A free AI acceptable use policy template,
written for Canadian privacy law.
A policy covering tool approval, data rules, AI agents, incident reporting and the records that show it is followed, ready for your lawyer to adapt wherever you operate.
A Word file. Also as a PDF or plain text, with a one-page checklist for your lawyer.
What the template covers
It is written in plain language, with placeholders highlighted and notes on what to delete.
-
A named owner
One person, such as your privacy officer or IT lead, owns the policy, its list of approved tools and its exceptions.
-
Scope that includes AI agents
Chat tools such as ChatGPT, and the AI built into software you already license, such as Microsoft 365 Copilot, plus AI agents that send messages or file documents.
-
Data rules by class
Each class of information gets a plain rule: passwords and keys never; personal and client information only in tools approved for it, and only as much as the task needs.
-
Limits on what agents may do
No agent moves funds or sends anything outside the organization without a named person’s authority. Every agent is on the approved list, with what it may do.
-
A workforce monitoring notice
The template tells staff plainly that their AI use is recorded, and flags Ontario’s written electronic monitoring rule for your lawyer.
-
The record behind each rule
Each part names the record that shows it is followed, and Appendix B gathers them into a ten-line checklist for an auditor, an insurer or your board.
-
Questions for your lawyer
Appendix C sets out the privacy and health law questions for your lawyer to answer, and Appendix D adds optional clauses for more sensitive records, such as health information.
What Mandate adds to a written policy
Mandate applies the template’s data rules to each message before it leaves for an AI tool, and keeps a signed record of each decision for the checklist in Appendix B.