# AI acceptable use policy
> Source: https://legalcode.md/skills/legalcode-ai-acceptable-use-policy | [HTML version](https://legalcode.md/skills/legalcode-ai-acceptable-use-policy)

Drafts or reviews an organization's AI Acceptable Use Policy (AUP) — governing which AI tools employees may use, under what conditions, and with what safeguards.

Drafts or reviews an organization's AI Acceptable Use Policy (AUP) — governing which AI tools employees may use, under what conditions, and with what safeguards. Covers permitted and prohibited AI uses, data handling restrictions (confidential information, PII/PHI, privileged communications), employee disclosure obligations for AI-generated content, intellectual property considerations for AI-generated work product, ethical walls between AI-assisted and human-only processes, security requirements for AI tool access, training and certification obligations, incident reporting for AI errors and bias, accountability and oversight requirements, and vendor-specific guidance for ChatGPT/OpenAI, Claude/Anthropic, Microsoft Copilot, and Google Gemini. Use when establishing AI governance foundations, conducting gap analysis against EU AI Act Art. 4 (AI literacy), ISO 42001, NIST AI RMF, or sector-specific requirements (HIPAA, FINRA, legal professional ethics rules), or updating existing policies for evolving AI tool landscapes. Jurisdiction-agnostic with [JURISDICTION-SPECIFIC] markers for local enforcement provisions. Produces a customizable AUP document, approved-tool registry, data-handling matrix, implementation roadmap, and compliance checklist.

This skill drafts and reviews organizational AI Acceptable Use Policies (AUPs). An AI AUP is the foundational governance document that communicates to all employees which AI tools are approved, under what conditions they may be used, and what safeguards are required. It translates the organization's AI risk appetite into enforceable employee obligations. **Covers:** - Drafting a complete AI AUP from organizational context - Reviewing an existing AI AUP for regulatory gaps and best-practice shortfalls - Building or auditing an Approved AI Tool Registry with tiered data-sensitivity controls - Drafting prohibited-use clauses with regulatory basis - Designing data handling rules by data classification category - Drafting employee disclosure and transparency obligations - Identifying IP ownership risks from AI-generated work product - Designing ethical walls between AI-assisted and human-only processes - Security access requirements for AI tools - Training and certification program design - Incident reporting procedures for AI errors, bias, and security events - Vendor-specific guidance for major AI platforms - Alignment assessment against EU AI Act Art. 4, ISO 42001, NIST AI RMF, ABA Model Rules, and applicable sector regulations **Does not:** - Provide legal advice or substitute for qualified legal review - Replace a Data Protection Impact Assessment (DPIA) ...

## Jurisdictions

Global



---
*Legalcode -- legalcode.md*