# AI Acceptable Use Policy

**Business name:** ______________________
**Effective date:** ______________________
**Policy owner (who to ask):** ______________________
**Next review date:** ______________________

> Template from Monterey Bay AI (montereybay.ai), a 501(c)(3) nonprofit. Free to copy and change.
> This template is educational. It is not legal advice. If your business handles health, financial, student, or other regulated data, have a qualified professional review your policy.

---

## 1. Purpose

We use AI tools to save time on routine work so we can spend more time with customers and each other. AI helps us draft, sort, and summarize. People stay responsible for the results.

## 2. Approved tools

Staff may use these AI tools for work:

- ______________________
- ______________________

To use a new AI tool for work, ask ______________________ first.

## 3. Never put into an AI tool

- Passwords, login codes, or API keys
- Payment card or bank account details
- Government ID numbers
- Health information
- Private customer, client, or student records
- Anything covered by a confidentiality agreement

If you are not sure, leave it out and ask.

## 4. A human checks

AI output is a draft. Before anything reaches a customer, a person checks:

- Names, numbers, prices, and dates
- Facts and quotes
- Tone and whether it sounds like us

Who checks: ______________________

## 5. Disclosure

We tell customers when AI is involved in these cases:

- An automated chat or reply speaks for the business
- ______________________

## 6. Security

- Any request to move money, change bank details, or share login codes is verified by calling back on a number we already have.
- Payment changes need two people.
- Multi-factor sign-in is on for email, banking, and AI tools.
- Urgent or secret requests are a red flag. Pause and verify.

## 7. Training

Everyone who uses AI for work gets training on this policy and the tools.
Training happens: ______________________

## 8. Questions and mistakes

Questions go to ______________________.
If something goes wrong (wrong info sent, private data pasted, a scam), tell ______________________ right away. We fix problems. We do not blame people for reporting them.

## 9. Review

We review this policy every ______ months, or sooner if our tools change.

---

Signed: ______________________  Date: __________