# AI Acceptable Use Policy Template for ERP Users > Source: https://netray.co/tools/ai-acceptable-use-policy-template-for-erp-users > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A fill-in acceptable use policy that tells ERP users what they may and may not paste into AI tools, and who approves exceptions. ## Category compliance-legal ## Industry Manufacturing ## Audience - CIO - IT manager - Information security ## Tool **Kind:** template **Output:** document **Fields:** #### Company name **Key:** company **Type:** text **Default:** Acme Precision Ltd #### Policy owner (role) **Key:** policy_owner **Type:** text **Default:** Chief Information Officer #### Effective date **Key:** effective **Type:** date **Default:** 2026-11-01 #### Approved AI tools **Key:** approved_tools **Type:** textarea **Default:** Company-hosted ERP assistant (internal), Microsoft 365 Copilot with company tenant controls, on-prem document search #### Data that must never be entered into non-approved AI tools **Key:** banned_data **Type:** textarea **Default:** Customer drawings and specifications, export-controlled technical data, supplier pricing and contract terms, employee personal data, unreleased financial results, ERP credentials and API keys #### Output review rule **Key:** review_rule **Type:** select **Options:** - A named person reviews before external use - Review required only for customer or supplier facing output - Review required for any ERP write-back **Default:** A named person reviews before external use #### Exception approver (role) **Key:** exception_contact **Type:** text **Default:** Head of Information Security #### Incident reporting contact **Key:** incident_contact **Type:** text **Default:** security@example.com **Blocks:** #### AI Acceptable Use Policy **Body:** Company: {{company}} Policy owner: {{policy_owner}} Effective date: {{effective}} This policy applies to all employees, contractors and temporary staff who use AI tools with company information, including data that comes from the ERP, MES, PLM or quality systems. #### 1. Purpose **Body:** AI tools can speed up drafting, analysis and lookups. They also create risk when company data leaves our control, when output is trusted without checking, or when an agent can change records. This policy sets simple rules so people can use approved tools with confidence. #### 2. Approved tools **Body:** Only the following tools may be used with company data: {{approved_tools}} Any other tool, including free consumer chat services and browser extensions, may be used only with public information and never with the data listed in section 3. #### 3. Data that must not be entered into non-approved tools **Body:** {{banned_data}} #### 4. Checking AI output **Body:** AI output can be wrong, out of date or invented. Rule: {{review_rule}}. The person who sends or acts on AI output remains responsible for it. Numbers taken from the ERP by an AI tool must be traceable to the underlying report, query or transaction. #### 5. AI agents and system changes **Body:** An AI agent may read ERP data only within the permissions of the user or service account assigned to it. Any change to master data, orders, inventory, prices or payments requires a human approval step unless the {{policy_owner}} has approved an exception in writing. #### 6. Exceptions and incidents **Body:** Request exceptions from: {{exception_contact}}. Report suspected data exposure, wrong AI actions or tool misuse immediately to: {{incident_contact}}. Reporting in good faith will not be treated as a disciplinary matter. #### 7. Review **Body:** This policy is reviewed at least once a year and whenever a new class of AI tool is approved. #### Approvals **Signatures:** - Policy owner - Head of Information Security - Human Resources - Legal or compliance **Notes:** This is a starting point, not legal advice. Have legal and HR review it, and align it with any export control, customer contract or data protection obligations that apply to you. ## Content **Intro:** Most companies already have staff pasting ERP data into chat tools. This template gives you a short, readable policy that names approved tools, lists data that must stay out, and sets a clear review rule for AI output. Fill in the fields and export a Word or PDF copy for sign-off. **Sections:** #### How to use this template **Body:** Start with the approved tools field, because a policy that only says no gets ignored. List the tools people may actually use, then name the data classes that stay out of everything else. Pick the output review rule that matches how your teams work today, then assign an exception approver by role so the policy survives staff changes. Export to Word, circulate to legal and HR, and publish it where staff will see it, such as the intranet page for IT services. #### What a good policy covers **Body:** A usable AI policy is short and concrete. It separates tools from data, states who is accountable for output, and treats agents differently from chat because agents can act. Pair it with a data classification scheme so staff know what Confidential or export controlled means in practice. **Bullets:** - Approved tool list that IT can update without rewriting the policy - Named data classes that must never leave company control - A rule that the person acting on AI output owns the result - Human approval for any ERP write-back by an agent - A no-blame path for reporting mistakes #### Manufacturing and ERP specifics **Body:** ERP data carries more risk than general office data. Bills of material, routings, supplier prices and customer drawings are commercial secrets, and defense or aerospace work may involve export-controlled technical data under ITAR or EAR. Employee records in HR modules carry privacy duties. If you cannot guarantee where an external tool processes data, treat it as a non-approved tool for these classes. Private or on-prem AI that runs inside your network is one way to give staff a useful approved option. #### Common mistakes **Body:** The usual failures are a policy that bans everything without offering an approved alternative, a policy that lists tool brand names that go stale, and no rule for agents. Another frequent gap is the lack of a review step for output sent to customers. Revisit the policy after the first quarter of use and adjust based on real incidents and exception requests. **Cta:** If you want an approved AI option for ERP questions that runs on your own servers and respects ERP roles, Netray can scope that with you. The template stands on its own either way. **Faq:** #### Should the policy name specific AI products? **Answer:** Keep product names in an approved tools list that IT maintains, and keep the policy text generic. That way adding or removing a tool does not require re-approval of the whole policy by legal and HR each time. #### Do we need a separate policy for AI agents? **Answer:** Not always. For most companies one policy with a dedicated agent section is enough. The key difference is that agents can take actions, so the policy must require permissions limits and human approval for any write-back to the ERP. #### Who should sign this policy? **Answer:** The policy owner, usually the CIO, plus information security, HR and legal or compliance. Signatures show that the people responsible for data, people and contracts have all reviewed the rules before staff are asked to follow them. #### Is this template legal advice? **Answer:** No. It is a generic starting point. Your legal counsel should review it against your contracts, export control duties, and privacy laws in the countries where you operate before you publish it. ## Search terms ai acceptable use policy template, generative ai policy template, chatgpt policy for employees template, ai usage policy for manufacturers, ai policy template word, employee ai use guidelines, erp data and ai policy --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json