Business Software

AI Acceptable Use Policy Template for Small Teams (Free, Copy and Paste)

Free AI acceptable use policy template for small teams, plus the rule most templates miss: which ChatGPT, Claude, Gemini and Copilot accounts train on data.

By Angela Roy Updated 8 min read
AI Acceptable Use Policy Template for Small Teams (Free, Copy and Paste)
Table of contents

Disclosure: We may earn a commission when you buy through links on this page, at no extra cost to you. How we make money.

Quick answer

This AI acceptable use policy template is a one-page policy a 5 to 50 person team can adopt this week. It covers four things: which AI tools and accounts people may use, what data must never go into them, who checks the output, and what to do when something goes wrong.

The rule most free templates skip is the account. The same tool can treat your data very differently on a personal account and on a business one, so the template below requires company accounts for company work.

Can the AI provider train on what your team types? (checked October 30, 2026)

Tool Personal or free account Business account
ChatGPT Used for training unless you turn off Improve the model for everyone in Data controls Not used for training by default (Business, Enterprise, Edu)
Claude You choose in Privacy Settings whether chats help train Claude Commercial products (Claude for Work, API) are outside the consumer training terms
Gemini Google says Gemini Apps data from personal accounts may be used for training Workspace content isn’t used for training outside your domain without permission
Microsoft Copilot Chat Not covered in this article Work or school sign-in: prompts and responses aren’t used to train the foundation models, but they are logged for audit

The rule most templates miss: personal accounts

Most AI acceptable use policies say “use approved tools”. That isn’t enough, because the approval has to cover the account, not just the product name. Here is what each provider says, from their own pages:

  • ChatGPT. On personal plans, OpenAI uses conversations to improve its models unless you turn off Improve the model for everyone under Settings → Data controls. Temporary chats aren’t used for training. On Business, Enterprise and Edu, OpenAI says workspace data is excluded from training by default.
  • Claude. For Free, Pro and Max, Anthropic says “You choose to allow us to use your chats and coding sessions to improve Claude”, and you can change that in Privacy Settings. Those consumer terms don’t apply to Claude for Work, Claude for Education, government plans or the API.
  • Gemini. Google’s Workspace privacy hub says your content isn’t human reviewed or used for model training outside your domain without permission. For personal accounts, Google’s help page warns that data shared with Gemini Apps “may be used for model training and improvement”.
  • Microsoft Copilot Chat. With a work or school account, Microsoft says “Prompts and responses aren’t used to train the underlying foundation models.” The same page says prompts and responses are logged and stored for audit and eDiscovery. So it’s kept out of Microsoft’s model training, but not hidden from your own company’s admins.

One more detail that changes how people should behave: feedback buttons. Anthropic says that when you give a thumbs up or down, it stores the whole conversation for up to five years and may use that feedback to train its models. Search excerpts of OpenAI’s help pages describe a similar rule for personal ChatGPT plans, even when training is turned off. The template therefore bans rating responses that contain company information on any personal account.

Free AI acceptable use policy template (copy and paste)

Replace everything in [square brackets]. Keep it to a page: people read a page, and they don’t read a handbook chapter.

[Company name] AI Acceptable Use Policy
Version 1.0 · Effective [date] · Policy owner: [name, role] · Next review: [date, 3 months from now]

1. Why we have this policy. AI tools save us time. This policy keeps our customers’ data, our company’s information and our reputation safe while we use them.

2. Who it covers. Everyone who works for or with [Company name]: employees, contractors and freelancers, on any device, whenever the work is for [Company name].

3. Approved tools and accounts. Use only the tools listed below, signed in with your [Company name] account. Don’t use personal or free accounts for company work, even for “quick” questions.

Tool Approved account / plan Approved for
[e.g. ChatGPT] [e.g. company Business workspace] [e.g. drafting, summaries, research]
[e.g. Microsoft Copilot Chat] [e.g. work account] [e.g. email and document drafts]
[add rows]    

4. Data rules.

  • Green: allowed. Public information, your own notes, general questions, and marketing drafts with no client details.
  • Amber: approved business accounts only. Internal documents and plans, anonymised figures, and code without passwords or keys. Remove names and contact details first.
  • Red: never, in any AI tool. Passwords, API keys and login codes; payment card or bank details; customer or staff personal data; health, HR or disciplinary records; anything covered by an NDA or a client contract that forbids it.

5. You own the output. AI tools make mistakes. Check facts, figures, quotes, links and code before you send or publish anything. AI must not make final decisions about hiring, pay, discipline or a customer’s money or rights without a person reviewing them.

6. Feedback and sharing settings. Don’t use thumbs up/down or “share” on any conversation that contains company information unless it’s in an approved business account. Don’t turn on settings that let a provider train on company data.

7. Agents and connected apps. Don’t connect an AI tool to company email, files, calendars or accounts, or let an AI agent send, buy, delete or sign anything, without approval from [policy owner].

8. Being open about AI. Follow client contracts on AI use. Don’t present AI output as something a person researched or checked unless a person did.

9. New tools. Ask [policy owner] before using a new AI tool, browser extension or plugin with company information. [Policy owner] will check its data and training terms and reply within [5] working days.

10. If something goes wrong. If you put red data into an AI tool, or a tool does something unexpected, tell [policy owner] the same day. Reporting quickly is never punished. Hiding it is.

11. Breaches. Deliberate or repeated breaches are handled under [our disciplinary policy / contractor agreement].

I have read and will follow this policy.
Name: ________ · Signature: ________ · Date: ________

What can go into an AI tool? The traffic-light rule

AI acceptable use policy traffic-light rule: green public data is allowed, amber internal data only on approved business accounts, red secrets and personal data never
Amber assumes an approved business account that doesn’t train on your data.

The colours are deliberately blunt. Staff won’t read a six-level data classification scheme in the middle of a deadline, but they will remember “red never goes in”. Two judgement calls come up most often:

  • Code. Most code is amber. It becomes red when it contains secrets (keys, tokens, connection strings) or when a client contract says the code can’t leave your systems.
  • “Anonymised” data. Removing names isn’t always enough. A small customer list with job titles and towns can still identify people, so when in doubt, treat it as red.

How to roll it out in a week

Day Task Why
1 Ask everyone which AI tools they already use, with a no-blame promise You can’t approve or block tools you don’t know about
2 Pick the approved tools and decide which need a business plan Personal accounts are where training settings and feedback rules bite
3 Check each approved tool’s training, sharing and connected-app settings Admin settings decide what actually happens to the data
4 Fill in the template and name a policy owner Someone has to answer “can I use this?” quickly
5 Run a 15-minute walkthrough of the traffic-light rule, then collect signatures One clear example sticks better than a long document

Then put a three-month review in the calendar. AI products change their plans and privacy terms often, and the approved list will go out of date faster than the rest of the policy.

If your team uses AI browsers or agents that act on websites for you, the risks go beyond what people type. Our guide to whether AI browsers are safe covers prompt injection and the rules worth adding to section 7. For what each chatbot plan includes, see Google AI Pro vs ChatGPT Plus, and if you’re on Microsoft 365, our note on the 2026 Microsoft 365 price increase explains which plans include Copilot Chat.

If you operate in the EU

The EU AI Act doesn’t require a written AI policy. Its Article 4 does require providers and deployers of AI systems to take measures to support AI literacy among staff and others who operate AI systems for them. That obligation has applied since February 2, 2025, and was amended by the Digital Omnibus on AI in July 2026. The European Commission’s AI literacy Q&A says there are no strict requirements or mandatory trainings, and that measures should fit the staff and the systems used. A short policy plus a walkthrough, like the one above, is a sensible part of that, but it isn’t a compliance guarantee.

What this template doesn’t cover

It’s a starting point for ordinary office work. Get proper legal or compliance advice if you handle health, financial or children’s data, work in a regulated industry, build AI features into your own product, or have client contracts with specific AI clauses. It also doesn’t settle copyright questions about AI-generated content you publish or sell.

Sources

Checked October 30, 2026. Providers change these terms; check the linked pages before you rely on them.

Frequently Asked Questions

Does a small business need an AI acceptable use policy?

If anyone on your team uses ChatGPT, Claude, Gemini or Copilot for work, yes. Without one, people decide for themselves what data to paste and which account to use, and personal accounts can have different training settings from business plans.

Can employees use their personal ChatGPT account for work?

It’s your call, but the template says no. On personal plans OpenAI uses conversations to improve its models unless the user turns that setting off, while Business and Enterprise workspaces are excluded from training by default.

What should an AI acceptable use policy include?

At minimum: approved tools and accounts, a data rule (what must never be entered), who checks AI output, rules for agents and connected apps, how to request a new tool, and how to report a mistake. The template above covers all of these on one page.

Does the EU AI Act require an AI policy?

Not a written policy as such. Article 4 requires providers and deployers to take measures to support their staff’s AI literacy. The European Commission says there are no strict requirements or mandatory trainings, so the measures should fit your team and the tools it uses.

Angela Roy Editor

Angela Roy has 7 years of experience in IT support and web hosting. On BytePicks, every price, plan limit and Windows fix is checked against the vendor's own documentation before it's published, and articles say when something hasn't been tested hands-on.