AI acceptable use policy: what to include

Start by saying what the policy covers: generative AI chat assistants, AI features built into software you already use (Microsoft 365 Copilot, meeting transcription, writing assistants in your CRM), browser extensions, and AI notetakers that join meetings. Then name the approved tools, the account type staff must use, and the route to request something new.

The distinction that matters most is between business accounts covered by a contract with data protection terms, and free consumer accounts where your data may be retained or used to improve the service. The Canadian Centre for Cyber Security's generative AI guidance (ITSAP.00.041) advises organizations to select vendors carefully and to be careful about what information they provide to these tools.

Be concrete. 'Do not share confidential information' is too vague to follow. List the categories, and tie them to your data classification policy if you have one.

• Client or patient personal information, including names combined with any other detail
• Social insurance numbers, banking details, health information, ID documents
• Privileged or confidential legal material and client files
• Passwords, API keys, network details and security configurations
• Unreleased financial results, deal information or pricing
• Source code or documents covered by confidentiality agreements, unless the tool is approved for it

Generative AI produces fluent text that can be wrong, invented or out of date. The Office of the Privacy Commissioner of Canada's principles for responsible, trustworthy and privacy-protective generative AI technologies (2023) include accountability and accuracy among their core principles. Your policy should say that the person who uses the tool owns the result.

• Every AI-assisted output is reviewed by a person before it leaves the organization or is relied on
• Facts, figures, citations and legal references are checked against the source
• AI is not used to make final decisions about individuals (hiring, discipline, credit, eligibility) without documented human review
• Staff record significant AI use in their working file where the work product matters

Decide when clients are told that AI was used. Some professions and some client contracts already require disclosure or consent; others leave it to judgment. A sensible default is to disclose where AI materially shaped advice or deliverables, where a client's confidential information was processed by an AI tool, and whenever a client asks. Professionals should check their regulator's guidance, since several Canadian professional regulators have issued notes on generative AI.

Policy only works if IT can back it up. Require company accounts with single sign-on and multi-factor authentication for approved tools, so access ends when someone leaves. Check the vendor's settings for chat history retention and whether your data is used for training, and set them deliberately. Where the platform allows, keep audit logs of usage, and make sure prompts and outputs fall under your retention schedule and legal holds like any other business record.

Give staff a short session with real examples from their own work: what is fine, what is not, and why. Explain how to report a mistake, such as pasting client data into the wrong tool, without fear; early reporting is what lets you contain it. Set an exception process with a named approver, and review the approved tool list every six months, because the products change quickly.

We help organizations draft AI policies that match the tools they actually license, configure those tools to enforce the policy, and find the unapproved tools already in use.