Policy template
Nightschool AI: AI acceptable-use policy template for Claude, Copilot, ChatGPT or Gemini
A policy clause is only as strong as the admin setting that enforces it.
A workable AI acceptable-use policy names the approved tools, says which data classes each tool may receive, requires business accounts, puts connectors and MCP servers behind approval, sets retention, defines incident reporting and requires training. Each clause should point to the admin setting in Anthropic's Claude, Copilot, ChatGPT or Gemini that enforces it.
Published
Key Takeaways
- Seven clauses cover most first policies: tools, data classes, accounts, connectors, retention, incidents, training.
- Tie each clause to a named admin control, so the policy can be checked, not just read.
- Vendors document different controls; where a control is not in their pages, say so in the policy.
- This is a starting template, not legal advice; have counsel review the final text.
The full guide
Tap any section to open it.
About this guide
This page is for the IT, security or compliance lead writing the first AI acceptable-use policy for a company that runs Anthropic's Claude, Microsoft 365 Copilot, OpenAI's ChatGPT or Google's Gemini. Copy the clauses, fill in the brackets, and use the vendor notes to point each clause at the admin control that backs it.
Policy clause to admin control, by tool
| Policy clause | Anthropic's Claude | Microsoft 365 Copilot | ChatGPT | Gemini |
|---|---|---|---|---|
| Business accounts only | Domain verification, SSO, Restrict organization creation toggle | Not in cited pages | SSO and domain verification (included in Business) | Not in cited pages |
| Sensitive data in prompts | Not in cited Anthropic pages | Purview DLP policy for Copilot (sensitive info types, labels) | Not in cited pages | Existing Workspace DLP applies (Google blog, Duet AI era) |
| Connectors, apps, MCP | Owner enables connectors org-wide; managed MCP settings for Claude Code | Admin changes to Copilot plugins are audit-logged | Apps on by default in Business; new apps generally off in Enterprise | Not in cited pages |
| Retention | Custom retention (Enterprise), minimum 30 days | Retention policy, Microsoft Copilot experiences location | Workspace retention policies | Gemini conversation history (community answer) |
| Records for incidents | Retention changes in audit logs | Audit (Standard), automatic once auditing is on | Compliance Platform (eligible Enterprise and Edu) | Not in cited pages |
How to use itFill the brackets, then link each clause to a setting
Each clause below has [brackets] for your own choices. Keep the wording short: staff read a one-page policy, and auditors read the settings behind it.
After each clause, write the admin setting that enforces it and the date you checked it. The vendor notes further down give the setting name and the vendor page it comes from.
Where a vendor page does not document a control, the template says so. Do not promise a technical block you have not confirmed in your own admin console.
The template
Clauses 1 to 3: tools, data and accounts
Replace each [bracket] with your own choice.
1. Approved tools
Staff may use only these AI tools for company work: [tool, plan, owner]. Any other AI tool needs written approval from [role] before use.
2. Data classes per tool
Public data: any approved tool; internal: [tools]; confidential: [tools, only with listed controls on]. Restricted data, such as health or payment data: [not allowed / named exception only].
3. Business accounts only
Company work goes only through company-managed accounts signed in with company SSO. Personal accounts on any AI tool must not hold company data.
The template
Clauses 4 to 7: connectors, retention, incidents, training
The same rule applies: name the setting beside each clause.
4. Connectors, apps and MCP servers
No connector, app, extension or MCP server may be connected to company systems until [role] approves it and adds it to the register at [location].
5. Retention
AI conversations and files are kept for [period] under [setting], then deleted, unless a legal hold applies. Staff must not export chats to unmanaged storage.
6. Incident reporting
Report within [hours] to [contact] if confidential data went into an unapproved tool, an AI output caused harm, or a connector acted without approval.
7. Training requirement
Before getting access, each user completes [course] and signs this policy. Records are kept for [period] by [role].
AnthropicAnthropic's Claude: the controls behind the clauses
Business accounts: Anthropic's SSO page says domain verification is required before you configure SSO, and that once domains are verified, owners see a Restrict organization creation toggle that stops users creating new Claude or Console organizations, including personal accounts, on those domains.
Connectors: Anthropic's Google Workspace connectors page says that on Team and Enterprise plans an Owner or Primary Owner must enable connectors at the organization level before members can authenticate. For Claude Code, Anthropic's managed MCP page describes managed-mcp.json and the allowedMcpServers and deniedMcpServers settings.
Retention: Anthropic's retention page says custom retention is for Enterprise plans, set by a Primary Owner or Owner, with a minimum of 30 days; data is otherwise retained indefinitely, and retention changes are tracked in audit logs.
MicrosoftMicrosoft 365 Copilot: the controls behind the clauses
Data classes: Microsoft's Purview DLP page says a DLP policy can restrict Microsoft 365 Copilot, Copilot Chat and Cowork from processing prompts that contain sensitive information types, and from using files and emails with sensitivity labels.
Retention: Microsoft's retention policy page lists a Microsoft Copilot experiences location covering Microsoft 365 Copilot, Security Copilot, Copilot in Fabric and Copilot Studio prompts and responses.
Incidents: Microsoft's Copilot audit page says Copilot interactions are logged automatically as part of Audit (Standard) if your organization enables auditing, and admin changes to Copilot settings and plugins are logged too.
OpenAIChatGPT Business and Enterprise: the controls behind the clauses
Business accounts: OpenAI's Business SSO page says SSO and domain verification are included with ChatGPT Business. OpenAI's data-sharing page says that by default it does not use inputs or outputs from business users, including ChatGPT Business and Enterprise, to improve its models.
Connectors and apps: OpenAI's apps admin page says apps are enabled by default in ChatGPT Business, while in Enterprise and Edu new plugins and apps are generally disabled by default. It also says custom apps are not verified by OpenAI and are intended for developer use only.
Retention and incidents: the same page says chat content follows the applicable workspace retention policies, and that the Compliance Platform is available only to eligible Enterprise and Edu workspaces.
GoogleGemini in Google Workspace: the controls behind the clauses
Data use: Google's Workspace blog post on generative AI, written when the product was called Duet AI, says Google does not use Workspace data to train the models behind systems outside of Workspace without permission, and that existing controls such as data-region policies and Data Loss Prevention apply automatically.
Retention: answers in Google's Workspace Admin Community point to Admin console, Generative AI, Gemini app, Gemini conversation history, as the place to set or turn off history. Community answers are not Google help articles, so confirm the path in your own console.
Connectors and extensions: the Google pages in our sources do not document an approval control for Gemini extensions. Write the clause anyway, and enforce it by process until you confirm a setting.
SourcesWhere each fact comes from
Anthropic: support.claude.com/en/articles/10276682-important-considerations-before-enabling-single-sign-on-sso-and-jit-scim-provisioning; support.claude.com/en/articles/10166901-use-google-workspace-connectors; support.claude.com/en/articles/10440198-configure-custom-data-retention-controls-for-enterprise-plans; code.claude.com/docs/en/managed-mcp.
Microsoft: learn.microsoft.com/en-us/purview/dlp-microsoft365-copilot-location-learn-about; learn.microsoft.com/en-us/purview/create-retention-policies; learn.microsoft.com/en-us/purview/audit-copilot.
OpenAI: help.openai.com/en/articles/11489188-setting-up-single-sign-on-sso-for-chatgpt-business; help.openai.com/en/articles/10306912-sharing-feedback-evaluation-and-fine-tuning-data-and-api-inputs-and-outputs-with-openai; help.openai.com/en/articles/11509118-admin-controls-security-and-compliance-for-plugins-and-apps. Google: workspace.google.com/blog/identity-and-security/protecting-your-data-era-generative-ai; support.google.com/a/thread/389311631. All read on 2026-11-08.
Train the admins who enforce the policy
A policy needs someone who can set the controls behind it. The Nightschool AI admin and governance courses walk each tool's setup in order: sign-in, provisioning, data use, connectors, audit logs and retention, checked against each vendor's own documentation.
Admin and governance courses, one per tool (sign up free to try the first lessons; the full course is paid)
Frequently Asked Questions
What should an AI acceptable-use policy cover first?
Approved tools, data classes per tool, business accounts only, connector approval, retention, incident reporting and training. Those seven clauses answer most first questions from security and staff.
Can I ban personal AI accounts technically?
Partly, on some tools. Anthropic documents a Restrict organization creation toggle for verified domains. For other tools, check your admin console; where no control exists, the clause is enforced by process.
Does OpenAI train on ChatGPT Business data?
OpenAI's data-sharing page says that by default it does not use inputs or outputs from business users, including ChatGPT Business and Enterprise, to improve its models.
How do I stop sensitive data reaching Microsoft 365 Copilot?
Microsoft's Purview DLP page describes policies that restrict Copilot from processing prompts with sensitive information types and from using labeled files and emails.
Where are Gemini chats retained?
Google Workspace Admin Community answers point to the Gemini conversation history setting under Generative AI in the Admin console. Confirm the exact path in your own console.
Is this template legal advice?
No. It is a starting point for your IT and compliance team. Have your counsel review the final policy against the laws and contracts that apply to you.
Why name the admin setting next to each clause?
So the policy can be checked. A clause with a named setting and a date is something an auditor can verify; a clause without one is a promise.
Keep going
Related Guides and Courses
Write the policy, then set the controls
Each clause should have a setting and a checked date beside it.
Nightschool AI is independent and not affiliated with, sponsored by or endorsed by Anthropic, Microsoft, OpenAI or Google. Claude, Microsoft 365 Copilot, ChatGPT and Gemini are those companies' products, named here only to describe them. This page is general information, not legal advice. Facts checked against the vendors' public pages on 2026-11-08; confirm in your own admin console before you change a setting.