Decision guide

What should an AI acceptable-use policy answer?

Make the policy useful to the people who need to apply it, and to the teams responsible for supporting it.

AI policy 5 min read Reviewed October 29, 2026

The practical takeaway

An AI acceptable-use policy should help a person answer three questions: Can I use this tool for this task, what information may I provide, and who checks or approves the result? Start with real work, then make those answers specific.

For: Business, IT, security, HR and compliance leaders

Start with the work people actually do

Ask a few teams to walk through their current AI use before writing rules. Include drafting, research, meeting summaries, coding, customer interactions, built-in SaaS features, and agents connected to business systems. A policy limited to public chatbots can miss the tools already inside everyday workflows.

Make disclosure constructive. Ask what people are trying to accomplish and what approved alternative would meet that need. The Australian National AI Centre identifies shadow AI as a possible sign of unmet needs or time pressure. That supports an approach that combines clear boundaries with a workable path to approval.

Sources [1]

Ten questions your policy should answer

Use these questions in a working session. Each answer should identify an owner and a place employees can find the current guidance. NIST’s generative AI profile supports explicit acceptable-use expectations, human oversight, and coverage of third-party personnel; the checklist below is GlobalLinc’s practical application.

AI acceptable-use policy working checklist
Question	Make the answer concrete
1. Who and what are covered?	Employees, contractors, embedded AI, personal accounts used for work, internal applications, and connected agents.
2. Which uses are encouraged?	Name useful examples for your business and the conditions attached to them.
3. Which tools and accounts are approved?	Identify the service, business account, approved configuration, owner, and permitted use.
4. Which data may be used?	Map existing information classes to approved tools, connections, and handling rules.
5. Which uses need extra approval?	Identify high-impact decisions, sensitive workflows, external publication, and actions that change records or move money.
6. Who checks the output?	Name the accountable reviewer and the facts, sources, or calculations they must verify.
7. What may an agent do?	Separate reading and drafting from sending, purchasing, modifying, or deleting.
8. How does someone request an exception?	Provide an intake route, decision owner, conditions, expiry, and review date.
9. What should someone report?	Accidental disclosure, suspect output, unexpected actions, and unapproved connections; give a contact route.
10. How will guidance stay current?	Assign policy ownership, training, review triggers, and a versioned approved-tool register.

Sources [2]

Approve the use, account, and data together

A product name on an approved list is incomplete. Record which account and contract apply, which features and connections are enabled, and what data the specific use requires. Approval for a public-document summary does not automatically approve employee records or an unrestricted connection to a document repository.

Review retention, deletion, access, model-training terms, processing locations, and third-party handling as separate questions. An assurance about one does not answer the others. Record what information the organization permits, how long it may be held, who can access it, and whether any further use is allowed. Confirm the answer against the agreement and the configuration in use.

Sources [3] [4]

Show employees how the rule changes by situation

These examples illustrate a policy design approach. Your organization should set the actual permissions around its data and obligations.

Illustrative decisions, subject to your approved policy
Situation	A useful policy answer
Draft a post from an already public announcement	Use an approved business tool; check facts, tone, rights, and external-release approval.
Summarize a confidential customer agreement	Use only the approved account, data handling, and workflow for that information class. Escalate if approval is unclear.
Recommend an employment or credit decision	Require the designated business, legal, and compliance review before use; define meaningful human oversight.
Let an agent update customer records	Authorize specific records and actions, require approval where appropriate, and retain evidence of changes.

Connect written rules to everyday controls

Give staff a short employee guide supported by a more detailed approved-tool register and review process. Use business sign-in, access management, training, and available data controls to support the rules. Test what those controls actually cover across browser use, desktop apps, APIs, and integrations.

Teach reviewers to verify an answer against authoritative information, especially where a plausible error could affect a customer. Joint international security guidance recommends checking AI outputs and withholding sensitive information unless its use has been approved. The policy should make the reviewer’s responsibilities understandable in their own job.

Run the draft through three real scenarios with the people who will use it.
Give employees a clear alternative when a requested tool or use is restricted.
Align accidental-disclosure reporting with your existing incident process.
Revisit approval when data, model access, integrations, or the intended use changes.

Sources [5]

Common gaps to catch before rollout

A blanket statement to “use AI responsibly” leaves the hard decisions with the employee. A long list of prohibited products can become equally unhelpful if it omits a usable alternative or ignores AI features inside approved software.

Also watch for vague ownership, no exception route, an assumption that every business account has the same protections, or a rule that allows an agent to act simply because a person is allowed to read the underlying data. Test the policy against an ambiguous request and see who can actually resolve it.

Leave the first working session with a usable draft

Bring your existing security and acceptable-use policies, information classifications, approved applications, relevant contract terms, and a few examples of actual AI work. Include a business sponsor, IT/security, HR, and the legal or compliance stakeholders appropriate to the uses in scope.

Aim for four outputs: a short employee policy, an approved-use register, named approval and reporting owners, and a prioritized list of controls or visibility gaps. Your organization approves the policy. GlobalLinc can help structure the work and identify specialist input where a specific question needs it.

Questions to bring into the conversation

Can an employee tell which account and data are permitted for a specific task?
Who can approve a new tool, exception, or connected action?
Which policy rules are supported by controls today, and which depend on guidance?

Sources and further reading

Research reviewed October 29, 2026. The checklists and examples are GlobalLinc’s practical recommendations, informed by independent technical and public-sector guidance. Examples are illustrative. Apply the references within their stated scope and your operating requirements.

A practical next step

What is the next decision you need to make?

An AI policy, a production workload, a cloud architecture question, or a technology renewal. Start with the priority in front of you.

Let’s talk it through