What should an Ai acceptable-use policy say?
By Alberto Alatorre ·
An acceptable-use policy is one page with four rules: what Ai may do, what it may never do, what never goes in, and who checks the work. Your team is already using Ai. Someone on your team has already pasted something into a chatbot. The question is not whether your people use Ai. It is whether you have told them how.
It tells your team what Ai may do, what it may never do, what never goes into it, and who checks the work. If you do not have one, write it this week. It needs to be clear enough that a new hire can read it in five minutes and know where the line is.
What may Ai do?
Start with the good jobs. Ai is strong on repeat work that follows a pattern. Drafting a first version of a job post. Turning a long policy into a plain-language summary. Organizing a pile of open-ended survey answers into themes. Turning rough notes into a checklist.
Write those jobs down by name. When people see the approved list, they use the tool with confidence. When they do not see a list, they guess, and guessing is where mistakes happen.
What may Ai never do?
This is the line that protects your people. Ai may never make a decision about a person on its own. It may never decide who gets an interview, who gets the job, who gets a raise, or who gets let go. A human owns those decisions, start to finish. Ai can draft the questions. It can organize the applications. It never makes the call.
Ai may never write the final version of anything that goes to an employee. A termination letter, a pay decision, a leave answer, a disciplinary note. Every one of those gets a human who reads it, fixes it, and owns it before it goes out.
Put these in plain words, in a list. The policy fails the moment someone has to ask whether a use is allowed.
What never goes into the tool?
This rule is the one most teams skip. Some things never go into a general Ai tool.
No names tied to pay, performance, health, or discipline. No medical notes. No Social Security numbers, bank details, or home addresses. No confidential business information like salaries, layoff plans, or internal investigations. If you would not want it on a shared screen in the break room, do not type it into a chatbot.
If your team needs Ai to work with sensitive information, that needs a tool with the right protections, not a free chatbot. That is what an Ai risk and compliance audit is for: checking what you use, what it sees, and whether the protections match.
Who checks the work?
Every Ai draft is a first draft. Someone on your team reads it, fixes it, and owns it before it goes out. Name that person by role, not by hope. For a job post, it is the hiring manager. For a policy summary, it is HR. For an employee message, it is the person sending it.
Checking means more than reading for typos. It means checking the facts, the tone, and the law that applies. Ai writes in confident language even when it is wrong. It can invent a rule that does not exist, or quote a law that changed. The human check is the guardrail.
If someone breaks a rule by accident, treat it as a training moment first. Fix the mistake, show them the rule, and check whether the rule was clear. If the same mistake keeps happening, the policy needs to be clearer or the team needs more training.
Keep a short record, too. Which tools you use, what they do, who uses them, and what data they see. Some states already regulate Ai in hiring and workplace decisions, and the rules are not the same everywhere. Know what you use, what it decides, and what records you keep.
How do you roll the policy out?
Do not email the policy and call it done. Bring the team together for thirty minutes. Read it out loud. Walk through one good example and one bad example for each rule. Then ask the team what they are already using, and add the good tools to the approved list.
Post it where people can find it. The handbook, the shared drive, the onboarding packet. A policy nobody can find is a policy nobody follows. Review it twice a year. The tools change every month. The four rules do not. Read other policies for ideas, but do not copy one and change the name. Your tools, your data, and your state rules are different from theirs.
What to do next
Write the four rules on one page this week. If you want the policy checked against the rules that apply to your business, the Ai risk and compliance audit is the place to start. FYHR Pro is free with an account, no card required, and a safe place to practice before you roll the policy out to the team.
HR guidance, not legal advice.
Frequently asked questions
- Do we really need a written policy if our team is small?
- Yes, especially if your team is small. One person pasting the wrong thing into the wrong tool is all it takes. One page is enough.
- Can we copy a policy from another company?
- You can read one for ideas, but do not copy it and change the name. Your tools, your data, and your state rules are different from theirs.
- What if someone breaks the policy by accident?
- Treat it as a training moment first. Fix the mistake, show them the rule, and check whether the rule was clear. If the same mistake keeps happening, the policy needs to be clearer or the team needs more training.
- What are the four rules?
- What Ai may do, what it may never do, what never goes in, and who checks the work.