# AI acceptable use policy: what to include, and which laws and regulators require or expect one

Source: https://superintelligencecompliance.ai/guides/ai-acceptable-use-policy  
Publisher: ZSKFL Management  
Last updated: 2026-11-02. Not legal advice.

> What an AI acceptable use policy should include, section by section, and the rule behind each: EU AI Act Article 4, NYDFS, NAIC, NIST, ISO 42001, and Colorado.

## At a glance

- An AI acceptable use policy should cover scope and definitions, approved tools and data rules, prohibited uses, human review, disclosure, vendor AI, records and inventory, incident reporting, training, roles, and a review cycle. Each of those sections answers a specific rule, and the table below names it.
- As of November 2, 2026, we found no US federal or state statute that requires every company to adopt an AI acceptable use policy. Insurance regulators, the New York Department of Financial Services, the EU AI Act, and OMB’s rules for federal agencies require or expect written AI policies, training, or governance programs from the organizations they cover. Bank supervisors expect model risk management for the models their guidance covers, and the OCC states that generative and agentic AI models are not within its scope. FINRA says its existing rules, including Rule 3110 on supervision, apply to generative AI, and that its notice creates no new requirements.
- Article 4 of the EU AI Act has applied since February 2, 2025. As amended in 2026, it requires measures to support AI literacy, without guaranteeing a level for any individual.
- Colorado SB 26-189 applies to consequential decisions made on or after January 1, 2027, and an acceptable use policy is one of the conditions that keep a consumer-facing chatbot outside it. A federal court order in *X.AI LLC v. Weiser* bars Colorado’s Attorney General from enforcing SB 26-189, including by investigation, for violations occurring on or before 14 days after the court rules on xAI’s preliminary injunction motion; as of November 2, 2026, xAI had not filed that motion.

## What should an AI acceptable use policy include?

An AI acceptable use policy should include eleven sections: scope and definitions; approved tools and data rules, covering confidential data, personal data, and copyright; prohibited uses; human review; disclosure to customers and candidates; vendor and third-party AI; recordkeeping and the AI inventory; incident reporting; training and AI literacy; roles and accountability; and a review cycle. Write it short enough that staff read it, and put the detail in procedures.

A generic template lists the same headings without saying why any of them is there. Here each section is tied to a rule that a regulator, a statute, or a framework already applies to AI, and that rule decides what the section has to say. A policy built that way can be walked through with an examiner section by section; one copied from a template often cannot.

## Is an AI acceptable use policy legally required?

For most US companies, no statute requires one by name. For insurers, banks, broker-dealers, federal agencies, and any company within the EU AI Act’s reach, a regulator or statute either asks for written AI policies outright or sets duties or supervisory expectations, such as training, oversight, and supervision, that a written policy is the practical way to meet.

**Rules and frameworks that require, expect, recommend, or reward a written AI policy, program, or training, as of November 2, 2026**

| Rule | Who it reaches | What it requires, expects, or recommends | Status |
|---|---|---|---|
| EU AI Act, Article 4 | Providers and deployers of AI systems within the Act’s reach, including providers and deployers in third countries where the system’s output is used in the EU | Measures to support AI literacy, without guaranteeing a level for any individual | Applies since February 2, 2025; amended by Regulation (EU) 2026/1744 |
| EU AI Act, Article 17 | Providers of high-risk AI systems | A quality management system that ensures compliance with the Act, documented in a systematic and orderly manner in the form of written policies, procedures and instructions, and including at least a strategy for regulatory compliance and an accountability framework setting out the responsibilities of management and other staff | From December 2, 2027 for stand-alone Annex III systems and August 2, 2028 for AI in Annex I Section A regulated products |
| EU AI Act, Article 26 | Deployers of high-risk AI systems | Use in accordance with the instructions for use, human oversight by people who have the necessary competence, training, authority, and support, monitoring of operation, logs kept at least six months, and notice to workers before workplace use | Same dates as Article 17 |
| NYDFS Insurance Circular Letter No. 7 | Insurers authorized in New York that use AI systems or external consumer data in underwriting or pricing | Insurers “should formalize their development and management of ECDIS and AIS in written policies and procedures,” and the board, a committee, or senior management through delegated authority should review and approve them at least annually | Guidance, July 11, 2024 |
| NYDFS industry letter on AI cybersecurity risks | Entities regulated under 23 NYCRR Part 500 | No new requirements; explains how Part 500 risk assessments, policies, training, vendor oversight, and access controls apply to AI | Guidance, October 16, 2024 |
| NAIC Model Bulletin on the Use of AI Systems by Insurers | Insurers in adopting states: 27 states, the District of Columbia, and Puerto Rico as of October 8, 2026 | A written AI Systems Program covering AI systems used in regulated insurance practices, whether built or bought | Adopted by the NAIC December 4, 2023 |
| SR 26-2, OCC Bulletin 2026-13, FDIC FIL-15-2026 | Banks; the agencies say it is expected to be most relevant to banking organizations with more than $30 billion in total assets | Model risk management covering development and testing, validation and monitoring, governance and controls, and vendor and third-party models; the OCC states that generative and agentic AI models are not within its scope | Guidance since April 17, 2026 |
| FINRA Regulatory Notice 24-09 | Broker-dealers | The securities rules apply to generative AI the same way they apply to any other technology; the notice creates no new requirements and points to Rule 3110 on supervision and Rule 2210 on communications with the public | Guidance on existing rules since June 27, 2024 |
| OMB Memorandum M-25-21 | Federal agencies, and AI developed, used, or acquired by or on behalf of them | Within 270 days, agencies “should develop a policy that sets the terms for acceptable use of generative AI for their missions” with safeguards and oversight; each CFO Act agency must develop an AI Strategy within 180 days | Issued April 3, 2025 |
| NIST AI RMF 1.0, GOVERN 1 | Voluntary | “Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively” | Version 1.0, January 26, 2023; NIST states it is being revised |
| ISO/IEC 42001:2023 | Voluntary; certifiable by independent certification bodies | ISO lists “AI policy and objectives” among the standard’s requirements for an AI management system | Edition 1, December 2023 |
| Colorado SB 26-189 | Developers and deployers of ADMT used to materially influence a consequential decision | No policy mandate; an acceptable use policy is one condition of the exclusion for consumer-facing natural-language technology | Applies to consequential decisions made on or after January 1, 2027; a court order in *X.AI LLC v. Weiser* limits Attorney General enforcement (see above) |
| Texas HB 149 | A person who promotes, advertises, or conducts business in Texas, produces a product or service used by Texas residents, or develops or deploys an AI system in Texas | No policy mandate. A defendant may not be found liable for a violation it discovers through an internal review process if it substantially complies with the most recent version of the NIST Generative AI Profile or another nationally or internationally recognized AI risk management framework (Sec. 552.105(e)); a cure statement comes with supporting documentation and any necessary changes to internal policies to reasonably prevent recurrence (Sec. 552.104) | In effect since January 1, 2026 |

Circular Letter No. 7, the NAIC bulletin, OMB M-25-21, and, for providers of high-risk systems, EU AI Act Article 17 ask for written AI policies or a written AI program in so many words. The NYDFS cybersecurity letter applies Part 500’s existing policy requirements to AI and adds no new ones. EU Article 4, the bank and broker-dealer guidance, and the voluntary frameworks get there indirectly, through the training, oversight, supervision, and documented controls they require, expect, or recommend. The [insurance guide](https://superintelligencecompliance.ai/guides/ai-compliance-insurance), the [financial services guide](https://superintelligencecompliance.ai/guides/ai-compliance-financial-services), and the [EU AI Act compliance checklist](https://superintelligencecompliance.ai/guides/eu-ai-act-compliance-checklist) give each rule in full.

## How is an AI acceptable use policy different from an AI governance policy?

An acceptable use policy tells staff what they may and may not do with AI tools. A governance policy tells the organization how it approves, owns, tests, and retires AI systems. Some companies combine them in one document. The rules in the table above reach both, so the outline below covers both.

## Which rule drives each section of the policy?

A section with no rule behind it for your company can be short; a section with several rules behind it should meet the strictest one that applies.

**AI policy sections and the rules behind them, as of November 2, 2026**

| Policy section | Rule that requires, expects, or recommends it |
|---|---|
| Scope and definitions | Duties attach to roles and to uses. Under the EU AI Act, a provider develops an AI system or model, or has one developed, and places it on the market or puts it into service under its own name or trademark, and a deployer uses a system under its authority in a professional activity. Colorado SB 26-189 excludes “a tool used by an individual solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing.” M-25-21 states that no system should be considered too simple to qualify as covered AI due to a lack of technical complexity |
| Approved tools and data rules | Any AI vendor that creates, receives, maintains, or transmits protected health information for a covered entity is a HIPAA business associate and needs a business associate agreement before it touches the data. The NYDFS letter says entities that allow personnel to use AI applications should consider blocking queries that might expose nonpublic information to a public AI product or system. FINRA Notice 24-09: under Rule 3110 a member firm must have a reasonably designed supervisory system tailored to its business, and the rules apply to generative AI as they do to any other technology; an approved-tools list is one way to keep staff use inside that system. Under the GDPR, a training set that contains personal data needs a lawful basis, a compatible purpose, and, for special categories of data, an Article 9 exception |
| Prohibited uses | EU AI Act Article 5 prohibitions, applied since February 2, 2025, including emotion recognition in the workplace and in education except for medical or safety reasons. The intent-based prohibitions in Texas HB 149 (Secs. 552.052 and 552.055 to 552.057), and, for governmental entities, the social scoring and biometric identification limits (Secs. 552.053 and 552.054). Colorado’s chatbot exclusion requires an acceptable use policy that prohibits using the generated content in a consequential decision |
| Human review | Colorado SB 26-189: after an adverse outcome, on request, an opportunity for meaningful human review and reconsideration, to the extent commercially reasonable. EU AI Act Article 26(2): assign human oversight to people who have the necessary competence, training, authority, and support. California SB 947, from July 1, 2027, for discipline and termination decisions |
| Disclosure to customers and candidates | EU AI Act Article 50 transparency duties, applied since August 2, 2026. Colorado pre-use notice. NYC Local Law 144 notice at least 10 business days before an automated employment decision tool is used. Illinois HB 3773, which makes failing to give notice of AI use a violation in its own right. Utah’s generative AI disclosure rules. The Texas health care disclosure. SEC antifraud and Marketing Rule cases over overstated AI claims |
| Vendor and third-party AI | NAIC bulletin processes for acquiring and overseeing third-party AI systems and data. Circular Letter No. 7: insurers retain responsibility for vendor tools and “should develop written standards, policies, procedures, and protocols” for them. Bank model risk guidance covers vendor and third-party models. California’s employment rules treat a vendor acting for the employer as its agent. NIST GOVERN 6 |
| Recordkeeping and inventory | Colorado: compliance records for at least 3 years. California employment rules: automated-decision system data kept at least four years. EU deployers: logs kept at least six months. Circular Letter No. 7 documentation may include an up-to-date inventory of all AI systems in use, under development, or recently retired. NIST GOVERN 1.6. M-25-21 annual use case inventories for agencies |
| Incident reporting | EU AI Act Article 26(5) for deployers of high-risk systems. The NYDFS letter on requiring vendors to give timely notice of cybersecurity events. NIST GOVERN 4.3. The Texas 60-day cure process |
| Training and AI literacy | EU AI Act Article 4. Circular Letter No. 7 training for relevant personnel. The NYDFS letter on training staff who use AI applications. NIST GOVERN 2.2. M-25-21 operator training for high-impact AI |
| Roles and accountability | NAIC bulletin: senior management accountable to the board or a board committee. Circular Letter No. 7: clearly defined roles and responsibilities. NIST GOVERN 2.1 and 2.3. ISO/IEC 42001 leadership requirements |
| Review cycle | Circular Letter No. 7: review and approval at least annually. NIST GOVERN 1.5. Texas HB 149 cure statements, which come with any necessary changes to internal policies to reasonably prevent recurrence |

## What data rules belong in a generative AI policy?

The data section should say which tools are approved, which categories of data may go into each, and which may not go into any tool without a contract that covers them. Health, financial, and personal data need their own lines, because each comes with its own law. Copyright needs one too, covering what goes into a tool and what comes out of it.

- **Health data.** No protected health information goes into a consumer AI tool that does not offer a business associate agreement, and the minimum necessary standard applies to what is sent to the model. See the [health care guide](https://superintelligencecompliance.ai/guides/ai-compliance-healthcare).
- **Nonpublic customer information.** NYDFS wrote that personnel permitted to use AI-powered applications “should be trained on how to draft queries to avoid disclosing NPI,” and that entities should consider monitoring for unusual query behavior and blocking queries that might expose nonpublic information to a public AI product or system.
- **Personal data under the GDPR.** Every training, fine-tuning, or evaluation set that contains personal data needs a lawful basis under Article 6, must respect purpose limitation under Article 5(1)(b), and, if it holds special categories of data, needs an Article 9 exception. The [AI data governance guide](https://superintelligencecompliance.ai/guides/ai-data-governance) covers the rest.
- **Copyright.** The US Copyright Office’s March 16, 2023 registration guidance says applicants have a duty to disclose the inclusion of AI-generated content in a work submitted for registration and to provide a brief explanation of the human author’s contributions. NIST GOVERN 6.1 calls for policies and procedures that address AI risks associated with third-party entities, including risks of infringement of a third party’s intellectual property or other rights. Since August 2, 2025, providers of general-purpose AI models under the EU AI Act have had to put in place a policy to comply with EU copyright law.
Federal contractors have a further reason to write this section carefully. M-25-21 covers AI developed, used, or acquired on behalf of an agency, and tells agencies to consider contract terms that protect federal information from being used to train or improve a vendor’s commercial offerings without express permission from the agency.

## Which uses should the policy prohibit?

List every practice banned in a jurisdiction whose law reaches your AI use, including where its output is used or where the people it affects live, then add your own limits.

In the EU, Article 5 bans a closed list of practices, including manipulative or deceptive techniques that materially distort behavior and cause significant harm, social scoring, untargeted scraping to build facial recognition databases, and emotion recognition in the workplace and in education, except for medical or safety reasons. The Digital Omnibus added two prohibitions that apply from December 2, 2026. One covers systems that generate or manipulate intimate or sexually explicit images of identifiable people without their explicit consent. The other covers systems that generate child sexual abuse material. The [EU AI Act guide](https://superintelligencecompliance.ai/guides/eu-ai-act-compliance) lists every Article 5 practice.

In Texas, HB 149 prohibits developing or deploying an AI system that intentionally aims to incite or encourage self-harm, harm to another person, or criminal activity, or with the intent to unlawfully discriminate against a protected class, or with the sole intent to infringe constitutional rights. It also prohibits developing or distributing an AI system with the sole intent of producing certain sexual material involving minors or unlawful deepfakes, or one that intentionally simulates sexual conduct while imitating a child. See the [Texas guide](https://superintelligencecompliance.ai/guides/texas-ai-law-hb-149).

Colorado gives the prohibited-use section a direct legal role. SB 26-189’s definition of automated decision-making technology excludes technology that communicates with consumers in natural language to provide information, make referrals or recommendations, answer questions, or generate other content, if that technology is not contracted, advertised, marketed, configured, or intended to be used in a consequential decision and is subject to an acceptable use policy that prohibits using its generated content in a consequential decision (C.R.S. 6-1-1701(2)(b)(III)). A company that wants its customer chatbot outside SB 26-189 needs that prohibition written down, in addition to meeting the other conditions. The [Colorado guide](https://superintelligencecompliance.ai/guides/colorado-sb-26-189) covers the other exclusions.

## When does the policy need human review and disclosure?

Require human review wherever an AI system makes or materially influences a decision about a person. Require disclosure in those cases too, and wherever people interact with AI without knowing it.

Colorado requires notice before covered ADMT materially influences a consequential decision, and human review only on request after an adverse outcome. SB 26-189 requires a deployer that uses ADMT to materially influence a consequential decision to give consumers clear and conspicuous notice before use, to give, within 30 days after a decision with an adverse outcome, a plain-language description of the decision and the technology’s role, a process to request more information, and an explanation of consumer rights, and, on request, to provide instructions for requesting personal data and correcting factually incorrect or materially inaccurate personal data, and an opportunity for meaningful human review and reconsideration, to the extent commercially reasonable. In California, from July 1, 2027, an employer may not rely solely on an automated decision system to discipline or terminate an employee. Where the employer relies primarily on one, a human must corroborate the output, and the employee must get a stand-alone written notice when the employer informs the employee of the decision (Labor Code sections 1522, 1524, and 1526.7). The policy should name who can override a system, what they see, and how overrides are logged.

For disclosure, since August 2, 2026 Article 50(1) of the EU AI Act has required providers to design AI systems that interact directly with people so that those people are informed they are interacting with an AI system, unless that is obvious from the point of view of a reasonably well-informed, observant and circumspect person, taking into account the circumstances and the context of use. In New York City, employers must notify candidates and employees who live in the city, at least 10 business days before use, that an automated employment decision tool is in use; see the [Local Law 144 guide](https://superintelligencecompliance.ai/guides/nyc-local-law-144). Utah requires a business using generative AI with consumers to disclose it when the consumer clearly asks, and requires up-front disclosure from people in state-licensed or state-certified occupations in high-risk interactions; the [state AI laws guide](https://superintelligencecompliance.ai/guides/us-state-ai-laws) covers Utah with the other states. The [employment guide](https://superintelligencecompliance.ai/guides/ai-compliance-employment-hr) covers the hiring notices in Illinois and California.

The disclosure section should also govern marketing. The SEC’s March 2024 cases against two advisers that described AI capabilities they did not have were ordinary misstatement cases. A policy that requires review of public AI claims is the control for that risk.

## What should the policy say about records, incidents, and training?

Keep the records the longest applicable rule requires, name who receives incident reports and how fast, and train people on the tools they are allowed to use.

- Maintain an AI inventory: Circular Letter No. 7 lists “an up-to-date inventory of all AIS implemented for use, under development for implementation, or recently retired” among the documentation insurers should be prepared to make available to the Department on request, and NIST GOVERN 1.6 calls for mechanisms to inventory AI systems
- Set retention to the longest rule that applies: Colorado requires 3 years of compliance records; California’s employment rules require 4 years of automated-decision data; once the high-risk duties apply, EU deployers of high-risk systems keep the logs under their control for at least six months, unless other Union or national law provides otherwise (Article 26(6))
- Define incidents and routes: under Article 26(5), once the high-risk duties apply, a deployer of a high-risk system that identifies a serious incident must immediately inform the provider, then the importer or distributor and the market surveillance authorities. NYDFS wrote that covered entities should require third-party service providers to give timely notification of any cybersecurity event that directly impacts the entity’s information systems or nonpublic information held by the provider, including threats related to AI
- Train by role: Circular Letter No. 7 says policies and procedures should include training for relevant personnel on the responsible and lawful use of AI systems and external consumer data, appropriately tailored to staff responsibilities, with prompt training for new staff and a regular cadence after that. NIST GOVERN 2.2 calls for personnel and partners to receive AI risk management training consistent with related policies, procedures, and agreements
- Cover EU AI literacy: take measures to support AI literacy under Article 4, as amended in 2026, which applies to providers and deployers whether or not their systems are high-risk
For AI that acts on its own, the [agentic AI governance guide](https://superintelligencecompliance.ai/guides/agentic-ai-governance) sets out the action logs, authority records, and oversight records worth keeping.

## Who should own the policy, and how often should it be reviewed?

Senior management should own it, the board or a board committee should oversee it, and it should be reviewed at least once a year and after any material change in law.

The NAIC bulletin expects governance with senior management accountable to the board or a board committee. Circular Letter No. 7 says policies and procedures “should include clearly defined roles and responsibilities, as well as monitoring and reporting requirements to senior management.” NIST GOVERN 2.3 calls for executive leadership to take responsibility for decisions about risks associated with AI system development and deployment, and GOVERN 1.5 calls for ongoing monitoring and periodic review of the risk management process with roles and responsibilities clearly defined, including determining the frequency of periodic review.

The annual cadence follows Circular Letter No. 7, under which an insurer’s board of directors or other governing body, one of its committees, or senior management acting under delegated authority should review and approve the insurer’s policies and procedures for AI systems and external consumer data at least annually, so that they stay current with changes in how the insurer uses them and with best practices in the industry. Texas adds a reason to keep the review process ready. After written notice from the Attorney General, no action may be brought before the 60th day, or at all if, before that day, the person cures the violation and delivers a written statement that it has cured it, with supporting documentation and any necessary changes to internal policies to reasonably prevent recurrence (Sec. 552.104).

## Is there an AI governance policy template that meets these rules?

No template meets them by itself, because the rules that apply depend on your sector, your role, where the people your AI affects live, and where your AI or its output is offered or used. A template is a reasonable starting point if you check each section against the mapping table above and delete or strengthen it accordingly.

- Build the inventory first, using the [first-90-days checklist](https://superintelligencecompliance.ai/guides/ai-compliance-guide); a policy written before the inventory will miss tools
- Mark each system with your role: provider, deployer, or both
- List the jurisdictions where affected people live and where your AI or its output is offered or used, and pull the prohibited practices and notice duties for each
- Write each section against the strictest rule that applies, and cite the rule in an internal note so the next reviewer knows why it is there
- Align the policy to a framework, NIST AI RMF or ISO/IEC 42001, as the [governance frameworks guide](https://superintelligencecompliance.ai/guides/ai-governance-frameworks) describes
- Calendar the annual review and a review after each material law change
This guide is general information as of November 2, 2026, not legal advice. Confirm current requirements with the primary source, your regulator, or counsel before adopting a policy.

## Sources

- [Regulation (EU) 2024/1689 (Artificial Intelligence Act)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj), EUR-Lex, 2024.
- [Regulation (EU) 2026/1744 (Digital Omnibus on AI)](https://eur-lex.europa.eu/eli/reg/2026/1744/oj?locale=en), EUR-Lex, July 24, 2026.
- [Insurance Circular Letter No. 7 (2024): Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing](https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07), New York State Department of Financial Services, July 11, 2024.
- [Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks](https://www.dfs.ny.gov/industry-guidance/industry-letters/il20241016-cyber-risks-ai-and-strategies-combat-related-risks), New York State Department of Financial Services, October 16, 2024.
- [NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers](https://content.naic.org/sites/default/files/inline-files/2023-12-4%20Model%20Bulletin_Adopted_0.pdf), National Association of Insurance Commissioners, December 4, 2023.
- [Implementation of NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers (status as of October 8, 2026)](https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf), National Association of Insurance Commissioners, October 2026.
- [OCC Bulletin 2026-13, Model Risk Management: Revised Guidance](https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13.html), Office of the Comptroller of the Currency, April 17, 2026.
- [Regulatory Notice 24-09](https://www.finra.org/sites/default/files/2024-06/regulatory-notice-24-09.pdf), FINRA, June 27, 2024.
- [OMB Memorandum M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust](https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf), Office of Management and Budget, April 3, 2025.
- [Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 (PDF)](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf), National Institute of Standards and Technology, January 26, 2023.
- [AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework), National Institute of Standards and Technology, accessed November 2, 2026.
- [ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system](https://www.iso.org/standard/42001), International Organization for Standardization, December 2023.
- [ISO/IEC 42001 explained](https://www.iso.org/insights/iso-42001-explained), International Organization for Standardization, accessed November 2, 2026.
- [SB 26-189, Session Laws 2026, Chapter 131 (enrolled act)](https://leg.colorado.gov/laws/session-laws/SB26-189/131/download), Colorado General Assembly, approved May 14, 2026.
- [Docket, X.AI LLC v. Weiser, No. 1:26-cv-01515 (D. Colo.), Minute Order, ECF No. 24 (April 27, 2026)](https://www.courtlistener.com/docket/73171074/x-ai-llc-v-weiser/), CourtListener RECAP, accessed November 2, 2026.
- [H.B. No. 149 (enrolled), Texas Responsible Artificial Intelligence Governance Act](https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm), Texas Legislature, 2025.
- [Business Associates](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html), U.S. Department of Health and Human Services, accessed October 2026.
- [Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence](https://www.federalregister.gov/documents/2023/03/16/2023-05321/copyright-registration-guidance-works-containing-material-generated-by-artificial-intelligence), U.S. Copyright Office, 88 FR 16190, March 16, 2023.
- [SB-947 Employment: automated decision systems (Chapter 859, Statutes of 2026)](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB947), California Legislative Information, 2026.
- [Civil Rights Council Secures Approval for Regulations to Protect Against Employment Discrimination Related to Artificial Intelligence](https://calcivilrights.ca.gov/2025/06/30/civil-rights-council-secures-approval-for-regulations-to-protect-against-employment-discrimination-related-to-artificial-intelligence/), California Civil Rights Department, June 30, 2025.
- [Automated Employment Decision Tools (AEDT)](https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page), NYC Department of Consumer and Worker Protection, accessed October 26, 2026.
- [Public Act 103-0804](https://www.ilga.gov/Legislation/publicacts/view/103-0804), Illinois General Assembly, 2024.
- [S.B. 226 Artificial Intelligence Consumer Protection Amendments (enrolled)](https://le.utah.gov/Session/2025/bills/enrolled/SB0226.pdf), Utah Legislature, 2025.
- [SEC Charges Two Investment Advisers with Making False and Misleading Statements About Their Use of Artificial Intelligence](https://www.sec.gov/news/press-release/2024-36), U.S. Securities and Exchange Commission, March 18, 2024.

## Common questions

**What should an AI acceptable use policy include?**

Eleven sections: scope and definitions; approved tools and data rules, covering confidential data, personal data, and copyright; prohibited uses; human review; disclosure to customers and candidates; vendor and third-party AI; recordkeeping and the AI inventory; incident reporting; training and AI literacy; roles and accountability; and a review cycle. Each section answers a rule. For example, NYDFS Circular Letter No. 7 expects New York insurers that use AI systems or external consumer data in underwriting or pricing to formalize their development and management of them in written policies and procedures, reviewed and approved at least annually, and NIST AI RMF GOVERN 1.6 calls for mechanisms to inventory AI systems.

**Is a company legally required to have an AI acceptable use policy?**

As of November 2, 2026, we found no US federal or state statute that requires every company to adopt one. Regulators expect written AI policies or programs from the organizations they cover: NYDFS Circular Letter No. 7 for New York insurers using AI in underwriting or pricing, the NAIC model bulletin's written AI Systems Program for insurers in adopting states, and OMB M-25-21, which says federal agencies should develop a policy that sets the terms for acceptable use of generative AI. In Colorado, an acceptable use policy that prohibits using generated content in a consequential decision is one condition of SB 26-189's exclusion for consumer-facing natural-language technology.

**Does the EU AI Act require an AI policy?**

Not by that name. Article 4, which has applied since February 2, 2025 and was amended in 2026 by the Digital Omnibus, requires providers and deployers to take measures to support AI literacy, without guaranteeing a level for any individual. Providers of high-risk systems must also put a quality management system in place under Article 17, documented in the form of written policies, procedures and instructions, and deployers carry the Article 26 duties, both from December 2, 2027 for stand-alone Annex III systems and August 2, 2028 for AI in Annex I Section A regulated products.

**What is the difference between an AI acceptable use policy and an AI governance policy?**

An acceptable use policy tells staff what they may and may not do with AI tools, such as which tools are approved and what data may go into them. A governance policy tells the organization how it approves, owns, tests, and retires AI systems. Some companies combine them in one document. The rules and frameworks in this guide reach both: NYDFS Circular Letter No. 7 (for New York insurers' AI used in underwriting and pricing) and NIST AI RMF GOVERN 1 call for policies that govern AI and its risks, and the NYDFS cybersecurity letter addresses how staff use AI applications.