Your staff AI policy, drafted in two minutes.

[ORGANISATION NAME] — ARTIFICIAL INTELLIGENCE ACCEPTABLE USE POLICY
Draft generated 8 November 2026 · Sector: Professional services
Policy owner: [Policy owner]

1. PURPOSE
This policy sets out how staff at [Organisation name] may use artificial intelligence (AI) tools responsibly, protecting our clients, our people and our organisation, and supporting our obligations under the GDPR, the Data Protection Act 2018 and the EU AI Act.

2. SCOPE
This policy applies to all employees, contractors and temporary staff who use AI tools for any work-related purpose, on any device.

3. OUR POSITION
Staff may use approved AI tools for work tasks. Any new tool must be approved before use.

4. APPROVED TOOLS
The following tools are currently approved, using organisation-managed accounts only: Microsoft Copilot.
Personal or free accounts must not be used for work information.

5. INFORMATION YOU MUST NOT ENTER INTO AI TOOLS
Unless a tool has been specifically approved for that category, never enter:
  - Customer personal data
  - Health data
  - Passwords, keys or access credentials
  - Any information marked confidential

6. HUMAN OVERSIGHT
AI output may be inaccurate, biased or fabricated. Staff remain responsible for all work they produce. Check facts, figures, citations and legal references before relying on or sharing any AI output.

7. TRANSPARENCY
Where AI materially generates content shared externally, or where people interact with an AI system, this should be made clear in line with the EU AI Act transparency requirements.

8. PROHIBITED USES
AI must not be used to make solely automated decisions with legal or similarly significant effects on individuals, to monitor staff emotions, or for any practice prohibited under Article 5 of the EU AI Act.

9. NEW AI USES
Any new AI use involving personal data must be reviewed by [Policy owner] and, where required, a Data Protection Impact Assessment completed before use.

10. INCIDENTS
Report any accidental disclosure of personal or confidential data to an AI tool to [Policy owner] immediately. Personal data breaches may need to be notified to the Data Protection Commission within 72 hours.

11. TRAINING & REVIEW
All staff will complete AI literacy training. This policy will be reviewed at least every 12 months.

---
This is a draft template generated by CloudMount (cloudmount.ie). It is not legal advice. Review it with your legal or data protection adviser before adoption.