TL;DR: An acceptable use policy sets out how your team may use your IT, and a good one is short enough for people to read. This guide covers what to include and gives you copy-ready AI wording, with a section for schools.
If your staff handbook is the only place your IT rules live, you probably don’t have a policy. Imagine a new starter asking whether they can paste client details into an AI tool or a colleague leaving a work laptop on the Tube.
A clear acceptable use policy gives you a written answer to both. This guide shows what a good acceptable use policy contains and gives you wording you can copy today.
What Is an Acceptable Use Policy and Who Needs One?
An acceptable use policy is a short document that explains how people may use your organisation’s IT systems, devices, accounts and data. Staff agree to it when they join and can refer back to it whenever they’re unsure.
A good IT acceptable use policy protects the business and supports the team because it sets expectations before a problem happens.
Any organisation with employees and company devices needs one. Growing businesses often find the gap when a client sends a security questionnaire or an insurer asks to see the policy. Schools need one too, and there’s a section on that below.
What to Include in an Acceptable Use Policy
A good IT acceptable use policy covers six areas. Keep each one to a few plain sentences that a new starter could follow on day one.
- Access and passwords: Set out who can access which systems and what makes a strong password. Require multi-factor authentication wherever a service offers it.
- Email and internet: Explain what staff may do on work email and the web, and how to report a suspicious message.
- Personal devices: Say whether staff may use their own phones and laptops for work and what security those devices must have.
- Data handling: Define which information is confidential and where it may be stored or shared.
- Reporting problems: Tell staff who to contact the moment they lose a device or click something suspicious, and confirm that prompt reporting won’t be penalised.
- Consequences: Explain how a breach is handled under your disciplinary procedure, so staff know the policy carries weight.
Add the date of the last review and the name of the person who owns the policy. Treat the list above as an acceptable use policy template, with one short section for each area, and review it every year because tools and risks change quickly.
AI Acceptable Use Policy: Copy-Ready Wording
Many policies were written before staff started using AI assistants, so the AI section is the part most likely to be missing. The Office for National Statistics reported that 55% of employees use AI for work or education. Meanwhile, only around 35% of businesses with 10 or more employees reported using any AI technology, which may mean staff are using AI tools independently.
The clauses below work as an AI policy template, and as acceptable use policy examples, you can copy them straight into your own document. Adapt the names and approval route to suit your business.
Definition: In this policy, an AI tool is any software or online service that generates text, images, code or audio from a prompt.
- Approved tools
Staff may use only the AI tools on the approved list held by IT and must sign in with their work account.
Why: A single approved list tells the business which tools are handling its information.
- Information that must never be entered
Never enter client data, personal data, passwords or financial records into an AI tool unless IT has approved that tool for that information.
Why: Public AI tools may store what you type, so a clear list of what stays out protects your clients.
- Checking AI-generated work
Staff must check AI output for accuracy before using it, and a manager must review any AI-assisted work that goes to a client.
Why: AI tools can sound confident when they’re wrong, so a named person needs to own the check.
- Requesting a new tool
To request a new AI tool, email IT with its name and your intended use, and wait for written approval.
Why: A simple request route gives staff an easy way to ask and keeps useful tools visible to IT.
- Breaching this clause
A breach of this clause may lead to action under the company’s disciplinary procedure, and any accidental breach must be reported to IT immediately.
Why: Quick reporting gives the business the best chance of limiting any harm.
Acceptable Use Policy for Schools: What Changes
An acceptable use policy for schools uses the same six areas, split into two versions that serve different readers.
- The staff version covers work accounts, pupil data, personal devices around pupils and how to report a safeguarding concern.
- The pupil version uses short, age-appropriate sentences that explain what responsible use looks like and who to tell if something online worries them.
Link both versions to your safeguarding policy so the rules on online behaviour and reporting concerns match.
Add the AI clause to the staff version, and give pupils a simple rule that they tell their teacher when they’ve used an AI tool for schoolwork. Ask pupils and parents to sign the pupil version and keep a record of who has done so.
A policy works best when the systems behind it support it. Not sure your policy covers what it should? A free Cyber Risk Assessment will show you.
FAQs
- What is an acceptable use policy?
An acceptable use policy is a document that sets out how staff may use an organisation’s IT systems and data. Employees usually agree to it when they join, and the business reviews it each year. - What should an IT acceptable use policy include?
It should cover access and passwords, email and internet use, personal devices, data handling, reporting problems and the consequences of a breach. Add an AI section if your staff use AI tools at work. - Where can I find acceptable use policy examples or an acceptable use policy template?
The six areas and the AI clauses in this guide give you a starting point you can adapt to your own tools and people. Ask your IT support provider to review the finished version, and ask your HR adviser or a solicitor to check the disciplinary wording. - Do I need an AI acceptable use policy?
Any business where staff use AI tools benefits from one because without it people decide for themselves which tools to use and what to type into them. A short clause in your existing policy is enough to start, and the AI policy template wording above covers the main points. - Does a school need a separate acceptable use policy for pupils?
Most schools benefit from two versions. Staff need detail on pupil data, safeguarding, personal devices and AI use. Pupils need short, age-appropriate rules they can follow.
