AI acceptable use policy for employees: what HR should write

Six sections, with sample wording

1. Approved tools. "Use [ChatGPT Business / Claude Team] with your company account. Don't use personal AI accounts for company work."
2. Data that never goes in. "Never enter candidates' or employees' personal details, health or leave information, pay, performance ratings, investigation notes, or anything from a personnel file, unless HR has approved that tool for that purpose."
3. Decisions AI may not make. "AI may help draft job posts, interview questions and policy text. It may not decide or rank who is hired, promoted, paid, disciplined or dismissed."
4. Checking and disclosure. "Read and check everything AI drafts before you send it. Say AI helped when a candidate, employee or customer asks."
5. Questions and incidents. "Ask [name] before trying a new tool. If something confidential went into an AI tool, tell [name] the same day; you won't be blamed for reporting it."
6. Training. "Everyone completes the 45-minute AI session in their first month; HR keeps the attendance record."

The hiring-law points to check

AI in hiring is where rules are tightest, so the policy should keep selection with people and point to these checks:

• New York City (Local Law 144, enforced since 5 July 2023): an employer may use an automated employment decision tool only after a bias audit in the past year, with notice to candidates.
• The EU AI Act treats AI used to recruit or select people as high-risk. Under the 2026 Digital Omnibus amendments, those obligations apply from 2 December 2027. Separately, Article 4 already asks companies that use AI to support staff AI literacy.
• Japan: the Personal Information Protection Commission has asked companies entering personal data into AI services to check it isn't used for anything beyond producing the answer.

A summary, not legal advice; sources and dates below. Check the rules where you hire.

A worked example

Illustration: a made-up business. The HR lead at a 60-person logistics company finds three things in one week: a recruiter pasted 40 CVs into a personal chat to "rank the top 5", a manager asked AI to write a performance warning from his notes, and nobody knows which AI tools are paid for. She writes the six sections in an afternoon, with these specifics:

• Approved: Claude Team, company accounts. Personal accounts banned for work.
• The recruiter may use AI to write the job post and structured interview questions; ranking candidates stays with the hiring panel's scorecard.
• Managers may ask AI to tidy the wording of a performance note after HR has agreed its content; the facts and the decision are the manager's.
• A 45-minute session for all staff in the next month, with attendance kept.

She sends the draft to the company's employment lawyer before publishing, with the hiring section flagged.

Roll it out

1. Ask, don't guess, which AI tools people use today, in a two-question anonymous form.
2. Draft the six sections with your company's tools and data.
3. Lawyer review of the people-data and hiring sections.
4. Announce it with the training session, not as an email attachment.
5. Review every six months, and when a new tool or law arrives.

Next step

A policy people have to remember gets forgotten. The next rung is putting the rules into the AI itself: shared instructions for the HR tasks people repeat (job posts, interview guides, onboarding plans), so the AI applies the rules every time. How to make your first Claude skill from a doc you already have shows the first one. For the training, see AI training for employees; for a company-wide policy template, the AI usage policy template.

The AI skill below drafts the policy for your company: answer a few questions about your tools and data, and your AI writes the plain-language draft and flags each point that needs a lawyer.

Questions

What should an AI acceptable use policy for employees include?

Approved tools and accounts, data that must never go into AI (for HR, anything about candidates and employees), decisions AI may not make alone (hiring, pay, discipline, termination), when to say AI was used, who to ask, and training. Keep it to one or two pages, and have a lawyer review it.

Can HR use ChatGPT to screen CVs?

Be careful. Some places regulate automated tools in hiring: New York City requires a yearly bias audit and notice to candidates, and the EU treats recruitment AI as high-risk, with those rules applying from 2 December 2027. Use AI to draft job posts and interview questions; keep selection decisions with people.

Should employees disclose when they use AI?

Set a simple rule: say so when a customer or candidate asks, when a document will be relied on as someone's own judgement, and wherever a law or contract requires it.