Updated 2026-09-15
My AI acceptable-use policy
I sell AI governance for a living. This AI acceptable-use policy is mine, published in public rather than filed away. It is also a worked example of the one-page policy I ask clients to write.
Rules
What I hold myself to
- 01I own AI risk for this practice. There is nobody else to delegate it to, which makes the register short and the accountability obvious.
- 02Every AI system I use for client work is listed in the register, with the data tier it may see and whether its output is reviewed before a client sees it.
- 03Model output is never sent to a client unreviewed. If a document was drafted with an AI system, I have read every line of it and I stand behind it.
- 04Client data is never used to improve a model. Where a vendor offers training on inputs by default, that setting is off before the tool is used.
- 05If a vendor changes its terms, its register entry is re-checked before the next engagement day, not at renewal.
- 06Incidents are written down, including the ones with no consequence, because the pattern matters more than the single event.
Classification
Which data may go where
| Tier | Examples | Rule |
|---|---|---|
| Public | Published writing, open-source code, marketing copy. | Any vendor. No approval needed. |
| Internal | Drafts, notes, my own repositories, invoices. | Vendors with a signed data processing agreement and no training on inputs. |
| Client confidential | Client code, architecture documents, incident detail, personal data. | Only vendors named in that client contract. Never pasted into a consumer chat interface. |
| Restricted | Credentials, production secrets, anything under legal privilege. | No AI system, no exception. |
Want one of these
This page is four documents in one.
The register, the policy, the classification table and the named owner. The Starter Kit describes them, and the Assessment fills them in against your systems.
Open the Starter Kit
Or email hello@meshin.co