An acceptable use policy (AUP) is the one security document every employee reads and signs, which makes it the most important one to get right and the easiest one to get wrong. Too long and nobody reads it; too vague and nothing can be enforced. This guide explains each section of a general company AUP, suggests the usual choice for a business of 10 to 100 people, adds a dedicated section on AI tools with example clauses, and ships an original editable template.
Download (original NetSys template, no registration):
- Download the acceptable use policy template (Word, .docx): 18 sections with bracketed choices, a guidance note under the sections that need a decision, a monitoring notice, an approval record and an employee acknowledgment form.
The AUP is the staff-facing companion to the cybersecurity policy template, which holds the requirements staff do not control (patching, backups, logging, vendor management). Keep the two consistent and have the same owner approve both. A signed policy is not compliance by itself and does not prove that controls exist; it proves that people were told the rules.
What is an acceptable use policy?
An acceptable use policy is a written agreement between a company and the people who use its technology. It defines permitted use, prohibited use, the company's right to monitor, the duty to report problems, and the consequences of violations. Unlike the cybersecurity policy, it is written in the second person ("you") in plain language, because its audience is every employee rather than IT. Its legal value comes from the acknowledgment: when a dispute or incident is investigated, the signed AUP shows that the person knew the rule.
Who needs an acceptable use policy?
Any business whose staff use email, the internet, cloud applications or AI tools for work, which is every business. The practical triggers are a cyber insurance application that asks whether written policies exist and are acknowledged, a client security questionnaire, an HR dispute over personal use or monitoring, an employee pasting client data into a free AI tool, and any regulation that requires workforce security training and sanctions. The NIST Cybersecurity Framework 2.0 places policy under its Govern function and awareness and training under Protect, and CIS Control 14 asks for a security awareness program that influences workforce behavior (both checked on November 7, 2026; links at the end). The AUP is where that program's rules are written down.
Section-by-section guidance
Each heading matches a section of the template. The guidance gives the reason for the section and the usual choice for a 10 to 100 person business. Where a choice depends on employment or privacy law, the template says so and the section needs counsel's review.
1. Purpose and scope
State who the policy covers (employees, contractors, temps, interns) and what counts as company technology and information, including personal devices used for work and AI tools. Say that the stricter rule wins where the AUP and another policy differ.
2. General principles
Four sentences do most of the work: technology is provided for work and reasonable personal use is allowed within limits; you are responsible for your accounts and devices; ask if unsure; report problems at once without fear. Allowing reasonable personal use is the usual choice because a blanket ban is ignored and therefore unenforceable.
3. Accounts, passwords and MFA
Require the company password manager, unique passwords of at least 14 characters, MFA wherever available, and an explicit rule never to approve an MFA prompt you did not start. The last rule exists because attackers send repeated prompts hoping someone taps approve to make them stop.
4. Company devices
Keep devices with you or locked away, do not disable security software or updates, restart within a business day when asked, no family use, report loss within an hour, return everything on departure. The one-hour reporting window is the clause that turns a lost laptop into an inconvenience instead of a breach.
5. Personal devices (BYOD)
Decide whether personal devices may be used at all and, if so, only when enrolled in device management with company data kept inside managed apps. State plainly what the company can do (remove company data and apps) and cannot do (read personal apps, messages and photos), and confirm that statement against the actual capabilities of your management tool. Say who pays for the device and plan. This section and the monitoring notice are the two most likely to need counsel's edits.
6. Email and messaging
No forwarding to personal accounts, verify payment and bank detail changes by phone to a known number, no Restricted data by unencrypted email, write as if a regulator will read it, report suspicious messages with the button rather than forwarding them around. The verbal verification rule is the single most valuable sentence in the document for stopping payment fraud.
7. Internet and web use
Reasonable personal browsing within the general principles, no attempts to bypass filtering (personal VPNs, proxies, hotspots on company devices), no downloads from untrusted sources, no illegal or offensive content, and a stated position on streaming and gaming during work hours.
8. Cloud applications and file storage
Company files live only in approved services; no new cloud sign-ups or connected apps without IT approval; share with least access and an expiry; no 'anyone with the link' for Restricted or Confidential data; no removable media unless IT issued and encrypted it. The connected-apps rule matters more every year, because granting an app access to your mailbox gives it everything you can see.
9. Software installation
IT installs software from an approved list, extensions are limited to an approved list because they can read every page you visit, no pirated or personally licensed software, and no security or network tools unless that is your job and it is authorized in writing.
10. Remote work and travel
Privacy of screen and conversation when handling sensitive information, the approved remote access method, no public or shared computers, devices in carry-on luggage and never in vehicles, and notice to IT before international travel. Add a rule on home printing if your staff handle paper.
11. Data handling and confidentiality
Follow the classification scheme in the cybersecurity policy, access only what your job needs (curiosity is a violation), take nothing when you leave, shred rather than trash, and confidentiality continues after employment.
12. AI tools
This section has become the most-read part of any AUP, and most older templates do not have it. The template's rules: approved tools only through company accounts; no Restricted data unless the tool is approved for that class; you own what AI helps you produce and must check it; no connecting AI tools, plug-ins or agents to company mail and files without approval; no meeting recording or transcription without notice and consent; no impersonation or infringing content; report accidental disclosures as incidents; and human review plus HR or counsel approval where AI touches decisions about people. Example clauses are below. For the detailed AI usage policy that sits behind this section, with an approved-tool register and data rules by tool, see our AI usage policy template and guide, or build a first draft with the AI policy generator.
13. Monitoring and privacy notice
The company states that it may log, monitor, access and review activity on company systems for security, legal, operational and compliance purposes, that staff should not expect privacy in anything on company systems, and that monitoring on personal devices is limited to the managed work profile. Several US states require written notice of electronic monitoring and other countries limit it more tightly, so the template leaves a bracket for the notice language counsel requires. A notice broader than what you actually do is as much a problem as one that is narrower.
14. Social media and public statements
Only named people speak for the company; personal views are labeled as personal where the company is identifiable; no confidential information or screen photos; nothing that harasses or disparages colleagues, clients or competitors; and a sentence confirming that the policy does not restrict legally protected rights such as discussing wages and working conditions. Counsel confirms that sentence.
15. Reporting problems and incidents
One paragraph that lists what to report (lost device, clicked link, unexpected MFA prompt, misdirected data, suspected malware, anyone asking for a password, AI disclosure, anything that seems wrong), how (phone for urgent matters), and the promise that honest reporting is always the right thing even when the mistake was yours. Do not fix it, delete evidence or wipe a device; call.
16. Prohibited activities
A single list staff can scan: credential sharing, unauthorized access or testing, bypassing controls, unapproved software and services, copying data to personal accounts, illegal or offensive material, personal commercial use, license infringement, impersonation, and recording without consent. The list says it is not exhaustive.
17 and 18. Consequences, exceptions and review
Violations go through the disciplinary procedure in proportion to seriousness and intent, up to termination and referral to law enforcement; deliberate violations and cover-ups are treated more seriously than promptly reported mistakes. Exceptions are written, approved and dated. The policy is reviewed annually, after incidents and when new technology arrives, and acknowledged at hire and annually.
AI acceptable use policy examples
These are original example clauses in the style of the template's section 12. Adjust the bracketed items and keep each clause to one idea so it can be enforced.
| Topic | Example clause | Why it is written this way |
|---|---|---|
| Approved tools | "Use only the AI tools listed in the approved register at [location], through accounts the company has set up. Free or personal AI accounts are not used for company work." | Business accounts give the company admin controls and terms that usually exclude training on your data; personal accounts often do not. |
| Data limits | "Do not enter client, patient or employee personal information, financial account details, credentials or anything under a confidentiality agreement into an AI tool unless the register says the tool is approved for that data." | Ties the rule to the data classification staff already know and to a register that can change without rewriting the policy. |
| Human review | "You are responsible for anything AI helps you produce. Check facts, figures, citations and code before relying on them or sending them outside the company." | Puts accountability with the person, not the tool, and sets the review point at the moment work leaves the company. |
| Connected tools and agents | "Do not connect AI tools, plug-ins, agents or browser extensions to company email, files, calendars or other systems without IT approval. Connected tools act with your permissions." | A connector or agent can read and send with the user's full access; approval lets IT review the vendor and the scopes first. |
| Meetings | "Do not use AI to record or transcribe meetings or calls unless participants have been told and any consent the law requires has been obtained. Use only the approved meeting platform's built-in feature." | Recording consent laws differ by state; a single approved tool keeps transcripts inside company storage. |
| Disclosure | "Tell recipients when a deliverable was substantially produced by AI where they would reasonably expect a person to have done the work, and follow client contracts that restrict AI use." | Some clients prohibit AI use on their matters; the clause makes the contract, not the employee's judgment, the deciding factor. |
| Decisions about people | "Where AI contributes to a decision about hiring, performance, pay, credit or eligibility, a person reviews the decision and [HR or counsel] has approved the use in advance." | Automated employment decision tools are regulated in some jurisdictions; advance approval routes the question to the people who track those rules. |
| Mistakes | "If you enter information into an AI tool by mistake, report it the same day as a security incident so the company can request deletion where the vendor allows it." | Vendors often allow deletion requests on business plans; the window to use them is short and depends on prompt reporting. |
The AUP holds the rules every employee must know. The approved register, per-tool data rules, vendor review results and review cadence belong in the AI usage policy, and the controls that enforce them (business accounts tied to company sign-in, connector approvals, data loss prevention on managed devices) are what our AI governance consulting sets up.
How do you roll out an acceptable use policy?
- Make the decisions the brackets ask for. Personal use allowed or not, BYOD allowed or not, the approved AI tools, who speaks for the company, the reporting contact. Most are leadership choices, not IT choices.
- Check it against reality. If the policy says software is installed only by IT, local administrator rights must actually be removed. A rule the company does not enforce weakens every other rule.
- Review with HR and counsel. Monitoring notice, personal devices, social media and consequences are employment law territory and vary by state and country.
- Approve and version it. Fill in the approval record. The version number matters because acknowledgments are tied to it.
- Brief staff before they sign. A short session or recorded walkthrough that explains the reasons, especially MFA prompts, payment verification and AI data limits, produces far better compliance than a form in an onboarding packet.
- Collect and store acknowledgments. Electronically through your HR system where possible, with the version each person signed. Repeat at least annually and whenever the policy changes materially.
- Put it where people can find it. The intranet, the handbook and the onboarding checklist, with the reporting contact visible on the first page.
How do you keep the policy current?
Review the AUP annually alongside the cybersecurity policy, after any incident that a rule should have prevented, and whenever the company adopts a new category of technology. In the last two years that category has been AI; the next is likely to be agents that act on staff's behalf across systems, which is why the template's AI section already covers connected tools and agents. Keep a change log in the approval record so you can show which rule was in force on a given date.
Frequently asked questions
What should an acceptable use policy include?
Scope, general principles, accounts and MFA, company devices, personal devices, email and messaging, internet use, cloud applications, software installation, remote work, data handling, AI tools, a monitoring and privacy notice, social media, reporting, prohibited activities, consequences, exceptions and review, plus an approval record and an acknowledgment form. The template has a section for each.
How long should an acceptable use policy be?
Short enough to read and sign in about fifteen minutes: typically four to six pages once the guidance notes are deleted. Technical requirements that staff do not control belong in the cybersecurity policy, and detailed AI rules belong in the AI usage policy, so the AUP can stay readable.
Should the AI rules be in the AUP or in a separate AI policy?
Both, at different depths. The AUP carries the eight or so rules every employee must know, because it is the document everyone signs. The AI usage policy carries the approved-tool register, data rules by tool, vendor review results, owners and the review cadence, because those change more often than the AUP and are maintained by fewer people. The AUP points to the AI policy so the two stay linked.
Can we monitor employees under an acceptable use policy?
Generally a company may monitor its own systems for security, legal and operational purposes when it gives proper notice, which is what the monitoring section provides. The required form of notice and the limits on monitoring vary by state and country, and personal devices need particular care. Have counsel review the monitoring and BYOD sections before the policy is issued, and make sure the notice describes what you actually do.
Does an acceptable use policy apply to contractors?
It should. Contractors, temporary staff and interns use the same systems and data, so the template's scope includes them and the acknowledgment form works for them. Their contracts should also require compliance, because the disciplinary procedure that applies to employees usually does not apply to a contractor.
How often should staff sign the acceptable use policy?
At hire, at least annually, and whenever the policy changes in a way that affects what people may do. Tie each acknowledgment to the version number so you can show which rules a person had agreed to on a given date.
Is a signed acceptable use policy enough for compliance?
No. It is evidence that people were told the rules, which regulators, insurers and auditors expect, but compliance depends on the controls that enforce the rules and the records that show they operate. Pair the AUP with the cybersecurity policy, the controls behind it, and training that explains the reasons.
Put rules and controls in place together
If your staff are already using AI tools, personal devices or new cloud apps faster than the policy can keep up, bring the draft to a short scoping call. We will help you set the bracketed choices, align the AUP with the AI usage policy, and configure the controls that make the approved path the easy one.
Sources and further reading
- NIST, The NIST Cybersecurity Framework (CSF) 2.0 (CSWP 29, February 26, 2024): policy under the Govern function; awareness and training outcomes under Protect. Checked on November 7, 2026.
- Center for Internet Security, CIS Control 14: Security Awareness and Skills Training: establish and maintain a security awareness program to influence workforce behavior. Checked on November 7, 2026.
- SANS Institute, Information Security Policy Templates: a library of free policy templates, useful as a general reference for policy structure. Our template shares no text with it. Checked on November 7, 2026.
Related reading
Cybersecurity Policy Template for Small Business
Read Article CybersecurityPenetration Testing Report Template: What a Good Report Contains
Read Article CybersecurityIT Risk Assessment Template: A Risk Register With Scoring That Means Something
Read ArticleAlso on this topic: AI Agent Monitoring: Quality, Access, Cost and Monthly Maintenance
Discuss ai governance consulting for your business.
Tell us about your current systems, the result you need and your timeline. We will discuss the work, responsibilities and pricing before you decide on an engagement.