Employee AI Use Policy Template (2026): Free Word and PDF

An employee AI use policy is the written rule set that tells staff which AI tools they may use, what information they may put into them, when a person must check the output, and what happens to the record. This page gives you one with the wording written out, twelve sections long, as a free Word file to edit and a PDF to circulate. It is written for US employers and names the laws that make each clause necessary.

The templates that rank for this search are 230 to 300 word landing pages that hand over a file in exchange for your email, name no jurisdiction and carry no date. Several are built around GDPR, which does not apply to a US workforce. In Littler's survey of more than 300 employers published May 6, 2026, 68% said they had a formal AI governance policy, up from 38% a year earlier. In EisnerAmper's survey of 1,017 US desk workers who use AI, published August 20, 2025, 36% said their company had one. The gap between those two figures is the reason to write the policy down and have people sign it.

Download the files

Decide these six things first

A policy that says "use AI responsibly" is not a policy. Before you open the Word file, settle the six decisions that fill its brackets.

1. Which tools are approved, by plan. "ChatGPT" is not an answer. ChatGPT Enterprise under a company contract and a free personal account on the same website are different tools with different data terms. List the product, the plan and who holds the contract.
2. Your data tiers. Most organizations need three: public, internal, and restricted. Restricted means customer personal data, employee records, health information, source code, unreleased financials, anything under a non-disclosure agreement and anything privileged. The policy will say which tier may go into which tool tier.
3. Who signs off on high-stakes output. Name a role, not "management". Public statements, contracts, code shipped to production, anything sent to a regulator and any document used in a hiring, pay, promotion or discipline decision needs a named human reviewer.
4. Whether AI may touch employment decisions at all. If your company uses or plans to use a tool that screens, ranks or scores candidates or employees, section 8 of the template applies and so do the state laws below. Many employers prohibit it outright until the legal team has mapped the obligations.
5. Whether you will monitor AI use. Twenty-two percent of AI-using desk workers in the EisnerAmper survey said their employer actively monitors their use. If you will, the policy must say so, and in Connecticut, Delaware and New York a separate written monitoring notice is required by statute.
6. Who owns the policy. One accountable owner, a review date no more than twelve months out, and a channel for employees to ask whether a new tool is allowed before they use it.

The template, section by section

The wording below is what is in the Word file. Replace every bracketed item. Delete any section that does not apply, but do not delete section 3, 5 or 12.

1. Purpose and scope

[Company] permits the use of artificial intelligence tools where they help us do our work well, and sets rules so that their use does not expose our customers, our employees or the company to harm. This policy applies to all employees, contractors and temporary staff, on any device, when working for [Company]. It covers generative AI assistants, AI features built into software we already use, including [name the suites you license], and any tool that produces text, images, code, audio, summaries, scores or recommendations from a model. It applies whether the tool is paid for by the company or free.

2. Approved tools

The following tools are approved for work use, on the plan stated and under the company contract: [tool, plan, contract owner]. Tools not on this list, including free consumer versions of approved products and AI features switched on inside other software, are not approved for any company information above the public tier. To request a tool, contact [role or email]. Requests are answered within [number] working days. A tool is added only after [IT security or legal] has reviewed its data terms.

3. Information you may and may not enter

We classify information in three tiers. Public: information already published by the company or freely available. Internal: ordinary business information not intended for publication. Restricted: personal data about customers, employees or candidates; health information; payment card data; source code and credentials; unreleased financial results; information received under a non-disclosure agreement; and anything a lawyer has marked privileged. You may enter public information into any approved tool. You may enter internal information only into approved tools on a business or enterprise plan whose terms exclude training on our data. You may not enter restricted information into any AI tool unless [legal or security] has approved that specific tool for that specific category in writing. Removing names does not make personal data public.

4. Confidentiality and privilege

Entering information into an AI tool is a disclosure to the tool's provider. Trade secrets lose protection if they are not kept secret, and legal privilege can be lost by disclosure to a third party. If you are unsure whether something is restricted, treat it as restricted and ask [role or email].

5. Accuracy and human review

You are responsible for everything you produce with an AI tool, as if you had written it yourself. AI output can be wrong, invented or out of date. Verify facts, figures, citations and code before you rely on them. The following outputs must be reviewed and approved by the named role before use: anything published or sent to customers, regulators or the press ([role]); contracts and legal documents ([role]); code deployed to production ([role]); and any document that will be used in a decision about hiring, pay, promotion, discipline or dismissal ([role]).

6. Disclosure

Tell your manager or client when AI produced a substantial part of a deliverable, if they ask or if the engagement terms require it. Do not present AI output as independent research or as a human expert's opinion. Where the law requires notice to a candidate, employee or customer that an automated tool was used in a decision about them, [HR or legal] will provide that notice and you must not use the tool until they confirm it has been given.

7. Intellectual property and copyright

Do not ask a tool to reproduce copyrighted text, images, code or music, or to imitate an identified living person's voice or likeness. Do not enter third-party material we do not have the right to use. Treat AI output that we publish as potentially unprotected by copyright and raise it with [legal] if ownership matters, for example in product names or logos. Code generated by AI is subject to the same license review as any other code.

8. AI in employment decisions

No AI tool may be used to screen, rank, score, select, evaluate or make recommendations about candidates or employees, or to analyze their video, voice, writing style or online presence, unless the use has been approved in writing by [HR director and legal counsel]. Any approved use must have a named human decision-maker who reviews the primary evidence and can override the tool, must comply with the notice, audit and record-keeping duties of the jurisdictions where our candidates and employees are located, and must be recorded in the AI register kept by [role].

9. Monitoring and records

[Company] [does / does not] log the use of approved AI tools on company systems and accounts. Where we do, the log records [the tool used, the user, the time, and whether restricted information was detected], it is held for [number] days, it is accessed only by [named roles] and only for a security or compliance reason, and it is not used to measure individual productivity. Where state law requires a separate notice of electronic monitoring, it is attached to this policy. AI outputs used in a business record are kept for as long as that record is kept.

10. Vendors and third parties

Before a new AI tool or an AI feature of an existing vendor is approved, [role] confirms in writing whether the provider trains on our data, how long inputs and outputs are retained, where they are stored, who at the provider can read them, and whether the contract allows our security and legal teams to audit. Vendors who use AI to perform work for us are bound by the same data rules.

11. Security and incident reporting

Do not install browser extensions or desktop AI agents without IT approval. Do not give an AI agent credentials, payment methods or write access to company systems without [security] approval. If you believe restricted information has been entered into an unapproved tool, or an AI output has caused harm, report it to [security email] within [number] hours. Reporting in good faith will not be held against you.

12. Training, acknowledgment and review

All staff complete the AI use training within [number] days of hire and annually. This policy is owned by [role], reviewed every [number] months and whenever the law or our tool list changes. A breach of this policy is handled under the disciplinary procedure. Nothing in this policy limits your rights under federal or state law, including your right to discuss working conditions with colleagues.

Acknowledgment. I have read the [Company] AI Use Policy dated [date]. I understand which tools are approved, which information I may not enter, when a person must review the output, and who to ask. Name, signature, date.

The laws behind the clauses

No federal statute regulates workplace AI by name. Title VII, the Americans with Disabilities Act and the Age Discrimination in Employment Act apply to AI-assisted decisions exactly as they apply to human ones. The Equal Employment Opportunity Commission's technical assistance documents on AI from 2022 and 2023 were removed from its website in January 2025 and should not be cited as current, but the statutes they explained are unchanged. The rules with teeth are state and local, and most of them bear on section 8.

Section 9 is where employee monitoring law enters. If your policy says you log AI use, Connecticut, Delaware and New York require a written notice of electronic monitoring, with the New York notice acknowledged by the employee on hiring. The wording is in our employee monitoring policy template and the penalties are in our state-by-state monitoring law table. Section 12's closing sentence exists because the National Labor Relations Act protects employees' right to discuss working conditions, and a policy that could be read to forbid talking about AI at work is an unforced error.

The framework most US policies now cite is the National Institute of Standards and Technology's AI Risk Management Framework, released January 26, 2023, with a generative AI profile added July 26, 2024. Its Govern function asks for policies that are "in place, transparent, and implemented effectively", for accountable and trained people, and for procedures covering third-party software and data. Sections 1, 10 and 12 of the template map to those three asks. The framework is voluntary and no US law requires it.

What the vendors say about your data

Section 3 only works if someone has read the data terms of each approved plan. Two examples from the providers' own documentation, as published on October 19, 2026:

• Microsoft 365 Copilot. Microsoft's privacy documentation, updated July 9, 2026, states that prompts, responses and data accessed through Microsoft Graph are not used to train its foundation models. It also states that interaction history is stored, can be retained and searched by administrators through Microsoft Purview, and that Microsoft restricts use of its models to infer an employee's performance, attitude or emotional state. So Copilot on a company tenant protects against training, but not against your employer reading the record.
• Anthropic Claude. Anthropic's privacy center, updated July 1, 2026, states that API inputs and outputs are deleted from its backend within 30 days by default, with exceptions for zero-retention agreements, files, policy enforcement (up to two years for flagged content) and legal requirements. Deleted chats on Work and Enterprise plans are removed within 30 days.

We could not retrieve OpenAI's enterprise privacy pages during research for this article, so we make no claim about them here. Check the business data page for the plan you hold and record what it says in your AI register, with the date. Consumer plans across providers generally allow training on conversations unless the user opts out, which is the reason the template bars internal information from free accounts.

Rolling it out

Three figures explain why a signed acknowledgment matters more than the policy text. Gallup's June 15, 2025 survey found 30% of US employees saying their organization had general guidelines or a formal AI policy; its tracker as of May 2026 found 25% saying their organization had communicated a clear plan for using AI. In SHRM's survey of 1,908 HR professionals in December 2025, 49% said their organization had an AI use policy. Policies exist more often than employees know about them.

1. Publish the approved tool list where people look for tools, not only in the policy.
2. Run the training before the acknowledgment, not after. Gallup's tracker found employees whose employer gave AI training were 1.7 times as likely to use AI frequently. Our AI training guide has a plan.
3. Give people a fast yes-or-no channel for new tools. EisnerAmper found 28% of AI-using desk workers would keep using AI even if their employer banned it, and 60% relied on free platforms. A slow approval process produces shadow AI.
4. Put the AI register (tool, plan, data terms, approval date, owner) in a place HR, legal and security can all read.
5. Review on a date, not on an incident. The Colorado law changes on January 1, 2027 and the California CCPA automated decision rules follow the same month.

Mistakes in the templates that rank

• One product in the title. A "ChatGPT policy" is silent on Copilot, Gemini, the AI features inside your HR system and the next product. SHRM's guidance since 2023 has been to cover AI broadly.
• No jurisdiction. None of the four templates we reviewed said which law it was written for. Two were built around GDPR.
• A single "confidential" bucket. Vendor terms differ by plan, so the rule has to pair data tiers with tool tiers.
• Silence on employment decisions. The duties with penalties attached are in hiring and promotion, and the templates do not mention them.
• Treating the policy as a shield. Under the California regulations the employer is liable for a vendor's system acting as its agent, and under NYC Local Law 144 the audit duty exists whether or not a policy was signed.
• A blanket ban. Bans push use to personal phones, where the company has no record and no data controls.
• No date, version or owner. A policy that cannot be dated cannot be shown to have been in force when something went wrong.

Key takeaways

• Download the twelve-section policy as a free Word or PDF file. Replace every bracketed field; keep sections 3, 5 and 12.
• Decide approved tools by plan, three data tiers, named reviewers for high-stakes output, whether AI may touch employment decisions, whether you log use, and who owns the policy.
• 68% of employers told Littler in May 2026 they had a formal AI policy; 36% of AI-using desk workers told EisnerAmper in 2025 their company had one.
• The binding rules are state and local: NYC Local Law 144 (enforced since July 5, 2023), Illinois HB 3773 (January 1, 2026), California's ADS regulations (October 1, 2025), Texas HB 149 (January 1, 2026) and Colorado SB 26-189 (decisions from January 1, 2027).
• The EEOC's 2022 and 2023 AI guidance was removed in January 2025. Title VII, the ADA and the ADEA still apply.
• If the policy says you log AI use, Connecticut, Delaware and New York require a separate written monitoring notice.
• Microsoft says Copilot prompts are not used to train its models but are stored and searchable by administrators; Anthropic deletes API inputs within 30 days by default. Record each approved plan's terms with the date.
• 28% of AI-using desk workers would keep using AI under a ban and 60% rely on free tools, so a fast approval channel matters more than a prohibition.