An AI acceptable use policy is one short document that answers three questions for every employee: which tools am I allowed to use, what must never go into them, and when does a person have to check the result before it leaves the company. It is step two of our four-step approach, and it is written from what your own diagnostic found, not from a template.
The common failure is a long document written for a regulator rather than for the person about to paste a customer list into a chatbot. It bans “unauthorised tools” without naming a single authorised one, so the reader has no idea what they are allowed to open. It says data must be “handled appropriately”, which tells a sales rep nothing about whether a signed contract can go in. And it arrives once, by email, from legal. A policy that cannot be applied at the moment of the decision is not a policy, it is a record that someone wrote one.
Ours fits on a couple of pages, names your actual tools, and uses the words your teams use for their own documents. It comes out of the maturity diagnostic, so the examples in it are situations that already happened in your company rather than invented ones. It is a draft and we say so: your legal counsel validates it, adjusts it to your sector, and signs it off. What you get from us is the part that is hard to write from the outside, which is the operational detail, not the legal boilerplate.
Article 4 of the EU AI Act asks providers and deployers to take measures that support the development of AI literacy among the people who operate AI systems on their behalf. A document nobody has read supports nothing, and a training course with no written rule leaves every employee to invent their own. The two are one deliverable in practice: the policy states the rule, the tracks teach the judgement the rule depends on, and the follow-up shows whether either landed. We do not sell the document on its own for that reason.
Diagnostic, acceptable use policy, interactive tracks by function, adoption follow-up. The four steps work together, and the free 30-minute call scopes all of them.
See the four stepsThe AI acceptable use policy your teams will actually read
You can, and it is a reasonable starting point for the structure. What a template cannot do is name your tools, list the data categories that are actually sensitive in your business, or describe the three situations where your teams have already got it wrong. Those are the parts people read, and they are the parts that come from the diagnostic rather than from a document.
Two weeks after the diagnostic closes, in the normal case. The diagnostic itself takes one to two weeks depending on how quickly the interviews get scheduled, so a month from kickoff to a draft in your legal team's hands is the realistic figure.
In the companies we work with it is usually three people: whoever owns legal or data protection, whoever owns IT and the tool budget, and the executive sponsor who can make it stick. The common mistake is letting it be owned by one of those alone, because a policy signed only by legal never names the tools and a policy signed only by IT never covers the judgement.
No. We design training, we are not a law firm. The policy we draft is a base to be validated by your own counsel, and the compliance decision stays yours.
We go through how your teams use AI today, what is missing to frame it, and what the first quarter would look like. You leave with enough to decide, whether you work with us or not.