What to take away
An effective AI acceptable use policy fits on one page, names the exact tools and work accounts employees may use, defines Red, Amber, and Green prompt data tiers with concrete examples, separates conversational chat from OAuth-connected agents, and satisfies EU AI Act Article 4 AI literacy duties.
Editable policy + CSV register
Download the AI Acceptable Use Policy template and register
Start from a concise one-page Markdown policy ready for intranet or PDF export, paired with a CSV register covering approved accounts, Red/Amber/Green data tiers, OAuth scopes, and EU AI Act Article 4 checks.
Free Markdown and CSV files. No email required.
How to adapt and roll out this policy
- Open the Markdown policy template, replace the bracketed placeholders with your approved tools, security contact, and exception approver, and keep the document to one readable page.
- Populate the CSV register in UTF-8 with one row per approved, restricted, or blocked AI tool, recording the exact account context (corporate SSO vs personal) and any OAuth or agent scopes.
- Define Red, Amber, and Green input examples using synthetic values from your industry so employees recognize prohibited pastes immediately.
- Export the finalized policy to PDF if you require recorded employee acknowledgement during onboarding or recurring awareness training.
- Test managed-browser warnings, prompt masking, or blocks on a pilot group before announcing enforcement across the company.
Free download, no email required. Adapt this operational template with your DPO or legal counsel for your specific sector and works-council obligations. All worked examples are fictional.
Turn your written AI policy into live browser controls
See how Elba pairs PDF policy acknowledgement in Training with real-time prompt masking, sensitive prompt blocking, and account-context detection across Chrome, Edge, Firefox 128+, and Safari 26+.
See AI policy enforcement in Elba1. Why ten-page AI bans fail in practice
Most corporate AI policies fail in one of two ways: either they ban generative AI outright without offering an approved workspace, pushing employees onto personal phones and signed-out tabs, or they state vague principles such as "do not enter confidential information" without defining which account or dataset is in scope.
Since 2 February 2025, Article 4 of the EU AI Act (Regulation (EU) 2024/1689) requires providers and deployers of AI systems to take measures ensuring a sufficient level of AI literacy among staff and contractors operating AI on their behalf. Pairing a concise, role-relevant acceptable use policy with short practical training and technical guardrails addresses both operational data risk and regulatory expectations.
References: EUR-Lex - Regulation (EU) 2024/1689 (EU AI Act, Article 4 AI literacy) · CNIL - AI how-to sheets and GDPR compliance recommendations
2. Six clauses every corporate AI policy needs
Keep the employee-facing text short enough to read in five minutes and move tool-by-tool changes into a linked register so you do not have to reissue the entire policy whenever you approve a new assistant.
| Policy clause | Operational rule to state clearly | Evidence to retain |
|---|---|---|
| Approved tools and accounts | Which AI workspaces are approved, and whether corporate SSO is mandatory | Dated AI tool register with named business owner and signed DPA |
| Green / Amber / Red data tiers | Which inputs may go to approved work accounts, require masking, or stay off-limits | Synthetic examples per department (engineering, sales, HR, finance) |
| AI agents, OAuth, and extensions | Separate approval before granting mailbox, drive, calendar, or browser host permissions | OAuth grant review and named owner able to stop the agent |
| Human verification and prohibited uses | Mandatory fact-checking on outputs; zero EU AI Act Article 5 prohibited workplace practices | Editorial/code review guidelines and AI literacy training completion |
| Browser controls and privacy | What managed browsers warn on, mask, or block, and what metadata is logged | DPIA / employee transparency notice aligned with GDPR Articles 13 and 35 |
| Incident reporting and exceptions | Blameless channel to report accidental secret or PII pastes; 90-day cap on exceptions | Incident response log and dated exception register |
References: EUR-Lex - Regulation (EU) 2024/1689 (EU AI Act, Article 4 AI literacy) · EUR-Lex - Regulation (EU) 2016/679 (General Data Protection Regulation) · CNIL - AI how-to sheets and GDPR compliance recommendations
3. Define Green, Amber, and Red inputs with synthetic examples
Employees decide what to paste in seconds. Replace abstract legal definitions with a three-tier traffic light tied to account context. A prompt that is acceptable inside a contracted enterprise workspace with zero model training can still constitute an unauthorized disclosure in a personal consumer account.
CNIL and ANSSI guidance both emphasize data minimization at the prompt layer: strip direct identifiers whenever a task works just as well with placeholders, and keep credentials, regulated health or HR records, and customer exports out of general-purpose chat interfaces.
- Green (Public and synthetic): published documentation, public press releases, standard syntax questions, and fictionalized templates.
- Amber (Internal work data): internal memos, non-personal metrics, and sanitized drafts, allowed only in contracted corporate AI workspaces or after replacing identifiers.
- Red (Restricted PII, secrets, regulated data): customer or employee PII, API keys, tokens, private repository code outside approved coding tools, unpublished financials, and legal files.
References: EUR-Lex - Regulation (EU) 2016/679 (General Data Protection Regulation) · ANSSI - Security recommendations for a generative AI system
4. Separate chat prompts from OAuth connectors and meeting bots
Approving ChatGPT, Claude, Gemini, or Copilot for drafting text should never imply permission to connect an AI meeting recorder to Google Calendar, grant an OAuth assistant access to Google Drive or Microsoft Graph, or install an unreviewed browser extension.
Include an explicit clause requiring IT or Security sign-off before any AI tool receives OAuth scopes, API keys, webhook tokens, or browser extension permissions. Every connected agent needs a named owner, least-privilege scopes, and a documented kill switch during incident response or employee offboarding.
References: ANSSI - Security recommendations for a generative AI system · NCSC - Thinking carefully before adopting agentic AI
5. Collect employee acknowledgement and back rules with browser guardrails
A PDF sitting unread in a shared drive neither changes daily habits nor demonstrates EU AI Act Article 4 literacy. Roll the policy out in three connected steps: publish an approved AI path first so staff have a legitimate workspace, assign a brief onboarding and annual refresher with recorded acknowledgement, and enforce clear rules in managed browsers.
When employees paste an IBAN, email address, or API key under deadline pressure, inline browser prompt masking or targeted blocking prevents accidental leaks far more reliably than an annual reminder alone.
References: EUR-Lex - Regulation (EU) 2024/1689 (EU AI Act, Article 4 AI literacy) · Elba Documentation - Document acknowledgement in Training · Elba Documentation - Browser extension security capabilities
How Elba operationalizes your AI acceptable use policy
Elba connects written policy to daily execution across both training and browser security. In Training, administrators can attach your finalized AI Acceptable Use Policy PDF (up to 10 MB) to a custom course or onboarding bundle so employees read and acknowledge the exact version via web, Slack, Microsoft Teams, or Google Chat, with versioned proof exports (up to 100 proofs per ZIP archive plus CSV reporting). Organizations already eligible for Elba’s Charter module retain that workflow as well.
On managed Chrome, Edge, Firefox 128+, and Safari 26+ (macOS 26+) browsers, Elba detects ChatGPT, Claude, Google Gemini, and Microsoft Copilot usage, distinguishes work, personal, and signed-out account status locally, blocks unauthorized AI domains or sensitive prompts, and can automatically mask PII, PHI, credentials, financial identifiers, and confidential terms in-draft before submission without storing raw prompts.
References: Elba Documentation - Document acknowledgement in Training · Elba Documentation - Browser extension security capabilities
AI acceptable use policy rollout checklist
Your checks stay on this page and reset when you reload it.
Common questions
Is an AI acceptable use policy mandatory under the EU AI Act?
The EU AI Act does not prescribe a single document template for every deployer, but Article 4 (applicable since 2 February 2025) requires deployers to take measures ensuring sufficient AI literacy for staff and contractors using AI systems on their behalf, taking into account their technical knowledge, context, and affected persons. A clear policy paired with role-adapted training and technical guardrails is the standard operational way to evidence those measures.
Should we ban personal ChatGPT, Claude, and Gemini accounts on work laptops?
Restricting work data to corporate SSO workspaces with a Data Processing Addendum and zero model training is strongly recommended. Rather than blocking every AI domain before offering an alternative, provision at least one approved corporate assistant first, then block or mask sensitive inputs on personal or signed-out sessions.
How often should employees re-acknowledge our AI policy?
Collect acknowledgement during employee onboarding and re-send whenever you materially change approved data tiers, monitoring controls, or connected-agent rules, alongside an annual refresher.
Does a signed AI policy satisfy GDPR when employees paste customer data?
No. Under GDPR Articles 28 and 32, the controller remains responsible for using authorized processors under a valid DPA and implementing appropriate technical and organizational security measures. Pair your policy with contracted enterprise tenants, access controls, and browser DLP or prompt masking.
Sources & further reading
Primary documentation used to review this guide. Product settings and edition requirements can change; check the linked documentation before making changes.
- EUR-Lex - Regulation (EU) 2024/1689 (EU AI Act, Article 4 AI literacy)
- EUR-Lex - Regulation (EU) 2016/679 (General Data Protection Regulation)
- CNIL - AI how-to sheets and GDPR compliance recommendations
- ANSSI - Security recommendations for a generative AI system
- NCSC - Thinking carefully before adopting agentic AI
- Elba Documentation - Document acknowledgement in Training
- Elba Documentation - Browser extension security capabilities