AI Acceptable Use Policy Template for ERP Users
Most companies already have staff pasting ERP data into chat tools. This template gives you a short, readable policy that names approved tools, lists data that must stay out, and sets a clear review rule for AI output. Fill in the fields and export a Word or PDF copy for sign-off.
Fill in
AI Acceptable Use Policy Template for ERP Users
AI Acceptable Use Policy
Company: Acme Precision Ltd Policy owner: Chief Information Officer Effective date: 2026-11-01
This policy applies to all employees, contractors and temporary staff who use AI tools with company information, including data that comes from the ERP, MES, PLM or quality systems.
1. Purpose
AI tools can speed up drafting, analysis and lookups. They also create risk when company data leaves our control, when output is trusted without checking, or when an agent can change records. This policy sets simple rules so people can use approved tools with confidence.
2. Approved tools
Only the following tools may be used with company data:
Company-hosted ERP assistant (internal), Microsoft 365 Copilot with company tenant controls, on-prem document search
Any other tool, including free consumer chat services and browser extensions, may be used only with public information and never with the data listed in section 3.
3. Data that must not be entered into non-approved tools
Customer drawings and specifications, export-controlled technical data, supplier pricing and contract terms, employee personal data, unreleased financial results, ERP credentials and API keys
4. Checking AI output
AI output can be wrong, out of date or invented. Rule: A named person reviews before external use. The person who sends or acts on AI output remains responsible for it. Numbers taken from the ERP by an AI tool must be traceable to the underlying report, query or transaction.
5. AI agents and system changes
An AI agent may read ERP data only within the permissions of the user or service account assigned to it. Any change to master data, orders, inventory, prices or payments requires a human approval step unless the Chief Information Officer has approved an exception in writing.
6. Exceptions and incidents
Request exceptions from: Head of Information Security. Report suspected data exposure, wrong AI actions or tool misuse immediately to: security@example.com. Reporting in good faith will not be treated as a disciplinary matter.
7. Review
This policy is reviewed at least once a year and whenever a new class of AI tool is approved.
Approvals
This is a starting point, not legal advice. Have legal and HR review it, and align it with any export control, customer contract or data protection obligations that apply to you.
Review my AI policy against our ERP setup
Optional: an expert reads your draft policy and flags gaps related to ERP data and agents.
Optional. The tool and every export work without this. No spam.
How to use this template
Start with the approved tools field, because a policy that only says no gets ignored. List the tools people may actually use, then name the data classes that stay out of everything else. Pick the output review rule that matches how your teams work today, then assign an exception approver by role so the policy survives staff changes. Export to Word, circulate to legal and HR, and publish it where staff will see it, such as the intranet page for IT services.
What a good policy covers
A usable AI policy is short and concrete. It separates tools from data, states who is accountable for output, and treats agents differently from chat because agents can act. Pair it with a data classification scheme so staff know what Confidential or export controlled means in practice.
- Approved tool list that IT can update without rewriting the policy
- Named data classes that must never leave company control
- A rule that the person acting on AI output owns the result
- Human approval for any ERP write-back by an agent
- A no-blame path for reporting mistakes
Manufacturing and ERP specifics
ERP data carries more risk than general office data. Bills of material, routings, supplier prices and customer drawings are commercial secrets, and defense or aerospace work may involve export-controlled technical data under ITAR or EAR. Employee records in HR modules carry privacy duties. If you cannot guarantee where an external tool processes data, treat it as a non-approved tool for these classes. Private or on-prem AI that runs inside your network is one way to give staff a useful approved option.
Common mistakes
The usual failures are a policy that bans everything without offering an approved alternative, a policy that lists tool brand names that go stale, and no rule for agents. Another frequent gap is the lack of a review step for output sent to customers. Revisit the policy after the first quarter of use and adjust based on real incidents and exception requests.
Frequently Asked Questions
Should the policy name specific AI products?
Keep product names in an approved tools list that IT maintains, and keep the policy text generic. That way adding or removing a tool does not require re-approval of the whole policy by legal and HR each time.
Do we need a separate policy for AI agents?
Not always. For most companies one policy with a dedicated agent section is enough. The key difference is that agents can take actions, so the policy must require permissions limits and human approval for any write-back to the ERP.
Who should sign this policy?
The policy owner, usually the CIO, plus information security, HR and legal or compliance. Signatures show that the people responsible for data, people and contracts have all reviewed the rules before staff are asked to follow them.
Is this template legal advice?
No. It is a generic starting point. Your legal counsel should review it against your contracts, export control duties, and privacy laws in the countries where you operate before you publish it.
If you want an approved AI option for ERP questions that runs on your own servers and respects ERP roles, Netray can scope that with you. The template stands on its own either way.
Related Tools
AI Model Card Template for ERP Use Cases
A one-page model card for each AI model or agent in your ERP landscape, covering intended use, data, limits, evaluation and ownership.
AI Agents & AutomationAI Risk Register Worksheet for ERP Projects
An editable risk register with likelihood x impact scores, owners and mitigations, pre-filled with typical ERP AI risks.
AI Agents & AutomationAI Agent Runbook Template
A runbook for the person on call when an ERP-connected AI agent misbehaves: how to check it, pause it and roll back.
Compliance & ContractsAI Vendor Security Questionnaire Template
A questionnaire covering data handling, model training use, access control, logging and incident response for AI vendors.
More Compliance & Contracts tools
See all- ISO 14001 Internal Audit Checklist
- Environmental Compliance Obligations Register Worksheet
- AI Governance Policy Template for Manufacturers
- Annualized Loss Expectancy Cyber Risk Calculator
- Cyber Insurance Retention Tradeoff Calculator
- MFA Rollout Risk Reduction Calculator
- Cyber Risk Register with ALE Worksheet
- IEC 62443 Security Levels and Parts Reference
- NIST CSF 2.0 Categories Reference for Manufacturers