Draft an AI acceptable-use policy for staff

Draft an AI acceptable-use policy for {{organization}}, for {{audience}} to read and follow. The aim is rules people can apply in the moment: which AI tools they may use, for what, and with what information. It is a draft for {{policy_owner}} to review, and for a qualified lawyer to check before it is issued.

Decisions we have made:
Approved tools and account types: {{approved_tools}}
Information that may and may not go into each tool: {{data_rules}}
Uses we want to encourage: {{encouraged_uses}}
Uses that are not allowed: {{prohibited_uses}}
How to request a new tool, and who approves it: {{approval_process}}

Existing policies the new one must agree with, with section numbers:
"""
{{existing_policies}}
"""

Use these numbered sections:
1. Purpose and scope: who it covers and which tools.
2. Approved tools: a table with the columns Tool, Approved for, Information allowed, Information not allowed.
3. Information rules: what must never be entered, with concrete examples drawn from our data rules.
4. Acceptable uses, with two or three examples each.
5. Not allowed.
6. Checking AI output: the person who sends or publishes something is responsible for it and checks facts, figures and quotes first.
7. New tools and exceptions.
8. Mistakes and questions: what to do if someone enters information they should not have, and whom to tell.
9. Review date.

Then add "Quick rules": up to 7 one-line rules for a poster or onboarding slide.

Keep the policy under 1,200 words, at about a grade 8 reading level, because a policy staff do not read protects no one. The tone should be plain and direct, like a colleague explaining the rules, not a legal notice. Write rules that can be followed or broken, for example "Do not paste customer contracts into any tool not listed in section 2", not "Be careful with sensitive data".

Use only our decisions and existing policies. After each rule, cite its source in brackets, for example [Decision] or [IT Security Policy 4.2], so the reviewer can trace it. Do not name tools we have not listed, do not describe any tool's security or data handling, and do not state what any law requires, because that is for counsel to confirm.

If anything is missing from our decisions, or they contradict an existing policy, do not fill the gap. List it under "Decisions still needed".

End with "Take to a qualified lawyer": the points counsel should check, such as monitoring of staff use, ownership of AI-generated work, data protection and any rules specific to our sector.