Free GenAI Policy Generator

# Acceptable Use Policy — Generative AI

**Organization:** [orgName]
**Owner:** [ownerRole]
**Contact:** [contactEmail]
**Effective date:** 2026-08-28
**Applicable jurisdictions:** [jurisdictions]
**Review frequency:** Annually

## 1. Purpose

This policy governs the use of Generative AI (GenAI) tools by employees, contractors, and third parties acting on behalf of [orgName]. It applies to any tool that generates or manipulates text, code, images, audio, video, or structured data using large language models (LLMs), diffusion models, or other generative techniques.

## 2. Scope

- All personnel (employees, contractors, temporary staff).
- All GenAI tools, whether accessed through [orgName] accounts, personal accounts, browser extensions, API integrations, or embedded features in other products.
- All classes of data handled in the course of [orgName] business.

## 3. Approved tools

The following GenAI tools are approved for use with [orgName] data at appropriate classification levels:

[approvedTools]

Any tool not listed above requires written approval from [ownerRole] before use with [orgName] data or on [orgName] devices.

## 4. Explicitly restricted tools

The following tools **must not** be used with any [orgName] data:

[restrictedTools]

## 5. Data class rules

The following classes of data must **never** be submitted to any external GenAI tool, including approved ones, unless the tool has been specifically approved for that class in writing:

[dataRestrictions]

Personnel are responsible for correctly classifying data before submission. When in doubt, do not submit.

## 6. Prohibited uses

Regardless of tool, the following uses are prohibited:

- Generating content that impersonates a real person without documented consent.
- Producing decisions in domains classified as high-risk under the EU AI Act (recruitment, credit, essential services eligibility, law enforcement) without human review and documented model-approval sign-off.
- Circumventing safety or content filters in approved tools.
- Using GenAI to fabricate evidence, testimony, or audit artifacts.
- Producing or distributing content that violates [orgName] existing conduct, non-discrimination, or intellectual-property policies.

## 7. Attribution and provenance

- Personnel must disclose the use of GenAI in any customer-facing artifact when the artifact is materially generated (not just edited) by AI.
- Internal artifacts should mark AI-assisted sections when doing so aids review (e.g., code review, decision memos).
- Where a tool provides content provenance markers (e.g., C2PA, watermarking), those markers must not be stripped.

## 8. Intellectual property

- Personnel are responsible for confirming licensing terms of any GenAI tool used.
- Content generated using tools trained on datasets whose licensing is unclear must be reviewed by Legal before external distribution.

## 9. Prompt injection and adversarial content

- Personnel must treat model outputs, especially those produced from third-party content (retrieved documents, tool responses, user submissions), as untrusted input.
- Do not paste model output directly into privileged execution contexts (shells, SQL clients, production configuration) without human review.

## 10. Exceptions

Exceptions to this policy require written approval from [ownerRole]. Exception requests must document (a) the intended use, (b) the data classes involved, (c) the compensating controls, and (d) the review interval.

## 11. Enforcement

Violations of this policy will be treated in accordance with existing [orgName] disciplinary procedures. Serious violations may result in termination and, where warranted, referral to law enforcement.

## 12. Review

This policy is reviewed **Annually** by [ownerRole] or on demand following material regulatory changes (e.g., EU AI Act implementing acts, sector-specific AI rules) or after any material AI-related incident.

---

_Generated from a template published at https://genaimaturity.net/tools/policy-generator. Illustrative only — not legal advice. Review by qualified counsel is required before adoption._