Whether it is IT-approved or not, chances are someone on your team is using ChatGPT, Copilot, or an AI note-taker right now. The question is not if your business is using AI. It is whether you are managing that use, or hoping for the best.
A real AI Acceptable Use Policy (AI AUP) is not a document you file away. It is a working system with four moving parts. Here is how to build an AI Acceptable Use Policy, step by step. (Plus a free template to make it easy!)
Step 1: Acknowledge AI Is Already in Your Workplace
Before you write a single rule, say the thing out loud: AI is being used in your business today. Pretending otherwise just pushes it into the shadows (what we calls "Shadow AI", similar to "Shadow IT"), where unapproved tools quietly collect company data with zero oversight.
Start your policy by naming the reality. Tell your team AI is welcome, that you want to make it safe rather than banned, and that this policy exists to protect the business, your clients, and their own work. That tone matters. A policy that reads like a lockdown gets ignored. One that reads like a partnership gets followed.
Step 2: Classify Your Data
Not all data carries the same risk, so not all data should be treated the same way. Before anyone pastes a document into an AI tool, they need a simple gut check:
- Public Data (marketing copy, general research) is safe to use freely.
- Internal Data (memos, process docs, draft emails) needs anonymization first.
- Restricted Data (client PII, financials, passwords, API keys) never goes into an AI tool. Period.
Give your team a quick reference table, not a legal brief. If they cannot classify a document in under 10 seconds, the rule will not stick.
Step 3: Specify Which Tools Are Allowed
Not every AI tool meets the same security bar. Some train their models on whatever you type into them. Others store data overseas, outside the reach of your compliance requirements. Decide which tools your team can use, vet them for privacy and security, and publish the list.
Just as important: give people a path to request new tools. If someone finds something useful, they should be able to ask IT to review it, not go around you. A policy that only says "no" invites workarounds. A policy that says "ask us" keeps everyone inside the fence.
Step 4: Train Your Staff
A policy nobody understands is a policy nobody follows. Make AI training a condition of access, not an afterthought. At minimum, your team should walk away knowing:
- How to spot and handle a hallucination (AI confidently stating something false).
- Why human review is non-negotiable for anything client-facing, financial, or HR-related.
- What to do if they accidentally paste something they should not have (hint: report it immediately, no blame).
If you are a client of ours, we have AI training available in our Lighthouse Academy!
Step 5: Bring It All Home with a AI Use Policy
This is where the pieces connect. Your AI Use Policy is the single document that defines, in plain language, how your business actually uses AI: which tools, for which tasks, under which data rules, reviewed by whom. It is the practical companion to your AUP, the part your team references day to day instead of flipping through a 15-section policy.
You do not have to build this from scratch. Download our editable AI Use Policy template, built from the same framework we use with our own clients, and customize it to fit your business in an afternoon.
Get Your Free AI Use Policy Template
One More Step We Recommend: Share It With Your IT Partner
If Lighthouse supports your IT, send us your completed AI Use Policy. We will align our own AI-assisted work on your account to match your rules, so when we help you, we are working inside the boundaries you have set, not outside them.
Need a Secure, Policy-Friendly AI Tool?
If you are still shopping for an approved AI tool, take a look at Hatz AI. It is built to meet most AI Use Policy requirements and security concerns out of the box, so you spend less time vetting tools and more time using them.