Fill in every row. If a tool isn't listed, it isn't approved.
The following AI tools are approved for work use at [Company Name]:
Employees may not use AI tools not listed above for work purposes without prior approval from [ROLE].
To request approval for a new AI tool, contact [ROLE] with: the tool name and URL, the intended use, and whether a paid or enterprise version is required. Approval criteria include where data is stored, whether the vendor trains models on user inputs, and whether enterprise terms of service are available.
Note: Free consumer tiers of most AI tools have different data retention and training terms than paid enterprise versions. Know which version your team is using before approving a tool.
This is the PIPEDA line. Determine your data storage jurisdiction and fill it in.
Personal information — names, email addresses, phone numbers, financial data, health information, or any information that identifies a living person — may not be entered into any AI tool unless:
All other approved tools are for internal, non-personal use only: drafting, research, summarising, and similar work that does not involve identifying information about clients, customers, or employees.
Confidential business information — pricing, contracts, unreleased plans, client files, or information covered by NDA — may only be entered into enterprise-tier tools with appropriate confidentiality terms. When uncertain, do not enter it.
Test: if you would not email this information to a stranger, confirm it is appropriate for your AI tool before entering it.
The list below covers most situations. Add any outputs specific to your business.
The following outputs must be reviewed and approved by a qualified human before being sent, published, or acted upon:
Internal drafts, meeting notes, research summaries, and working documents may move at normal pace. Employees are responsible for the accuracy of anything they act on, regardless of how it was produced.
The Ontario rule is mandatory for employers with 25+ employees using AI in hiring. The client disclosure section is yours to define.
Ontario employers with 25 or more employees: As of January 1, 2026, Ontario's Employment Standards Act requires that if AI is used to screen, assess, or select candidates for a position, that use must be disclosed in publicly advertised job postings.
Does this apply to [Company Name]? [Yes — we will include the following disclosure in all job postings where AI is used in screening: "We use AI tools to assist in screening applications for this role." / No — we do not use AI in candidate screening. / Under review.]
Internal disclosure: Any employee may ask whether AI was used in a decision that affects them. [Company Name] will provide a direct, honest answer upon request.
Client and external disclosure: [Company Name] will disclose AI use to clients when: [describe your approach — e.g., "AI-generated content is included in a deliverable without significant human revision" / "upon client request" / "at the start of each engagement"]
Name a role, not just a person. Set the next review date before you file this away.
This policy is owned by: [ROLE]
The policy owner is responsible for maintaining the approved tools list, evaluating requests for new tools, answering questions about this policy, and updating it when our tools, practices, or legal obligations change.
Review schedule: Quarterly · Next review: [DATE]
On each quarterly review, the policy owner will confirm: the approved tools list is current; any tools adopted since the last review have been formally evaluated; any incidents or near-misses have been documented; any regulatory changes have been incorporated.
Questions about this policy: [EMAIL or ROLE]