Enterprise generative AI acceptable-use policy: a practical checklist

Overview

Turn broad principles into enforceable rules for approved tools, sensitive data, human review, prohibited uses, incidents, training, and evidence.

What to review

1. Define scope across employees, contractors, APIs, copilots, embedded features, local models, and customer-facing systems; name policy owners and approvers.
2. Maintain approved, restricted, and prohibited tool/use lists based on risk, data class, jurisdiction, and business impact.
3. Ban entry of secrets, privileged material, regulated data, personal data, source code, or customer content unless the approved workflow expressly protects it.
4. Require qualified human review for legal, employment, credit, health, safety, financial, public, or other consequential output.
5. Set rules for accuracy checks, source verification, copyright, disclosure, recordkeeping, access, security testing, and output reuse.
6. Create incident reporting, exception approval, vendor review, employee training, monitoring, enforcement, and scheduled policy-update procedures.

What to do next

A usable policy answers who may use which system, for what purpose, with what data, under which review, and with what evidence. Pair the written policy with technical controls and role-specific training; NIST AI RMF is voluntary and does not replace applicable law.

Official sources and further reading

• Artificial Intelligence Risk Management Framework: Generative AI Profile — National Institute of Standards and Technology
• NIST AI RMF Playbook — National Institute of Standards and Technology
• AI Act — regulatory framework and application timeline — European Commission