What goes into an AI acceptable use policy that people will actually follow?

Practitioners often err by creating overly technical or legalistic AUPs that personnel find difficult to interpret or apply to their daily tasks. For an AUP to be followed, it must be practical, directly addressing common use cases and potential misuses within the organisation's operational context. This requires engaging stakeholders from various departments, including legal, IT, HR, and business units, to ensure the policy reflects real-world scenarios and is integrated into existing training and onboarding processes. Emphasising the "why" behind restrictions, such as data privacy or ethical considerations, rather than just stating rules, enhances understanding and buy-in.

A well-crafted AI AUP, aligned with ISO 42001's requirements for an AI management system (AIMS), serves as a foundational control for managing AI-related risks. It clarifies individual and collective responsibilities, enabling the organisation to demonstrate due diligence in governing AI systems. Without a clear, enforceable AUP, organisations face increased risks of non-compliance with regulations, reputational damage from AI misuse, and inefficient resource allocation due to unclear operational boundaries. Its effectiveness ultimately depends on consistent enforcement, regular review, and adaptation to evolving AI technologies and regulatory landscapes.