Governance · AI governance and assurance · 05
Acceptable-use and supervision policy
An acceptable-use and supervision policy sets the rules for how staff and systems may use AI: which tools are approved, what data may and may not be entered, which uses require human review before action, how outputs are checked and attributed, what must be disclosed to customers and colleagues, and what is logged. It is needed when staff are using AI tools with no rules, when a customer or regulator asks for the organization’s AI policy, when an incident involved confidential data entered into a public model, or when a governance framework requires documented supervision. The policy produces a practical document staff can follow, the supervision points for consequential uses, the technical controls that enforce what can be enforced, and the acknowledgment and training that make the policy real.
Scope
What the review covers.
- Approved tools and the approval process for new ones
- Data rules: what may be entered, by classification
- Supervision: human review points, escalation and prohibited autonomous actions
- Output handling: verification, attribution, disclosure
- Logging, monitoring and enforcement controls
- Training, acknowledgment and review cadence
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Acceptable-use policy | Short, practical, written for staff |
| Supervision standard | Review points by use classification |
| Enforcement design | Technical controls where feasible |
| Training and acknowledgment | Materials and records |
Prerequisites
What we need from you.
- The AI use inventory and data classification scheme, or support producing them
- Legal and HR participation for employment and disclosure aspects
- Decision authority for tool approvals
Related
Where this sits.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Will a policy stop people using unapproved tools?
Not alone. The policy is paired with approved alternatives and technical controls where they exist. Rules without alternatives are ignored.
Do we have to disclose AI use to customers?
Sometimes by contract or regulation, often by good practice. The policy states what is disclosed and when, with counsel.
How does this relate to editorial standards for published content?
Our own editorial standards are an example of supervision applied to publishing. See Editorial standards.