AI Acceptable Use Policy
Using this in a product? Commercial use is allowed under CC BY 4.0, with attribution. Ask about an SLA-backed feed or a white-label licence.
On this page 7 sections
In brief
The AI Acceptable Use Policy is a free DOCX policy for EU AI Act and ISO/IEC 42001. A policy for staff use of AI tools: permitted and prohibited uses, data handling, disclosure and reporting, with the prohibited practices drawn from the law. It is written for provider / developer, deployer / user organisation and public authority / government body.
- Format
- DOCX · Policy
- Version
- v2, built 12 Nov 2026
- Duties cited
- 27 from 12 instruments
- Frameworks
- EU AI Act, ISO/IEC 42001
- Written for
- Provider / developer, Deployer / user organisation, Public authority / government body
- Price and licence
- Free · CC BY 4.0
What's inside
- Scope, roles and definitions
- Permitted and prohibited uses, the latter drawn from every recorded prohibited-practice duty
- Data, confidentiality and disclosure rules
- Reporting, review and enforcement, with placeholders
Preview
The sheets and sections of version v2, as built. Columns marked ▾ have a dropdown; ƒ is a formula.
Document outline (DOCX)
- 1. Purpose and scope
- 2. Definitions
- 3. Permitted uses
- 4. Prohibited uses
- 5. Data and confidentiality
- 6. Disclosure
- 7. Competence and training
- 8. Reporting and enforcement
- 9. Review
- Duties this policy serves
- Do not deploy or provide AI for prohibited practices
- Developers and deployers must not use AI to incite self-harm, harm to others or crime
- Governmental entities must not use AI for social scoring
- Governmental entities must not use AI for biometric identification from public data without consent where it infringes rights
- Developers and deployers must not use AI with the intent to unlawfully discriminate against a protected class
- Developers and distributors must not build AI intended to produce child sexual abuse material or unlawful sexual deepfakes
How to use it
- 1Request the files. Enter your name, company and work email in the form on this page. The DOCX download links arrive by email and work for 7 days.
- 2Read the README page. It states the version (v2), the dataset it was built from and the licence, so anyone reviewing your copy knows which records it reflects.
- 3Complete the document. Work through the DOCX sections (1. Purpose and scope, 2. Definitions, 3. Permitted uses, 4. Prohibited uses) and replace each placeholder with your organisation's answer.
- 4Keep the evidence and watch for new versions. Link each completed row to the evidence that supports it. When the law on record changes, this template gets a new version and a changelog on this page.
Duties this template covers (27)
Each is cited in the file with its source reference and a link back to the record.
- Establish accountability processes and a risk-management process (guardrails 1 and 2)
- Frontier developers must protect employees who report catastrophic-risk concerns
- Do not deploy or provide AI for prohibited practices
- Ensure AI literacy of staff operating AI systems
- Use high-risk AI as instructed, monitor it and inform affected people
- Providers must meet the full set of provider duties for high-risk AI
- Providers must supply conformity evidence and log access to authorities on request
- Non-EU providers must appoint an EU authorised representative for high-risk AI
- Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI
- Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually
- Providers of GPAI models must notify the Commission within two weeks of meeting the systemic-risk threshold
- Non-EU providers of GPAI models must appoint an EU authorised representative
Legal basis
Version history
| Version | Built | Dataset | What changed |
|---|---|---|---|
| v2 | ef1018b7a6a2 | Dataset 7c0835db52c1 → ef1018b7a6a2. | |
| v1 | 7c0835db52c1 | First version, built from dataset 7c0835db52c1. |
Only the latest version is served. A rebuild that changes the content adds a version; a rebuild that does not is skipped.
Frequently asked questions
What is in the AI Acceptable Use Policy?
Scope, roles and definitions. Permitted and prohibited uses, the latter drawn from every recorded prohibited-practice duty. Data, confidentiality and disclosure rules. Reporting, review and enforcement, with placeholders.
Which duties does it cite?
27 recorded duties from Australian Voluntary AI Safety Standard, California SB 53, EU AI Act and India AI Governance Guidelines, including Guardrails 1 and 2, Labor Code Section 1107 (as added by SB 53), Article 5, Article 4, Article 26 and Article 16. Each row links to the record, and the record to the official source.
Who is it for?
The duties it cites fall on provider / developer, deployer / user organisation and public authority / government body. Whoever owns AI governance for those roles usually completes it, with the system owner supplying the facts.
Is it free?
Yes. Request the DOCX with your work email on this page; the download links arrive by email, valid for 7 days. No account and no charge. Licensed CC BY 4.0. You may use, adapt and share this template, including commercially, with attribution to aipolicytracker.org.
How will I know when it changes?
Version v2 was built on 12 November 2026. The library is rebuilt daily; when a change to the records reaches this template it gets the next version, a changelog below and an entry in the templates feed.
Is there a self-assessment that goes with it?
Yes: the Shadow AI Discovery Assessment (21 questions, about 6 minutes) and the AI Policy & Acceptable Use Assessment (23 questions, about 6 minutes). They are free and run on Certifyi, a related product. A score is a self-check, not an audit; this template is where the work it points to gets written down.
Does completing it make us compliant?
No. It is an informational resource, not legal advice; it helps produce the evidence a regulator, customer or auditor asks for. Whether a duty applies to you is a judgement the template cannot make.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.