The AI acceptable use policy you can adopt in an afternoon.

Your people are already using AI, with or without a policy. Enterprise policy frameworks are overkill for a 300-person business; a one-line ban is ignored by lunchtime. This template sits in between: specific enough to govern, short enough to follow.

What's inside

• The full policy in 17 numbered sections, ready to edit in Word. Every company-specific value is marked [LIKE THIS], and guidance notes tell the policy owner what to change.
• A data traffic-light that tells staff which information can go into which tools, with one rule that never bends: secrets and credentials never go into an AI tool.
• Rules for AI agents and coding assistants: least privilege, human sign-off before anything irreversible, logging, and a way to stop an agent fast.
• The working parts: an approved tools register, an agents register, a tool request form with eleven due-diligence questions, and the policy on a page for staff.
• A 30-day rollout checklist, plus pointers to the UK, EU and US rules that apply, each checked against its source in October 2026. Not legal advice.

For COOs, heads of IT, security and legal at organisations of roughly 100 to 1,000 people that need a sensible AI policy this quarter.