Answer nine questions and get a complete AI acceptable use policy for your company. The policy updates as you type. Copy it, or have the PDF emailed to you.
This policy sets the rules for using AI systems at Acme Health. It applies to employees, contractors and any third party acting on behalf of Acme Health. It covers chat assistants, coding assistants, AI features inside other software, and AI agents, whether the model is hosted by Acme Health or by a provider.
Acme Health operates in healthcare. This policy supports Acme Health's obligations under HIPAA, SOC 2.
Only the following AI tools may be used for company work. Use of any other AI tool, including a personal account on an approved product, requires written approval from the Head of Security.
The following data must not be entered into any AI tool, prompt, file upload or agent context unless the Head of Security has approved the specific tool for that data type in writing.
A person must review AI output before it is sent to a customer, partner, regulator or the public, and before it is used in a decision about hiring, credit, coverage, care, discipline or any other matter that affects an individual.
The reviewer is accountable for the output. AI-generated content must be checked for accuracy, fabricated citations, and leaked confidential data before use.
AI agents that call tools, browse, execute code or act on behalf of a user are permitted only when the agent and every tool or MCP server it can call appear on the approved list kept by the Head of Security.
An agent may hold only the permissions of the person or service it acts for. Write access to production systems, financial systems and customer records requires explicit approval for each agent.
Acme Health records AI usage with the user identity, the tool or model used, the time, and the policy decision taken. These records are retained for 1 year and are available to the Head of Security, internal audit and regulators on request.
Any suspected leak of data into an AI system, unexpected agent behavior, or output that harms a person must be reported to the Head of Security within one business day. Reports are handled under Acme Health's existing incident response process.
Violations of this policy may result in loss of access to AI tools and disciplinary action under Acme Health's code of conduct. The Head of Security owns this policy and reviews it at least once a year and after any material change to the AI tools in use or to applicable regulation.
Effective date: [insert date]. Approved by: [insert name and title].
This template is provided for general information and is not legal advice.
The generated policy has eight sections: scope, approved tools, prohibited data, human review, AI agents and tool access, logging and retention, incident reporting, and enforcement. Each answer in the form changes the matching sections, so a healthcare company that bans PHI in prompts and a SaaS company that allows approved coding agents get different documents.
A document tells people what to do. The DeepInspect gateway applies the same rules to HTTP traffic between users, agents, and LLM APIs, by identity and data type, and writes an audit record for each decision. The AI Readiness Check shows where your current AI usage differs from your policy.