AI Acceptable Use & Security Policy

Purpose

Most organisations do not build AI. They use other people's AI: an assistant inside the office suite, a forecasting feature in a system they already run, a chatbot a supplier offers, or a free tool a member of staff finds on their own. Governing that use proportionately starts with knowing what is in use. For each use, the organisation then decides what data it may touch, who answers for it and how much checking it needs. A small use with low-risk data needs a short screen and a named owner. A use that touches Confidential data, faces customers, acts on its own or helps decide something about a person needs an assessment and a senior decision first. A few uses are never allowed. The result is a list the organisation keeps, with counts of what is approved, held, declined and due for review. It is never one score.

This policy commits [[Organisation Name]] to the same approach. It says which AI tools people may use for work, with which information, who must check what the tools produce, when people must be told that AI was involved, and what is never allowed. It sets 22 rules, AG-01 to AG-22. Every other document in the AI Security Governance & Acceptable Use pack cites them by number.

The other documents put the policy into practice: the AI Use Case Intake & Approval Procedure decides each new use, the AI Governance Responsibility Matrix says who does what, the AI System & Use Case Inventory lists every use, the AI Use Case Risk & Impact Assessment assesses the larger ones, the AI Tool Approval & Data Permission Matrix lists the approved tools and the data each takes, the EU AI Act Role & Risk Classification Worksheet records the organisation's reasoning against the EU AI Act, and the AI Literacy & Staff Training Plan trains the people. The rules below are the part that does not change from one tool to the next.

Legal note. This document helps you govern the AI your organisation uses. It is not legal advice, and following it is not a statement that you comply with the EU AI Act, the GDPR or any standard. Whether the Act binds you, in which role, and which of its duties apply to each system depends on the facts and on how your Member State applies the Act: confirm it with counsel.

Scope

This policy applies to:

• People: everyone who works for [[Organisation Name]] and uses an AI system for work, whether on a work device or a personal one: employees, contractors, temporary staff and supplier staff who hold our accounts (AG-01).
• AI built into other software: AI tools that a person chooses, and AI features inside software the organisation already runs, such as a forecasting feature in a business system, a summarising button in a meeting tool or a machine-learning filter in a security service. A supplier can switch on such a feature in a release, and it is then a new use (AG-09).
• Information: everything a person types, pastes or uploads into an AI tool, and everything the tool returns. The information classification levels of the Information Classification & Handling pack decide what may go in (AG-03).
• Suppliers: AI tools and AI features supplied to us, under the third-party security pack (AG-11).

Excluded: [[anything deliberately left out, and where it is covered instead, e.g. AI embedded in a product the organisation sells, which a separate product governance process covers; or "None"]]. Use of AI in a purely personal, non-professional activity is outside the EU AI Act's obligations for deployers (Article 2(10)) and outside this policy, but a personal account is never used for work (AG-04).

How this policy works

Five things are asked of every person who uses AI for work.

Every proposed use gets one of four outcomes, and the outcome sets how much checking it needs before it starts. The AI governance lead sets the tier from the intake answers (A03). Values in [[brackets]] are the pack's defaults.

Permitted, conditional and prohibited uses

Uses fall into three groups. The groups are not a list of tools. They describe what a use needs before it may begin, and the approved list (A07) names the tools.

Permitted

A use is permitted when it has an intake decision of Approve or Approve with conditions, runs on a tool that is on the approved list (A07), keeps within the data level the list allows for that tool, and meets its conditions (AG-02, AG-03, AG-09). A person who is unsure asks the AI governance lead before using the tool, not after. Public information may go into any tool (P15 CL-19), but never through a work account and never under the organisation's name.

A tool on the approved list has one of three states:

Allowed only after approval

A use needs approval before it starts, and it is not started until the decision is made, when any of the following is true (AG-06, AG-09, AG-16, AG-17). The tier rises as the risk rises.

• Confidential information, personal data, or customers and the public are involved (Tier 2).
• The use informs a decision about a person, or a wrong output or a stoppage would affect a core service or a material sum (Tier 2).
• The use decides or shapes a decision about a person, falls in an area of Annex III of the EU AI Act, acts or sends output on its own, or could otherwise make the organisation a provider of an AI system (Tier 3). A new feature built on a supplier's model API is Tier 3 and held until Legal records the role. If Legal records the deployer role, the tier is set again from the answers. If Legal records the provider role or another role, the hold clears but the use stays Tier 3, and the executive decision-maker decides. A feature already running when this policy starts carries the hold as a condition with a date.

Worked examples, sorted by outcome, with the case after Legal records the deployer role shown beside the case before it. The outcome of each is the intake method's (A03), applied to the answers a person would give.

Never allowed

The practices that Article 5 of the EU AI Act prohibits are never allowed, in any use, whoever supplies the tool (AG-05). Ten items make up the checklist in the EU AI Act Role & Risk Classification Worksheet, and a proposed use is checked against all of them at intake. The first eight have applied since 2 February 2025. The last two apply from 2 December 2026.

The organisation adds three prohibitions of its own, and two absolute limits on data and on money (AG-05, AG-03, AG-16):

• Using AI to impersonate a person, including cloning a voice or a face.
• Using AI to get around a security control, such as writing a script that defeats a filter or a sign-in check.
• Using AI to write malware or tools meant to harm systems that the organisation does not own or has not authorised testing.
• Putting special category personal data into any AI tool. This takes no exception (AG-03, AG-20).
• Letting an AI system release a payment or change a supplier's bank details (AG-16).

Data rules by classification

What may go into an AI tool depends on the information's level under the Information Classification & Handling pack, on the tool's state on the approved list, and on whether personal data is involved. The rules agree with P15 CL-19. A collection, an export or a copy takes the highest level of anything in it (P15 CL-13). Special category personal data never goes into an AI tool at any level (AG-03). In short: Public information with no personal data in it into any tool (personal data inside Public information still needs a tool approved for personal data); Internal only into a tool approved for Internal, signed in with the work account, under a contract term that bars training on our data; Confidential only into a tool approved for Confidential, under the same contract term, after the supplier's documented decision. A vendor setting that stops training, verified off, is an added technical control and never replaces the contract term: the supplier can change a setting, and only the contract binds it.

The same rules as a lookup. Each tool is assumed to meet its baseline conditions. The answer for a real tool comes from its row on the approved list, using the method of the AI Tool Approval & Data Permission Matrix.

Personal data adds one more condition: the tool must itself be approved for personal data, under processor terms (AG-03). A tool that is not approved for personal data takes none at any level, and a tool that is not approved takes none at all.

Conditions of every approved tool

A tool is approved only if it meets the baseline conditions that apply at the highest level of data it takes.

What the contract must say

Procurement puts the eight AI terms ST-1 to ST-8 into the contract with the supplier of any AI tool, or of any software with an AI feature (AG-11). They cover no training on our data, processor terms, sub-processors, locations, incident notice, return and deletion on exit, notice of new AI features and the supplier's statement of intended purpose. The AI Tool Approval & Data Permission Matrix lists each term and the Supplier Contract Security Clause Library clause that carries it.

What the law asks and when

This section says, in summary, what the EU AI Act asks of an organisation that uses AI. It does not say that following this policy meets any of it. Regulation (EU) 2024/1689 binds the operators of its Article 2(1): providers, deployers, importers, distributors, product manufacturers and authorised representatives. An organisation that uses another party’s AI system under its own authority for its business is a deployer (Article 3(4)). An organisation that sells goods and is called a distributor in its trade is not an AI Act distributor unless it makes an AI system available on the Union market (Article 3(7)). Which role an organisation holds for each system depends on the facts, and counsel confirms it.

The Act came into application in steps. The dates below are those of Article 113 as amended by Regulation (EU) 2026/1744.

For an organisation that only uses AI, four parts of the Act matter most, and the policy answers each:

Draft and proposed texts. Commission guidelines on the classification of high-risk systems (Article 6(5)): a draft published on 19 May 2026, consultation to 23 July 2026. The Act asked for them by 2 February 2026. The Commission's proposal COM(2025) 837 to amend Regulation (EU) 2016/679 and related law, in committee in the European Parliament on 8 October 2026. This policy relies on neither.

Roles. A business that distributes goods, such as a wholesale distributor, is not a distributor under the AI Act. The Act's distributor makes an AI system available on the Union market. An organisation that uses AI tools in its own work is looking at the deployer test.

Penalties. Member States lay down the rules on penalties, and the Act sets ceilings. Infringing a prohibition can bring a fine of up to EUR 35 000 000 or, for an undertaking, up to 7 % of total worldwide annual turnover, whichever is higher (Article 99(3)). Failing a deployer or transparency obligation can bring a fine of up to EUR 15 000 000 or 3 % (Article 99(4)).

Classification is a legal question. This worksheet records your own reasoning against the text of the Act. It does not say that any system is or is not prohibited, high-risk or subject to a transparency duty, and it does not say that you are a provider, a deployer or any other operator. Counsel confirms each conclusion.

Policy statements

The statements keep the rule IDs AG-01 to AG-22 that every document in the AI Security Governance & Acceptable Use pack cites. Values in [[brackets]] are the pack's defaults; set your own before approval. Each statement names the evidence an auditor looks at.

Using AI at work

AG-01 This policy applies to everyone who works for the organisation (staff, contractors and supplier staff who hold our accounts) whenever they use an AI system for work, on any device or account. It covers AI built into other software as well as AI tools.

Evidence: the scope in this policy, and the acknowledgement record showing that staff, contractors and supplier staff with our accounts have read it.

AG-02 Use an AI tool for work only if it is on the approved list (A07), and only with data the list allows for it. Public information with no personal data in it may go into any tool (P15 CL-19), but never through a work account and never under the organisation's name. An unapproved use found is stopped within [[3]] working days of discovery, and the people involved are helped to a tool they may use.

Evidence: the approved list of tools with the data level each takes; for each unapproved use found, the date found, the date stopped and the tool it moved to.

AG-04 Sign in to approved tools with your work account through single sign-on (P13). Never use a personal or free account for work, never type a work password or access key into an AI tool, and never register for an AI tool with a work email address before it is approved (P13 JML-12).

Evidence: single sign-on records showing each approved tool connected; the survey or discovery results for personal and free accounts; the registration check made when a new tool is requested.

AG-09 No new AI use, and no new AI feature switched on in software already in use, starts before an intake decision under A03. Every decision is recorded in the inventory (A05). Nobody approves a use they own: the use owner is consulted and signs the conditions it accepts, and where a tier's approver owns the use the executive decision-maker takes that approver's place. If the executive decision-maker owns a Tier 3 use, the board or its equivalent decides it (D-42). A use found already running is recorded at the tier its answers give; at Tier 2 or 3 it gets its assessment within [[90]] calendar days of the inventory closing.

Evidence: an intake decision for every use in the inventory, dated before the use began and signed by the approvers of its tier (the executive decision-maker in place of an approver who owns the use), never by the use owner; for a use found running, its tier and the date its assessment is due.

Uses that are never allowed, and uses that need a senior decision

AG-05 The practices that Article 5 of the EU AI Act prohibits are never allowed, in any use, whoever supplies the tool. They include inferring the emotions of staff at work, scoring people on social behaviour, and generating intimate images of a real person without consent. The checklist is PP-01 to PP-10. Staff also never use AI to impersonate a person, to get around a security control, or to write malware.

Evidence: the prohibited-practice checklist completed at intake for every proposed use; the record of any use stopped under it and passed to Legal.

AG-06 No AI output decides, alone, a matter that affects a person's job, pay, discipline, credit, access to a service or legal position (GDPR Article 22). A named person makes the decision after reading the evidence. A use that decides or shapes such a decision, or that falls in an area of Annex III of the EU AI Act whatever it does, is Tier 3 and is not started before the Tier 3 decision. A use that only informs such a decision is Tier 2.

Evidence: for each use that decides or shapes a decision about a person, the Tier 3 file, the Tier 3 decision and the name of the person who makes the decision about the person; for each use that only informs one, the Tier 2 file.

AG-16 An AI system that can act on its own (send messages, change records, approve or release payments, run commands) is Tier 3 until assessed. It runs under a named identity with the least access it needs, and it never releases a payment or changes supplier bank details.

Evidence: for each system that can act on its own, the Tier 3 file, the named identity it runs under, its access list, and the controls that stop it releasing a payment or changing bank details.

AG-17 Nobody builds an application or feature on a supplier's model API (prompts, retrieval, tools or code around a model the organisation calls), whether for staff or for customers, fine-tunes for others, brands, sells or supplies an AI system to a third party, or puts the organisation's name on a supplier's AI system, without Legal's decision first. Using a supplier's finished product as supplied is not building. Building can make the organisation a provider (EU AI Act Articles 3(3) and 25), so Legal records which role the organisation holds before the use starts. A new use is Tier 3 until then. When Legal records the deployer role the tier is set again from the answers; when Legal records the provider role or another role the use stays Tier 3, because it is outside this policy's deployer governance. A use already running carries the hold as a condition with a date.

Evidence: Legal's recorded decision for any proposal to build on a supplier's model API, brand, sell or supply an AI system; the role reasoning on the EU AI Act worksheet (A08).

AG-21 Before an AI system monitors or evaluates staff, HR and Legal check the national rules on monitoring at work and on telling or consulting staff representatives. Where the system is high-risk, employers tell the workers' representatives and the workers affected before it is used (EU AI Act Article 26(7), from 2 December 2027 for Annex III systems).

Evidence: for each system that monitors or evaluates staff, the record of HR's and Legal's check of the national rules; where the system is high-risk, the notice to workers' representatives and the workers affected.

Data

AG-03 Follow the classification: Public information with no personal data in it into any tool; Internal only into a tool approved for Internal; Confidential only into a tool approved for Confidential; special category personal data never (P15 CL-14, CL-19). Personal data goes only into a tool approved for personal data, under processor terms (P06 clause CL-06), whatever the level of the information around it: personal data inside Public information does not go into just any tool. A collection, export or copy takes the highest level of anything in it (P15 CL-13).

Evidence: the approved list showing each tool's highest data level and whether it takes personal data; the result of the inventory check that compares each use's data with its tool (IV-10); the processor terms for each tool that takes personal data.

AG-14 Material that belongs to a customer, a supplier or another third party, or that is under a confidentiality agreement, is treated as Confidential and goes into an AI tool only if the contract allows it and the tool is approved for Confidential.

Evidence: the contract or confidentiality terms checked before any customer or supplier material went into a tool; the tool's approval for Confidential data.

AG-15 AI-generated code, scripts and configuration go through the same review, testing and approval as any other change before they reach production, and secrets never go into a prompt (P16 LM-10).

Evidence: change records showing review and testing of AI-generated code and configuration; the secret-scanning results for prompts and repositories where the organisation runs them.

Human oversight and disclosure

AG-07 A person who is competent to judge the output reads it before it is relied on, sent outside the organisation or published. That person has the authority to reject it. The inventory names who this is for each use. AI output is never treated as a verified fact, a legal opinion or a finished piece of code.

Evidence: for each use in the inventory, the named person who checks the output and has the authority to reject it; spot checks of outputs sent outside the organisation.

AG-08 Tell people when they deal with AI. A customer who talks to a chatbot is told so at the start. Realistic AI-generated images, audio or video of real people, places, objects or events are labelled as artificially generated or manipulated, and so is AI-generated text published to inform the public on a matter of public interest unless a person has reviewed it and holds editorial responsibility (EU AI Act Article 50, from 2 August 2026).

Evidence: the notice shown at the start of each customer-facing assistant; the labelling rule for generated images, audio and video, and a sample of published items.

The inventory and suppliers

AG-10 The inventory lists every use with an owner, a purpose, a tool, the highest data level, a tier, an approver, a status and a review date. Owners review their uses at the tier's interval, and the whole inventory is reviewed at least every [[6]] months. A trigger (A05) forces a review within [[10]] working days. Pending that review the AI governance lead may suspend an approved running use; the approvers of its tier decide whether it resumes.

Evidence: the inventory with every field completed; the review dates of each use; the record of the six-monthly review of the whole inventory and of each review started by a trigger; the record of any suspension of an approved running use and the approvers' decision on whether it resumes.

AG-11 A supplier of an AI tool, or of software with an AI feature, is assessed under the third-party pack before it receives Internal or Confidential data, and before a Tier 2 or Tier 3 use of it starts even with Public data (P06 TP-01, TP-05; P15 CL-16 asks for it for Confidential data only), and again on a material change (P06 TP-09). The contract carries the AI terms ST-1 to ST-8. A supplier that adds an AI feature gives notice (P06 clause CL-20), and the feature goes through intake before it is switched on.

Evidence: for each supplier that receives Internal or Confidential data, its decision under the third-party pack; the contract showing the AI terms ST-1 to ST-8; the notice of each new AI feature and the intake decision that followed.

Accountability and competence

AG-18 Everyone who uses or oversees an AI tool completes the AI essentials module (AL-01) before access is switched on, or within [[60]] calendar days of the plan's launch if they already have access, and refreshes it every [[12]] months. People in the roles of A09 take the role modules. The organisation keeps an internal record of what each person completed. No certificate is needed (EU AI Act Article 4).

Evidence: the internal literacy record for each person with access to an AI tool: module, date completed and next due; the list of people whose access was switched on after completion.

Records and incidents

AG-12 Keep the intake file, the assessment, the approval and its conditions for each use until the use ends and for [[3]] years after, or longer where law or a contract asks. Keep the literacy record (A09) for the same period. A high-risk system's logs that the organisation controls are kept at least 6 months (EU AI Act Article 26(6), from 2 December 2027 for Annex III systems).

Evidence: the intake file, assessment and approval for each use, kept for the period this policy sets; the literacy record; for any high-risk system, the log retention setting.

AG-13 Report an AI-related security event or mishandling at once through the incident route (P09 IM-01). The triggers that hand over are AT-1 to AT-8. Nobody is blamed for a report made in good faith. The incident pack decides whether it is an incident and what must be reported, and its clocks apply.

Evidence: reports made through the incident route that cite an AI trigger (AT-1 to AT-8); the incident pack's decision on each; the absence of any action against a person who reported in good faith.

Review, exceptions and measures

AG-19 The policy is reviewed at least every [[12]] months, and when the law, a standard, a major tool or an incident changes the picture. Everyone acknowledges it within [[10]] working days of joining and each year (P04).

Evidence: the document control table with the approval date and next review date; the acknowledgement record for joiners and for each yearly round.

AG-20 A departure from this policy is a P02 exception, scored and approved by the approver its band sets (EX-05). The Article 5 prohibitions (AG-05) and the rule on special category data (AG-03) take no exception.

Evidence: the entries in the exception register against this policy, each scored and approved at its band; no entry against AG-05 or AG-03.

AG-22 The AI governance lead reports the headline measures (AIM-01 to AIM-05) monthly to the security and IT leadership team, as counts such as 4 of 7, with every gap named. A measure is never combined into a score or a share.

Evidence: the monthly report of the five headline measures, each as a count with the gaps named.

Roles and responsibilities

Every AI use has one AI use owner, recorded by role in the inventory. The owner answers for the use and for what it produces. The AI governance lead owns this policy. One person may hold several roles in a small organisation, with one limit: nobody approves a use they own. Where a tier's approver owns the use, the executive decision-maker takes that approver's place.

The AI Governance Responsibility Matrix sets out who is responsible, accountable, consulted and informed for each of 16 activities under these rules. A Critical exception to any rule is approved by the board or its equivalent: the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management.

Compliance and consequences

How compliance is checked. The AI governance lead compares the inventory with single sign-on records, with the spending that P13 JML-12 discovers, and with a short survey of staff at least [[every six months]]. Line managers check that their teams use only approved tools. [[Internal audit]] tests the policy [[every year]], including one Tier 2 use from intake to review.

Measures. The AI governance lead reports five headline measures each month (AG-22). Each is a count with the gaps named. None is combined into a score or a share.

Consequences of not complying. Nobody is disciplined for a mistake they report at once, or for a report made in good faith (AG-13). Deliberately using an unapproved tool after being told to stop, putting Confidential information into a personal or free account, hiding a use, or putting special category data into any tool may lead to action under the [[disciplinary procedure]]. For a supplier, mishandling our information is a breach of the security terms of its contract, handled under them.

Exceptions

Any departure from these rules is requested, scored and approved under the Security Exception & Waiver Standard [[document ID]] (Security Exception, Waiver & Segregation of Duties pack), using the Security Exception Request & Approval Form, before the departure begins (AG-20). An exception names the rule, the use, the reason, the compensating measures and an expiry date, and is recorded in the Security Exception Register. Agreement by email, in a meeting or by a manager is not an exception.

AG-05 and AG-03 take no exception: the prohibitions of Article 5 of the EU AI Act, and the rule that special category data never goes into an AI tool. An exception never changes a legal duty. Personal data is protected under data protection law, and an incident is reported, exception or not.

Related documents

Definitions

Document control

Approval record

Review. This policy is reviewed at least every 12 months, and sooner after: a major incident, or an incident the document should have prevented; a material change to the organisation's activities, systems or suppliers; a change in law, regulation or a contract the document supports; an audit or assessment finding against the document; a significant change in the threats the document addresses. A change in the AI Act or its guidelines, a major new tool, and an incident that this policy did not prevent always trigger a review (AG-19).

Acknowledgement. Everyone in scope acknowledges the policy within [[10]] working days of joining and each year after (AG-19). The current approved version is published at [[location everyone in scope can reach]].

Worked example: the first seven weeks

EXAMPLE, not part of the policy. The organisation is the one used throughout the pack: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, an important entity under NIS2 in its Member State. Not a financial entity, so DORA's reporting duties do not apply. Replace it with your own, or delete this section before approval.

The seven uses at 30 Sep 2026. The tier is the intake method's, from the answers given.

The position for the leadership team: 4 of 5 AI uses in use or proposed have a current approval; 2 of 3 Tier 2 and 3 uses have a completed assessment; 0 approvals are past their review date; 104 of 131 people with an AI tool have completed AI essentials; 1 of 1 unapproved uses found were stopped in time.

Adapting this template

Small organisation

Regulated entity (NIS2, DORA, GDPR, EU AI Act)

IT and services run by suppliers

Framework references

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: Regulation (EU) 2024/1689 (the EU AI Act) as amended by Regulation (EU) 2026/1744; ISO/IEC 27001:2022 incl. Amd 1:2024; ISO/IEC 42001:2023 (by number and title only); NIST CSF 2.0; NIST AI RMF 1.0; Regulation (EU) 2016/679 (GDPR); as published and read on 8 October 2026.

ISO/IEC 27001 and ISO/IEC 42001 references name the clause or control this document relates to, by number and title only. ISO/IEC 42001 is a paid standard whose text was not read for this document. A reference does not say that meeting a clause or control meets any requirement of the EU AI Act.

This pack does not say which ISO/IEC 42001 or ISO/IEC 27001 controls, or which NIST AI RMF outcomes, meet a requirement of the EU AI Act. Each reference says what the source asks for and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met. The Commission’s guidelines explain how the Commission reads the Act. They are not binding, and only the Court of Justice of the European Union gives an authoritative interpretation of the Act. Member States lay down the penalties for infringements (Article 99(1)) and designate the authorities that enforce the Act, and no national text was read for these documents.