their own work, so training covers the rules and the approved AI tools together.
Walk Each Team Through the Policy
We run the policy walkthrough by role. Sales sees the client data rules, finance sees what stays out of prompts, and managers see how output review and disclosure work.
Practice in the Approved Tools
Staff work through real tasks in Claude, ChatGPT, Copilot or Gemini with the company settings already on, so they see where company accounts and approved connectors sit.
Collect Acknowledgment
Each person confirms they have read and understood the policy. We set up the acknowledgment in the HR or e-signature tool you already use and keep the record with the policy owner.
Add It to Onboarding and Offboarding
New hires get the same walkthrough and sign the acknowledgment during onboarding. When someone leaves, SSO ends their AI access along with their other company accounts.
Want a full AI training program for your team?
Our AI training for employees builds on your policy with role tracks, hands-on workshops in Claude, ChatGPT and Copilot, and a prompt library for each team.
Keeping Your AI Policy Current as Tools Change
AI vendors change their products often. Anthropic launched Claude for Small Business on May 13, 2026, with connectors to QuickBooks, PayPal, HubSpot and Google Workspace. Google plans to retire Gems on Workspace business and enterprise accounts in March 2027, with Skills taking their place. Each change can add a tool or a data path your policy has to cover. A named policy owner keeps your responsible AI policy current, with review triggers written into the policy itself.
The policy owner reopens the policy when your AI setup changes.
Each review updates the policy text, the settings register and the staff walkthrough together. A fractional Chief AI Officer can take the owner role for companies without an in-house AI lead.
Frequently Asked Questions on AI Acceptable Use Policies
It names the AI tools and plans staff can use, the data that stays out of prompts, how client confidentiality terms apply, who reviews AI output and when it is disclosed, who approves connectors, what happens to personal accounts, who owns AI-assisted work, how to report an incident, and who owns the policy. Ours also lists the admin setting that enforces each clause.
It depends on the plan. Anthropic's pricing page lists model training on Claude Team and Enterprise as "None by default", and its commercial terms state that "Anthropic may not train models on Customer Content from Services." OpenAI says of ChatGPT Business and Enterprise, "We do not train on your business data, and our models don't learn from your usage." Personal plans work differently: Claude Free, Pro and Max are opt-out, and ChatGPT Free and Plus content can be used for training unless the user turns it off in OpenAI's Data Controls settings. That is why a company AI policy keeps client work in company accounts.
A sample AI policy or ChatGPT policy template gives you headings to start from. The clauses still need your tools, your client terms and your data, and your counsel approves the final text. For a small team we keep the policy short: the approved tools, what stays out of prompts, who checks client work, and who to ask with a question.
The cost depends on how many AI tools are in use, how many client contracts carry AI or confidentiality terms, the regulated data you hold and how many teams need training. We scope it in a free strategy session and quote against that scope. AI tool seats are billed by the vendor directly; Claude Team Standard seats, for example, list at $20 per seat per month billed annually on Anthropic's pricing page.
Ready to Give Your Team a Clear AI Use Policy?
Start with a free strategy session. Tell us which AI tools your team uses, the client terms you work under and the data you hold, and we will come back with a scoped plan for the policy, the admin settings and the training.