# AI acceptable-use policy — draft for approval

I use this template as a starting point. I adapt it to our organisation, contracts, applicable law and assessed use cases before approving it.

- Policy owner:
- Approver:
- Version / effective date / next review:
- Scope (people, systems and countries):

## What I approve
I maintain a register of approved AI uses, named business owners, tools, data classes and required human review. Approval is specific to the intended use and model/service version.

## Data and access
I allow only the data categories explicitly approved for the tool. I prohibit passwords, secrets and restricted personal or commercial data in unapproved tools. I require least-privilege access, appropriate retention and approved vendor terms.

## Human oversight
I require a competent person to verify accuracy and sources before using an AI output in a consequential decision or external commitment. I do not authorise autonomous production changes through this policy. Any write action needs a separately approved capability and workflow.

## Transparency and literacy
I identify applicable AI interaction and content-disclosure duties for each use. I provide role-appropriate training and record attendance and exercises. I give affected people an escalation route where appropriate.

## Uses requiring separate assessment
I require specialist review before employment, education, essential-service, biometric or other potentially regulated high-risk uses. I reject prohibited practices and document the legal basis for classification decisions.

## Monitoring and changes
I record material failures, suspected data disclosure and unsafe outputs through [incident route]. I suspend an unsafe use when necessary. I reassess approval after a model, supplier, audience, data or intended-purpose change.

## Exceptions
I document the reason, risk owner, authorised approver, controls, expiry and review date for every exception. This template does not establish legal compliance.