AI Use Policy for Companies: What a Generative AI Policy Should Cover

What should a company AI use policy cover?

A company AI use policy should define its purpose and scope, list approved tools, set data rules for confidential, personal, customer, and source code information, require human review, address ownership of outputs, disclosure, security, and employment issues, and name an owner who keeps it current.

Employees are often already using generative AI tools for drafting, research, coding, and analysis, whether or not a policy exists. A written policy turns that informal use into a set of decisions the company has actually made: which tools are allowed, for which work, with what information, and under whose review.

There is no single AI policy template that fits every business. A software company with customer data in its products faces different issues from a professional services firm drafting client deliverables. The outline below is a starting framework to adapt to the company’s tools, data, contracts, industry obligations, and risk tolerance.

What is the purpose and scope of a generative AI policy?

The policy should explain why it exists, which people and systems it covers, which uses are permitted, restricted, or prohibited, and how it relates to existing confidentiality, security, privacy, and employment policies.

Scope should be specific. State whether the policy covers employees, contractors, interns, and agencies; company devices and personal devices used for work; standalone chat tools; AI features embedded in existing software; coding assistants; meeting transcription; and AI built into the company’s own products. Embedded features are easy to overlook because they arrive through ordinary software updates.

Companies often use two layers. An AI acceptable use policy tells employees what they may and may not do day to day. An AI governance policy sets how the company evaluates, approves, monitors, and retires AI systems, and who decides. Smaller companies can combine both in one document, provided the operational rules stay short enough for people to follow.

How should the policy handle approved tools and AI procurement?

Maintain a list of approved tools and account types, require use of company accounts with the right settings, and route new tools through an intake and review process before anyone uses them with company information.

The vendor contract determines much of what the policy can promise. Before approving a tool, review how the vendor may use prompts and outputs, its security commitments, IP terms, and exit rights. Our AI Vendor Contract Checklist walks through the ten clauses that most often deserve attention during that review.

• Distinguish approved enterprise accounts from personal or free consumer accounts, which may carry different data use and retention terms.
• Record the approved purposes for each tool, such as drafting marketing copy, summarizing public documents, or assisting with code.
• Require that settings governing model training, data retention, and sharing be configured by an administrator rather than left to individual users.
• Send new tools and material changes through procurement, security, and legal review before rollout.

What information should employees keep out of AI tools?

The policy should classify information and state plainly which categories may never be entered, which may be entered only in approved tools, and which are freely usable.

Customer commitments deserve special attention. A company may have promised customers that their data will be used only to provide its services or processed only by listed subprocessors. Entering that data into an unapproved AI tool can breach those promises even if the tool itself is secure. Security controls should back up the rules: single sign-on, access limits, logging where available, and a clear process for reporting accidental disclosure.

• Confidential business information: financials, strategy, deal terms, board materials, and nonpublic product plans.
• Personal information: employee records, applicant data, and any information about identifiable individuals, especially sensitive categories such as health or financial data.
• Customer and partner information: data and documents the company received under contracts, NDAs, or data processing agreements that may restrict disclosure or further processing.
• Source code and technical secrets: proprietary code, credentials, API keys, architecture details, and security configurations.
• Privileged material: communications with counsel and documents prepared for legal advice, which disclosure could put at risk.

Who is responsible for checking AI output, and when should AI use be disclosed?

The person who uses an AI output remains responsible for it. The policy should require review proportionate to the stakes and define when AI involvement must be disclosed to customers, colleagues, or others.

Generative AI can produce confident but incorrect statements, fabricated citations, insecure code, and biased content. NIST’s AI Risk Management Framework and its Generative AI Profile describe these risks and the value of human oversight. The policy should translate that guidance into concrete steps: verify facts and sources, test code, check outputs for confidential information, and require subject matter review before AI-assisted work is used in customer deliverables, public statements, or consequential decisions.

Disclosure rules should be practical. Consider whether customer contracts, industry rules, or platform terms require notice of AI involvement; whether customer-facing chat or content should identify AI use; and whether internal documents should note when AI materially contributed. Marketing claims about the company’s own AI capabilities should be accurate and supportable, because consumer protection law applies to AI claims as it does to any other advertising.

Who owns AI-generated content, and can it be copyrighted?

Ownership depends on the tool’s terms, the company’s agreements with employees and contractors, and copyright law. The U.S. Copyright Office’s position is that copyright protects only human authorship, so material generated entirely by AI is generally not protectable.

The Copyright Office’s 2023 registration guidance requires applicants to disclose AI-generated material that is more than minimal and to claim only the human-authored contribution. Its January 2025 report on copyrightability concluded that prompts alone generally do not give a user enough control over the expressive output, while human expression that is perceptible in the output, creative selection and arrangement, and meaningful human modification can be protected. Federal courts have upheld the human authorship requirement. These questions are decided case by case.

For a business, the practical consequences are significant. Content, designs, or code that are mostly AI-generated may be difficult to protect against copying. The policy should require employees to document meaningful human contributions for important assets, flag AI-assisted material in work that will be registered, licensed, or sold, and review vendor terms on output ownership and indemnity. Outputs can also resemble existing third-party works, so review for infringement risk before publishing high-value material.

How does an AI policy affect employees, contractors, and HR decisions?

The policy should explain how it applies to employees and contractors, how AI may be used in hiring and personnel decisions, what monitoring occurs, how violations are handled, and what training people receive.

• Bind contractors and agencies through their agreements, not only through an internal policy they may never see, and confirm IP assignment and confidentiality terms cover AI-assisted work.
• Treat AI tools used in recruiting, screening, evaluation, or discipline as higher risk, because anti-discrimination laws apply regardless of the technology used, and some jurisdictions, such as New York City, regulate certain automated employment decision tools.
• Explain any monitoring of AI tool use consistent with applicable privacy and employment law.
• Draft restrictions so they do not unintentionally limit legally protected employee communications.
• Provide role-based training at onboarding and when tools or rules change, with a simple acknowledgment.

Who should own the AI policy, and how often should it be reviewed?

Assign a named owner, often supported by a small cross-functional group from legal, security, IT, HR, and the business, and review the policy on a set schedule and whenever tools, laws, or uses materially change.

An AI governance policy works only if someone maintains it. The owner should keep the approved tool list current, track exception requests, receive incident reports, and coordinate updates to contracts, privacy notices, and training. NIST’s framework organizes this work into governing, mapping, measuring, and managing AI risk, which is a useful structure even for a small company.

Many companies review the policy at least annually, with interim updates when a major vendor changes its terms, a new use case moves into customer-facing work, or a relevant law takes effect. Keep a short record of each decision so the company can explain later why a tool or use was approved.

What does an AI use policy outline look like?

A practical outline covers the sections below. Adapt each one to the company’s actual tools, data, contracts, and obligations rather than adopting generic language.

• Purpose, scope, covered people, covered tools, and relationship to other policies.
• Definitions of generative AI, approved tools, company data, and prohibited data.
• Approved tools list, account requirements, and the intake process for new tools.
• Permitted, restricted, and prohibited uses, with examples.
• Data classification rules for confidential, personal, customer, privileged, and source code information.
• Human review, accuracy, and testing requirements proportionate to the stakes.
• Ownership, documentation of human contribution, and third-party IP review.
• Disclosure rules for customers, colleagues, and public content.
• Security controls and how to report incidents or accidental disclosures.
• Employment provisions, contractor obligations, training, and acknowledgment.
• Governance owner, exception process, recordkeeping, and review cadence.