Generative AI acceptable-use policy
Rules for anyone who uses an AI tool in the course of their work.
- Version
- 1.0
- Review
- every 12 months
1. Purpose and scope
This policy sets the rules for using generative artificial intelligence tools within the organisation. It applies to employees, executives, interns, temporary staff and contractors acting on its behalf, whatever device they use. It supplements, without replacing, existing IT-security and confidentiality rules.
2. Principles
- Human responsibility — AI is a tool; the person using it remains responsible for what they produce, send or decide.
- Confidentiality — a tool only receives the data it is allowed to receive (section 4).
- Accuracy — all generated content is checked before use; AI can be confidently wrong.
- Transparency — AI use is not concealed when it matters to the recipient.
- Respect for people and the law — no discriminatory, intrusive or unlawful use.
3. Authorised tools
- Microsoft Copilot — in the version subscribed by the organisation, with a work account.
Any other tool, extension or AI feature built into software must be approved by the AI lead before professional use. Free or personal versions of consumer tools may only be used with public information.
4. Which data, in which tool
| Data | Examples | Validated tool | Unvalidated consumer tool |
|---|---|---|---|
| Public information | website, press releases, published documentation | Allowed | Allowed |
| Non-sensitive internal documents | procedures, templates, minutes without names or figures | Allowed | Conditional — After removing names, figures and client references. |
| Confidential information | strategy, unpublished financials, ongoing deals | Conditional — Within the distribution scope of the source document. | Forbidden — No contractual guarantee on retention or reuse of the data. |
| Personal data | names, emails, phone numbers of staff, clients or candidates | Conditional — Only the data the task needs; pseudonymise where possible; never a profile of or a decision about a person without human review. | Forbidden — Forbidden: no contractual basis for this processing. |
| Special-category data (GDPR art. 9) | health, opinions, trade-union membership, biometrics, sexual orientation | Conditional — Only within a use covered by an approved data-protection impact assessment (DPIA). | Forbidden — Forbidden in all circumstances. |
| Client data and professional secrecy | client files, documents under NDA, privileged material | Forbidden — Not allowed: confidentiality commitments to clients come first. | Forbidden — Forbidden: would breach your confidentiality commitments. |
| Secrets and credentials | passwords, API keys, tokens, access codes | Forbidden — Never, in any tool: a pasted secret is a compromised secret. | Forbidden — Never. |
| Proprietary source code | your applications' code, internal scripts | Conditional — No secrets or keys in the pasted code; human review before anything ships. | Forbidden — Validated tool only. |
If in doubt about which category data falls into, apply the strictest rule and ask.
5. Rules of use
Do
Don't
6. Transparency and human oversight
- Any AI-generated content intended for outside use, or used as the basis for a decision about a person, is reviewed by a competent person before use.
- When content shared externally was mostly produced by AI, the recipient is told.
- No decision with significant effects on a person (hiring, appraisal, sanction, refusal of service) is taken solely on the basis of automated processing.
7. Intellectual property and confidentiality
- Do not submit third-party works or documents you have no right to use.
- Check that generated content does not reproduce protected text, images or code before reusing it.
- Content produced at work is subject to the same confidentiality rules as any other internal document.
8. If something goes wrong
- Tell the AI lead immediately — for example if personal or confidential data was pasted into an unvalidated tool.
- Do not try to erase the traces yourself: note the tool, date, time and data involved.
- When a personal-data breach is likely to result in a risk to people, the organisation has 72 hours after becoming aware of it to notify the supervisory authority (GDPR art. 33): every hour of delay counts.
9. Training
Since 2 February 2025, the EU AI Act requires organisations that use AI systems to take measures to ensure a sufficient level of AI literacy among their staff (Article 4). The organisation trains each user before access is opened, then whenever the tools change significantly, and keeps a record of that training.
10. Governance and review
- AI lead: to be named — approves tools, answers questions, keeps the register of uses.
- Data protection: a lead is named for uses involving personal data.
- The policy is reviewed every 12 months, and whenever a tool is added or regulation changes significantly.
- Breaching the policy may lead to access being suspended, without prejudice to applicable disciplinary rules.
11. Acknowledgement
I confirm I have read and understood this policy and will follow it.
Template generated by i-avantage's “AI usage policy” tool from your answers, in your browser. Adapt it to your context and have it reviewed by your DPO or legal counsel; depending on your organisation, introducing such a policy may require informing staff representatives.