An acceptable use policy for staff using AI agents tells employees what they may ask agents to do, what data they may share, which outputs they must check, and what they must never do, such as giving an agent their login. It sits under your main AI agent policy and is written for every employee.
How is this different from the AI agent policy?
Your AI agent policy governs the organisation: who approves agents, how they are certified, what records are kept. The acceptable use policy governs the individual. It answers the questions a member of staff has on a Tuesday afternoon: can I paste this customer file in, can I send what the agent drafted without reading it, can I ask it to log in for me? The split between organisational bounds and individual behaviour is explained in agent governance is a bound, not a model.
Keep the two separate. The organisational policy changes when governance changes; the acceptable use policy changes when staff behaviour does. Staff should be able to read theirs in five minutes.
When should you issue it?
Before any member of staff gets access to an agent, and again with every significant change: a new agent, a new data class allowed, a new channel. Require acknowledgement on first access and annually after. If you use an agent to answer policy questions, make sure it draws from the current version; answering staff policy questions with an AI agent covers how.
The EU AI Act's Article 4 expects organisations using AI to take measures for a sufficient level of AI literacy among staff. An acceptable use policy alone does not meet that, but it is part of the evidence.
How do you fill in each clause?
Write each clause as an instruction with a reason. "Do not paste card numbers into an agent, because they would then sit outside our card data controls" is followed more often than "Card data is prohibited".
- Approved agents lists by name the agents staff may use. Anything else is unapproved.
- Data rules go by class: public, internal, confidential, customer personal data, special-category data, card data. Say which classes each approved agent may receive.
- Credentials must be explicit. An agent must never use a person's login; it acts under its own identity with its own bounds. The reasons are in whether an AI agent can use a person's login.
- Checking outputs says which outputs staff must review before use, and what "review" means.
- Reporting tells staff how to report an agent doing something wrong, without blame.
The template
- Purpose and scope. Who the policy applies to and which agents it covers.
- Approved agents. Named list, with what each is for.
- Unapproved tools. Rule on public AI tools and personal accounts.
- Data you may share. Table of data classes against approved agents.
- Data you must never share. Explicit list.
- Credentials and access. No sharing of logins, passwords or authentication codes with any agent.
- Checking outputs. Which outputs need review, and what review means.
- Sending and acting. Who sends agent drafts to customers, and under whose name.
- Disclosure to customers. When staff must tell customers an agent was involved.
- Reporting problems. Channel, what to include, no-blame statement.
- Breaches. How breaches are handled.
- Owner and review. Named owner, review frequency, version.
A worked sample
A hypothetical insurance broker, clauses 4 to 8.
4. Data you may share. The claims assistant may receive policy documents, claim forms and customer correspondence for open claims. The drafting assistant may receive internal documents and anonymised examples. Neither may receive data from closed files older than the retention period.
5. Never share. Card numbers, bank passwords, medical records beyond what the claim form contains, and anything about a colleague's employment.
6. Credentials. Never give an agent your login, a one-time code or a session link. If an agent asks for them, stop and report it. Agents act under their own accounts.
7. Checking outputs. Every claim decision letter drafted by an agent must be read in full by the handler before sending. Check names, policy number, amounts and the reason for the decision against the file.
8. Sending. Agent drafts go out under the handler's name only after the handler has read them. The handler is accountable for what they send.
The process for writing the parent policy is in how to write an AI agent policy.
Questions people ask
Should the policy ban public AI tools completely?
Most regulated firms ban them for any non-public data and allow them, if at all, for public information only. A blanket ban without an approved alternative tends to push use out of sight.
How do we know staff have read it?
Require acknowledgement on first access and annually, and test understanding with two or three scenario questions. A signature alone proves little.
Who should own the acceptable use policy?
Usually the chief information security officer or the head of operational risk, with input from HR and data protection. The owner must have authority to update it quickly.