An AI acceptable use policy should say which tools are approved (enterprise accounts only), what data can go in, which uses need human review, how a new use gets approved, and what happens when someone breaks the rules. At a bank, credit union, insurer or hospital, the board approves it, management runs it, and it gets reviewed every quarter.
The most common mistake is a 30-page policy nobody reads, or a one-liner ("don't use AI with confidential information") nobody can apply.
What sections should an AI acceptable use policy have?
Ten sections cover what matters. Each fits in a paragraph or two:
| Section | What it says | Example rule |
|---|---|---|
| 1. Purpose and scope | Who it applies to: staff, board members, consultants and vendors with access | "Applies to any use of AI with the organization's information" |
| 2. Approved tools | The list of authorized enterprise accounts | "Only the organization's Claude Enterprise and Gemini in Google Workspace; no personal accounts, free or paid" |
| 3. Allowed and prohibited data | Which level of information can go into each tool | "Passwords and full card data, never; customer data, only in restricted spaces with approval" |
| 4. Uses that need human review | Which outputs can't reach a customer or patient without review | "Every credit decision, claim or clinical recommendation is reviewed and signed off by a person" |
| 5. Approving new uses | Who decides when a department wants to use AI for something new | "The AI committee approves it with a use case risk assessment" |
| 6. Connectors and extensions | Which integrations are allowed | "Only IT-approved connectors; no AI browser extensions without approval" |
| 7. Customer-facing content | What review branded content needs | "All AI-made content goes through brand and compliance review before publishing" |
| 8. Incidents | How and to whom to report a mistake or a leak | "Report to information security the same day, with no penalty for reporting" |
| 9. Training | What each role needs to learn | "No one gets access without completing training for their role" |
| 10. Owners, review and consequences | Who owns the policy, how often it's reviewed, and what happens on a violation | "The committee reviews it every quarter; violations follow the sanctions policy" |
For section 3, start from your data classification; we cover it in what data employees can put into AI tools.
Who should approve it?
The board, on management's recommendation. It isn't a formality: AI touches customer data, decisions and the brand, and that's governance.
Examiners are heading the same way. The CSBS AI Supervisory Framework for state examiners (September 2026) includes review procedures for governance and AI inventories, and the NCUA says its examiners review internal controls around AI tools and third-party due diligence. A board-approved policy is one of the first documents either is likely to ask for.
In practice:
| Role | What it does with the policy |
|---|---|
| Board | Approves it and receives periodic reports |
| CEO or management | Proposes it and answers for compliance |
| AI committee (risk, compliance, security, IT, business) | Approves new uses and reviews the policy every quarter |
| Information security and IT | Configure tools to back the policy up |
| Each department | Applies it and reports incidents |
Separate policy, or part of information security?
It works best as a short policy of its own that builds on what already exists: information security, data classification, acceptable use of technology. That way it can move at the pace of the tools without reopening the whole security program, and it doesn't repeat what's already written.
What makes a policy stick?
Configuration that backs it up. A rule the tool enforces beats one people have to remember:
- "Enterprise accounts only" sticks when personal accounts on the company email are blocked. See the Claude Enterprise setup checklist.
- "Approved connectors only" sticks when connectors are enabled by role.
- "Human review" sticks when AI creates drafts and a person publishes or decides.
- "Report incidents" sticks when reporting carries no penalty and everyone knows the channel.
And people who know it. For health organizations, HIPAA's Security Rule already requires a security awareness and training program for the whole workforce and a sanctions policy for workforce members who don't follow security policies. An AI policy fits inside both.
How often should it be reviewed?
We recommend every quarter, because AI tools change faster than any other technology in the organization: new features ship, plans change and vendor terms move within months. Review it out of cycle, too, whenever something important changes: a new tool, a change in a vendor's usage policy, a new rule or an incident. A concrete example: Anthropic's Usage Policy, taking effect November 12, 2026, requires a qualified person to review every AI recommendation in credit, insurance, health care and other high-risk areas, and the affected person to be told AI was used. If your organization uses Claude for anything like that, your policy has to say so.
An honest caveat: a good policy doesn't replace good configuration or good training. The three go together, and the policy is the easiest of the three to write.
Which frameworks help?
You don't have to invent the structure. The NIST Generative AI Profile (NIST AI 600-1, July 2024), a companion to NIST's AI Risk Management Framework, is the most useful reference for a genAI policy.
In Texas it carries extra weight. TRAIGA's liability defense covers, among other things, a violation an organization discovers through an internal review process while substantially complying with that NIST profile or another recognized AI risk framework. It's a narrow defense, not a blanket safe harbor, but it rewards exactly the kind of documented program a good policy starts.
How do we handle it at Andes?
At Andes we build software with AI under a secure development policy: approved tools only, no customer personal data in prompts, human review and static analysis before every deployment. For regulated organizations, our AI governance package includes the AI policy, the use case inventory, the risk assessment mapped to your regulator's framework and your parent group's standard, vendor due diligence templates and staff training. If you don't yet know what's in use, start with how to control shadow AI.
Does your organization have a board-approved AI policy?
If there's a draft that never made it to the board, that's the next step. See our AI for regulated institutions service and let's build it with your team.
Sources
- NIST, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1, July 2024): https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence
- Texas Legislature, HB 149, Texas Responsible Artificial Intelligence Governance Act (enrolled), Sec. 552.105: https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm
- CSBS, Artificial Intelligence Supervisory Framework (September 2026): https://www.csbs.org/csbs-artificial-intelligence-supervisory-framework
- NCUA, Artificial Intelligence (AI): https://ncua.gov/regulation-supervision/regulatory-compliance-resources/artificial-intelligence-ai
- 45 CFR 164.308, Administrative safeguards (Cornell LII): https://www.law.cornell.edu/cfr/text/45/164.308
- Anthropic, Usage Policy (effective November 12, 2026): https://www.anthropic.com/aup