AI acceptable use policy template for Ontario businesses
A free, editable AI acceptable use policy for Ontario businesses, in Word and PDF. It covers approved tools, what information can go into them, human review, hiring disclosure and incident reporting, with the Ontario and federal rules behind each part listed and linked.
Reviewed by the ITRS security team · Last updated
Download the template
The template is free to use and adapt for your own organization. Download the editable Word version or the PDF version. Replace everything in square brackets, delete what does not apply, and have your legal counsel review it before you adopt it.
It is five pages: twelve short sections your staff can actually read, an acknowledgement form, and an appendix listing the law and guidance behind each part, checked on November 10, 2026.
What the template covers
| Section | What it sets out |
|---|---|
Purpose and scope | Who the policy applies to, including contractors, and which tools count: chat assistants, AI features inside existing software, meeting note-takers, browser extensions. |
Approved tools | A table of approved tools, the company account to use for each, and the highest class of information each may receive. Everything else is unapproved until added. |
Prohibited uses | Personal AI accounts for work, final decisions about people without human review, unapproved plugins and note-takers, and connecting AI tools to mail or files without IT approval. |
Information rules | Four classes (public, internal, confidential, restricted) with examples, and which may go into which tools. Restricted information never goes into AI tools. |
Human review | A named person checks every output before it is used and is accountable for it. |
Clients | When to tell a client that AI materially shaped work delivered to them. |
Hiring and HR | The Ontario job-posting disclosure rule, bias checks and human decisions, and an optional Quebec clause. |
Monitoring | Whether AI use is monitored, tied to your Ontario electronic monitoring policy. |
Security and incidents | Company accounts with MFA, prompt retention, and reporting when personal information goes where it should not. |
Training, exceptions, review | Training at joining and yearly, written exceptions with an end date, and an annual review. |
The Ontario and federal rules behind it
There is no general AI law for Ontario businesses yet, but several existing rules already touch how staff use AI. The template is built around these. Laws change, so confirm the current position with counsel.
| Rule | What it requires | Who it applies to |
|---|---|---|
Ontario Employment Standards Act, 2000, s. 8.4 | A publicly advertised job posting must say so if AI is used to screen, assess or select applicants. In force for postings from January 1, 2026. | Employers with 25 or more employees on the day the job is posted |
Ontario Employment Standards Act, 2000, Part XI.1 | A written policy on electronic monitoring of employees, in place before March 1 of each year. | Employers with 25 or more employees on January 1 |
PIPEDA | Personal information entered into an AI tool is still covered. Breaches with a real risk of significant harm must be reported to the Privacy Commissioner of Canada and the people affected told as soon as feasible, and every breach must be recorded. | Private businesses in Ontario, which has no private-sector privacy law of its own |
Quebec private-sector privacy act, s. 12.1 | Notice, an explanation on request and a human review for decisions based exclusively on automated processing of personal information. | Businesses making such decisions about people in Quebec |
Enhancing Digital Security and Trust Act, 2024 (Bill 194) | AI accountability, risk management and public information rules. | Prescribed Ontario public sector entities, not private businesses |
Where the rules come from
- Job-posting AI disclosure, the 25-employee threshold and the January 1, 2026 start: Ontario's guide to the ESA.
- Electronic monitoring policies: Ontario's guide to the ESA.
- Breach reporting, notice and records: PIPEDA ss. 10.1 to 10.3. Ontario businesses fall under PIPEDA: Information and Privacy Commissioner of Ontario.
- Generative AI and personal information: the federal, provincial and territorial privacy regulators' principles for generative AI (December 7, 2023), which say to use de-identified information in prompts where possible and that accountability for decisions stays with the organization.
- Security risks of staff pasting sensitive data into prompts, and the advice to have a usage policy with oversight: Canadian Centre for Cyber Security, ITSAP.00.041.
- Automated decisions in Quebec: s. 12.1 of the private-sector act. Ontario public sector AI rules: Enhancing Digital Security and Trust Act, 2024.
- Discrimination in employment: the Ontario Human Rights Commission has warned that AI in hiring can repeat and amplify existing bias.
Is there a federal AI law?
Not for private businesses. The proposed Artificial Intelligence and Data Act was part of Bill C-27, which died when Parliament was prorogued in January 2025. Bill C-36, the proposed Protecting Privacy and Consumer Data Act, was introduced on June 15, 2026 and, as of November 10, 2026, is at second reading in the House of Commons. It is a privacy bill, and it is not law. Until something passes, PIPEDA, the ESA and human rights law are the rules that apply.
How to adapt it in an afternoon
List the AI tools already in use
Ask each team, and check which AI apps staff have connected to Microsoft 365 or Google Workspace. Our guide to discovering shadow AI covers how.
Decide which to approve
For each tool, check where data is stored, whether the vendor trains on it, how long it is kept and what admin controls exist. Approve company accounts only.
Fill in the information classes
Replace the examples with the information your business actually holds, and mark what is restricted.
Check the hiring and monitoring sections
Count your employees. At 25 or more, the job-posting disclosure and the electronic monitoring policy apply.
Get it reviewed, then train
Have counsel review it, walk staff through it, and collect signed acknowledgements.
Questions about the template
Yes. Download it, edit it and use it for your own organization. There is no form to fill in.
No Ontario law requires a private business to have an AI acceptable use policy. But employers with 25 or more employees must disclose AI use in public job postings and must have a written electronic monitoring policy, and every business remains responsible under PIPEDA for personal information staff put into AI tools. A policy is the simplest way to show you manage that.
No. The Employment Standards Act rule does not apply to an employer with fewer than 25 employees on the day the job is posted. Part-time and casual employees each count as one.
The template says no: work goes through company accounts on approved tools, where the business controls retention, training use and access. Free personal accounts give you none of that.
Our AI acceptable use policy guide explains what a policy should cover and why. This page is the ready-to-edit document, with Ontario's employment rules built in.
Want help putting it in place?
A template is a starting point. We help organizations build the rest: an inventory of the AI tools already in use, risk tiers and an approval process, and technical controls in Microsoft 365 or Google Workspace that match the policy. See AI governance and AI tool risk assessments.
Related reading.
- GuideAI acceptable use policy: what to includeStaff are already using generative AI tools. A short, clear acceptable use policy tells them which tools are approved, what information must never go in, who is…
- GuideFinding the AI tools your staff already useBefore you can write a sensible AI policy, you need to know what is already in use.
- GuideAI meeting notetakers: privacy and confidentiality risksAI notetakers join calls, record everything, and send summaries to everyone on the invite.
- ServiceAI governance and responsible-use policyYour staff are already using generative AI. Governance decides which tools are allowed, what data can go into them, who approves new uses and how leadership keeps…
- ServiceAI tool risk assessmentsBefore a new AI tool touches client, patient or employee data, someone should check where that data goes, whether it trains the vendor's models, how long it is kept and…
- PracticePrivacy, Data Governance & AIPIPEDA and Quebec Law 25 readiness, data mapping, breach notification and AI governance.
Not sure what your obligations require of your systems?
Speak with our privacy practice. We are staffed 24/7. Active incident? Call (289) 582-9930, 24/7.