Acceptable use & staff training

The policy and training that turn AI from a wildcard into a managed tool — what to put in the policy and how to evidence the training.

What the AUP must cover

  1. Approved tools — the named list (e.g. M365 Copilot, ChatGPT Enterprise, Claude for Work, Gemini Business, GitHub Copilot Business). Consumer URLs of those same tools are out.
  2. Prohibited inputs — customer personal data outside approved tools, source code outside GitHub Copilot Business / Cursor / Codeium Enterprise, regulated data (PHI, payment card) anywhere without explicit approval.
  3. Output handling — review before sending externally, do not present AI output as your own professional advice without checking, disclose to clients when material.
  4. Code generated by AI — must pass the same review as human code; license attribution where required.
  5. Decision-impacting AI — hiring, performance, customer prioritisation: only with documented oversight.
  6. Reporting — how to report an incident or near-miss in 60 seconds.

How to evidence the training

  • Course assignment per role, completion tracked in your LMS (Workday Learning, Cornerstone, LearnUpon, Lessonly, KnowBe4).
  • Sign-off recorded in your HRIS.
  • Refresher annually and on every material policy change.
  • Sample test: ask 10 random staff to find the policy and the reporting link — both should be findable in under a minute.

Tier expectations

Foundation Essential Professional
Policy One page, signed at onboarding + role-based sections + jurisdictional addenda
Training Annual e-learning + role-based modules + tabletop drills, phishing-style AI red-team

Tools

  • DLP enforcement: Microsoft Purview, Netskope GenAI, Zscaler GenAI Protection, Palo Alto AI Access Security.
  • LMS / acknowledgement: Workday Learning, KnowBe4, Lessonly, Vanta policy module.

Do this Monday

  1. Publish v1 of the AUP in your handbook and require an acknowledgement on next login.
  2. Block consumer ChatGPT/Claude/Gemini URLs at the network or browser layer for users who have the enterprise alternative.

Reviewer hot-buttons

  • AUP names specific tools, not "AI in general".
  • Training completion rate ≥ 95%, with chase-up for the rest.
  • Acknowledgement re-signed after the last material change.