Use this when the company has no AI rules, or has a ban nobody follows. You get three files in a new folder, ./ai-acceptable-use-rules/: the staff rules for using AI tools, two pages with a red, amber, green guide to what data may go where (ai-use-rules.md); a spreadsheet you can open in Excel listing every AI tool as approved, approved for public information only, or not approved, with the reason (approved-tools.csv); and a short plan for announcing the rules and training each team (rollout-notes.md). This skill drafts for a human to review and sign; this skill never marks a control effective. The rules take effect only when the policy owner approves and publishes them.

Inputs to gather

Read the AI register if one exists, the general acceptable use policy, the data classification scheme, the vendor list and the terms of any AI tool the company pays for. Ask the reader, in one message: which AI tools people use today (including free accounts), which data the company would be hurt most by leaking, which teams use AI in hiring, customer communication or code, and who approves new software.

Step 1: start from real use

List the tools people use and what for, team by team. A rule set written without this list either bans what everyone already does, which drives use underground, or misses the risky use. Ask two or three people per team; the honest answers come from asking what saves them time, not whether they break rules. Name the uses people forget to declare: meeting transcription bots, AI features switched on inside email, documents and the CRM, code completion in the editor, and browser assistant extensions.

Step 2: set the approved tools list

Put every tool in one of three states in the tools spreadsheet (approved-tools.csv), with the reason, the checks behind it (data location, retention, subprocessors, breach notice in the terms) and a re-check date, because vendors change training and retention terms and a tool approved today can drift:

Approved: business account under terms the company signed, inputs not used for training, retention known, company sign-in, admin can remove users.
Approved for public information only: useful, but terms or controls are not good enough for anything internal.
Not approved: with the alternative people should use instead.

Free consumer accounts of an approved product are a different tool with different terms. Say so in the list, because it is the most common leak path.