Free template · Malaysia & Singapore
AI Acceptable Use Policy Template
Your staff already use ChatGPT, Claude, Copilot or Gemini. This is what an AI acceptable use policy has to cover, an excerpt from our template (AGK-POL-02 v1.0), and the data × AI tool matrix that tells staff what they may paste where.
Short answer
What is an AI acceptable use policy?
An AI acceptable use policy is the staff-facing rulebook for using AI at work. It says which AI tools are approved, what data may go into them, who is accountable for AI output, what AI must never be used for, and how to report problems. Every user acknowledges it before getting access.
Checklist
What an AI acceptable use policy should cover: 10 sections
These are the ten rule sections of AGK-POL-02 v1.0, after purpose, scope and key terms. If your current policy misses one, that is the gap to close first.
- 01
Approved tools only
Which AI tools staff may use for work, through company accounts and single sign-on, and how to ask for a new one.
- 02
Data rules
What data may go into which tool: a data label × AI tool tier matrix, never secrets, minimum data, client contracts respected.
- 03
Human review and accountability
The person who uses AI output is accountable for it; no decision that significantly affects a person rests on AI alone.
- 04
AI in employment decisions
Hiring, performance, pay and staff monitoring with AI treated as high risk; no covert monitoring.
- 05
Intellectual property and confidentiality
Copyright, AI-generated code review and licence checks, ownership of AI-assisted work.
- 06
Disclosure of AI use
When customers, managers, clients or regulators must be told that AI was used.
- 07
Connectors, agents and browser use
Only approved connectors and MCP servers; agents supervised; untrusted instructions inside documents ignored.
- 08
Prohibited uses
A short, explicit list of what AI must never be used for.
- 09
Reporting incidents and concerns
Where to report a mistake or near-miss immediately, with no blame for good-faith reports.
- 10
Training, acknowledgement and consequences
Every user signs an acknowledgement before access, completes training, and knows what a breach leads to.
Excerpt · AGK-POL-02 v1.0
Template excerpt: approved tools and prohibited uses
Two sections of the policy, as they appear in the template. Highlighted [values] are the ones you set. Each control has an ID and the lowest adoption tier it applies to.
4. Use approved tools only
| Control ID | Requirement | Applies to |
|---|---|---|
| AGK-POL-02-C01 | RequirementYou shall use only AI tools on the approved AI tool list at [intranet link] for [CLIENT NAME] work, accessed through your company account and single sign-on. | Applies toAll tiers |
| AGK-POL-02-C02 | RequirementYou shall not enter, upload or connect any non-Public [CLIENT NAME] information into consumer AI (T0), including personal accounts on tools that are otherwise approved. | Applies toAll tiers |
| AGK-POL-02-C03 | RequirementYou shall not link personal accounts (personal e-mail, personal cloud storage, personal messaging) to the company AI tenant, or company accounts to personal AI tools. | Applies toStandard + Regulated |
| AGK-POL-02-C04 | RequirementTo request a new AI tool, feature, connector or extension, submit a request under AGK-PRC-01 or AGK-PRC-A01. Do not install or enable it first. | Applies toAll tiers |
11. Prohibited uses
You shall not use AI to:
- Carry out any prohibited practice in AGK-POL-01, or anything illegal.
- Harass, discriminate, deceive or manipulate anyone, or create deepfakes of real people without consent.
- Monitor, profile or score colleagues or customers outside an approved use case.
- Generate malware, bypass security controls, or test systems without authorisation.
- Bypass AI tool safety controls ("jailbreaking") or company technical controls.
- Make commitments, give regulated advice or sign agreements on behalf of [CLIENT NAME] without the authority to do so.
- [Add any client-specific prohibitions, e.g. use in clinical diagnosis, investment advice, or sanctions screening without approval.]
Source: AGK-POL-02 v1.0, sections 4 and 11. The full policy has 28 controls across 13 sections; download it in the Lite pack.
Data × AI tool matrix · AGK-STD-A02 v1.0
What data can go into which AI tool?
The policy points to one table. Staff label the data, check the tier of the tool, and read the cell. Where the label is unclear, treat it as the higher label until the data owner confirms.
| Data label | T0 Unapproved | T1 Approved | T2 Hardened | T3 Agentic |
|---|---|---|---|---|
| Public | T0 UnapprovedAllowed | T1 ApprovedAllowed | T2 HardenedAllowed | T3 AgenticAllowed |
| Internal | T0 UnapprovedProhibited | T1 ApprovedAllowed | T2 HardenedAllowed | T3 AgenticAllowed within the agent's approved scope |
| Confidential | T0 UnapprovedProhibited | T1 ApprovedAllowed for business need | T2 HardenedAllowed | T3 AgenticConditional: approved agent scope; write/send actions need human approval |
| Restricted | T0 UnapprovedProhibited | T1 ApprovedProhibited | T2 HardenedConditional: approved use case (AGK-PRC-01), DPIA done, minimum necessary data | T3 AgenticConditional: as T2, plus autonomy no higher than [A2] unless the AI Governance Committee approves |
| Secrets | T0 UnapprovedProhibited | T1 ApprovedProhibited | T2 HardenedProhibited | T3 AgenticProhibited (agents use managed credentials, never pasted secrets) |
Source: AGK-STD-A02 v1.0, section 4. DPIA: data protection impact assessment. Autonomy levels A0–A4 run from suggest-only to high autonomy.
Five data labels
- Public
- Approved for public release: published website content, press releases, public filings.
- Internal
- For staff use; low impact if disclosed: internal procedures, general meeting notes, non-sensitive project plans.
- Confidential
- Business-sensitive: pricing, contracts, unreleased plans, small volumes of business-contact personal data.
- Restricted
- Highest sensitivity: personal data at scale, sensitive personal data (health, financial, NRIC/ID numbers, biometrics), regulated data, client secrets under NDA, M&A and price-sensitive information.
- Secrets
- Credentials, passwords, API keys, tokens, private keys, connection strings. Never entered into any AI tool.
Four AI tool tiers
- T0 Unapproved / consumer
- Personal accounts, free or consumer AI tools, any tool the company has not approved.
- T1 Approved enterprise
- Approved platform configured to the baseline: single sign-on, contractual no-training, audit logs.
- T2 Hardened enterprise
- T1 plus retention set, DPIA or transfer assessment done, encryption/key controls or in-region processing where required.
- T3 Agentic with actions
- AI that can act: write-capable connectors, browser or computer use, autonomous agents. Scoped per approved agent.
Rolling the policy out in two weeks
Step 1
Find what is already in use
Survey staff and check expenses and network logs, with a 30-day amnesty for anyone who declares a tool.
Preview AGK-PRC-07Step 2
Approve and acknowledge
Approve the policy, then every user signs the acknowledgement before access, in English or BM.
Preview AGK-TPL-07Step 3
Explain it in plain language
Give staff the Safe AI Use Guide and a short session; the policy is the rule, the guide is how.
Preview AGK-GDL-A01
- Keep the approved tool list outside the policy, so updating it never needs board approval.
- If connectors, browser agents or autonomous agents are not in use yet, keep that section and state they are disabled until approved.
- Staff sign the acknowledgement before access and again every year (AGK-POL-02-C23).
Free AI Governance Lite pack
The documents an organisation starting out needs to govern AI tools in its first 90 days. Word and Excel, ready to edit.
- Lite Quick Start and Control Checklist AGK-001 · Word
- AI Governance Framework and Document Architecture AGK-000 · Word
- AI Acceptable Use Policy AGK-POL-02 · Word
- AI Data Handling Standard AGK-STD-A02 · Word
- AI Discovery and Shadow AI Procedure AGK-PRC-07 · Word
- AI Adoption Roadmap and Use-Case Prioritisation Guide AGK-GDL-C02 · Word
- AI System Register AGK-TPL-01 · ExcelPreview AI System Register
- AI Use Case Intake Form AGK-TPL-03 · Word
- AI Incident, Nonconformity and CAPA Log AGK-TPL-06 · ExcelPreview AI Incident, Nonconformity and CAPA Log
- AI Acceptable Use Acknowledgement AGK-TPL-07 · Word
- Pengakuan Penggunaan AI (Bahasa Melayu) AGK-TPL-07-BM · Word
- AI Use-Case Prioritisation and Benefits Tracker AGK-TPL-12 · ExcelPreview AI Use-Case Prioritisation and Benefits Tracker
Template release v1.0 · ZIP · 733 KB
Download AI Acceptable Use Policy and the Lite pack
Templates for governance purposes, not legal advice.
AI acceptable use policy FAQ
What is an AI acceptable use policy?
An AI acceptable use policy is the staff-facing rulebook for using AI at work. It says which AI tools are approved, what data may go into them, who is accountable for AI output, what AI must never be used for, and how to report problems. Every user acknowledges it before getting access.
Can staff use personal ChatGPT or Claude accounts for work?
Under the template, no non-Public company information may go into consumer AI (tool tier T0), including personal accounts on tools the company has otherwise approved. Staff use the approved tool through their company account and single sign-on instead (AGK-POL-02-C01 and C02).
Should the policy list the approved AI tools?
No. The template points to an approved AI tool list on your intranet rather than naming tools inside the policy, because the list changes more often than the policy. The list itself is kept in the AI system register.
Does an AI policy need to cover AI agents and connectors?
Yes, once they are switched on or planned. The template keeps a section on connectors, agents and browser use even if those features are disabled, stating that they stay off until approved, and requires staff to confirm irreversible actions an agent takes.
Is this template enough for PDPA compliance?
It is one part. The policy sets the data rules; the AI Data Handling Standard adds the personal data controls, and breach notification sits in the incident procedure. It is a governance template, not legal advice.
Part of the AI governance guide for Malaysia and Singapore. See also the template library and Claude privacy and compliance.
