AI Acceptable Use Policy Generator

Organizational Context

What industry are you in? *

Select all that apply.

Approximately how many employees do you have? *

1–10 11–50 51–250 251–1,000 1,000+

Do you operate in Québec, or serve Québec residents? *

This triggers specific language obligations under Quebec's Law 25 (Act respecting the protection of personal information in the private sector).

Yes No

Are you subject to any specific compliance frameworks?

Select all that apply.

PIPEDA HIPAA SOC 2 ISO 27001 GDPR PCI-DSS

Current AI Tool Landscape

Which AI tools does your organization currently use or permit?

Select all that apply.

ChatGPT Microsoft Copilot Google Gemini Claude (Anthropic) Midjourney GitHub Copilot Custom / Internal AI tools Other

Do employees use personal AI accounts for work purposes? *

Yes No

Do you have AI tools embedded in existing software? *

For example: Salesforce Einstein, Notion AI, Adobe Firefly, Microsoft 365 Copilot.

Yes No

Which embedded AI tools or platforms?

List the software products that include AI features your employees use.

Data Handling

What categories of data do employees regularly work with? *

Select all that apply.

Client personally identifiable information (PII) Financial records Health / medical information Legal documents and privileged communications Trade secrets or proprietary business information Employee data Public / non-sensitive data only

Does your organization have a formal data classification scheme? *

For example: Public, Internal, Confidential, Restricted.

Yes No

Are employees currently inputting any sensitive or confidential data into AI tools? *

Yes, regularly No Not sure

Roles and Accountability

Is there a designated person or team responsible for AI governance today? *

Yes No

Do you want the policy to designate an AI owner or committee going forward? *

Yes No

Will different rules apply to different roles or departments? *

For example: stricter rules for HR or legal teams who handle sensitive data.

Yes No

Risk Posture and Enforcement

How would you describe your organization's current approach to AI risk? *

Conservative — minimize risk, restrict broadly Balanced — weigh productivity against risk Permissive — enable broad use, address issues as they arise

Should the policy permit AI use by default with exceptions, or restrict it by default with approved exceptions? *

Permit by default — allowed unless explicitly prohibited Restrict by default — prohibited unless explicitly approved

What consequences should apply for policy violations? *

Informal warning and remediation Formal disciplinary process Up to and including termination

Do you want to include a process for requesting approval of new AI tools? *

Yes No

How frequently should the policy be reviewed? *

Annually Semi-annually When triggered by major AI developments or incidents