# Corporate AI Acceptable Use Policy (Template)

- **Organization:** [Company Name]
- **Policy owner:** [CISO / DPO / IT Lead]
- **Version:** 1.0
- **Review date:** [YYYY-MM-DD]
- **Next scheduled review:** [YYYY-MM-DD]

## 1. Purpose and scope

This policy defines how employees, contractors, and interns at [Company Name] may use generative AI assistants, copilots, browser extensions, and AI agents for work. It aligns operational rules with GDPR data-protection principles and EU AI Act (Regulation (EU) 2024/1689) Article 4 AI literacy expectations.

This policy applies to all corporate work, whether performed on managed devices, approved cloud tenants, or personal devices authorized under company BYOD rules.

## 2. Approved AI tools and account rules

Only tools listed in our internal AI Register may be used for company work, and only under the approved account context:

| Tool                             | Approved account type                 | Permitted use cases                                             | Status     |
| -------------------------------- | ------------------------------------- | --------------------------------------------------------------- | ---------- |
| [e.g. Microsoft 365 Copilot]     | Corporate SSO account only            | Internal drafting, meeting summaries, approved SharePoint sites | Approved   |
| [e.g. ChatGPT Enterprise / Team] | Provisioned work workspace only       | Code review on non-secret snippets, synthetic analysis          | Approved   |
| [e.g. Personal AI accounts]      | Personal email or signed-out web chat | Publicly released text only; zero internal or customer data     | Restricted |

Do not sign up for new AI tools or connect AI note-takers, browser extensions, or OAuth apps to Google Workspace, Microsoft 365, Slack, or code repositories without prior IT/Security approval.

## 3. Data classification rules for prompts and uploads

Treat prompts, uploaded files, and pasted snippets according to the highest sensitivity class they contain:

- **Green (Allowed in approved work accounts):** Public marketing copy, published documentation, generic code syntax questions, and synthetic or fictional examples.
- **Amber (Allowed ONLY in contracted enterprise tenants with zero external model training, or after fictionalization/masking):** Internal memos, non-identifiable operational metrics, and sanitized templates where names, emails, IBANs, and client identifiers are replaced with fictional placeholders.
- **Red (Strictly prohibited in unapproved tools; never paste raw values):** Customer or employee PII (names, emails, phone numbers, national IDs), health or HR records, credentials, API keys, session tokens, source code from private repositories unless explicitly covered by an approved coding assistant, unpublished financial results, M&A files, and legal privilege material.

## 4. Connected AI agents, OAuth apps, and browser extensions

Approving a conversational chatbot does not authorize an AI agent or connector to read mail, modify shared drives, join meetings, or act on your behalf.

1. Any AI tool requesting OAuth scopes, API tokens, mailbox access, calendar access, or browser extension host permissions requires a separate review by [Security / IT Owner].
2. Every approved AI agent must have a named business owner, documented scopes, and a designated person able to revoke its credentials immediately.

## 5. Human review and EU AI Act transparency

1. **Mandatory human verification:** Employees remain accountable for every output used in customer deliverables, code commits, financial records, HR decisions, or legal documents. Verify facts, citations, and calculations against primary sources.
2. **Prohibited practices:** Never use AI systems for prohibited practices under EU AI Act Article 5 (such as workplace emotion recognition or manipulative scoring) or unapproved high-risk HR screening.
3. **Transparency:** Disclose AI-generated external content where required by law, customer contract, or company editorial standards.

## 6. Security controls, logging, and incident reporting

- Managed browsers enforce company AI security rules, including warnings, automated prompt masking of sensitive identifiers, or blocks on unapproved AI domains and uploads.
- Security logs retain policy classifications and technical metadata needed to investigate exposure without building an unnecessary archive of raw prompts.
- **Mistaken paste or upload:** Report accidental submission of Red-class data immediately to `[security@company.example]` or `[#security-help]` so IT/Security can rotate secrets, check account state, and assess notification duties without blame.
- **Exceptions:** Time-boxed exceptions (maximum 90 days) require sign-off from both the business owner and `[Security / DPO]`.

## 7. Employee acknowledgement

I confirm that I have read this Corporate AI Acceptable Use Policy, understand the approved tools and Red/Amber/Green data rules, and know how to request a new AI tool or report an accidental data submission.