CxO™ DELIVERABLE
Acceptable Use Policy Development
An acceptable use policy is the set of rules for how employees use company devices, accounts, data and software, including AI tools. DAG Tech's fractional CTO writes it around how your people actually work, in plain language, with clear approved tools so staff can move quickly and an enforcement path so the rules hold up.
Custom proposal · Last updated October 2026
The Short Answer
What Is an Acceptable Use Policy?
An acceptable use policy (AUP) is a plain-language document that sets out what employees may and may not do with company technology, and what happens when the rules are broken. Most policies fail from neglect, not absence. A generic template names systems you do not use. The document is too long for anyone to read. It says nothing about personal phones or AI tools. It bans things the business needs to do, so people ignore it. And there is no way to enforce it. The most common gap today is AI: staff want to use AI assistants to work faster, and with no approved tools or guidance they paste client data into whatever consumer chatbot is handy. A good AUP gives them approved options instead.
In a CxO engagement the AUP works alongside the IT roadmap, which supplies the technical controls, and the AI governance policy, which covers AI use in more depth. Your fractional CTO starts from your real obligations: regulations, client contracts and cyber insurance terms. Policy without technical enforcement is advice, so each rule is paired with how it is monitored or enforced in tools such as Microsoft 365, Google Workspace or your device management platform.
At a glance
SPEC SHEET- DELIVERABLE TYPE
- Policy document and acknowledgement
- ALSO KNOWN AS
- AUP, end-user technology policy, IT usage policy, computer use policy
- PRACTICE AREA
- Technology / Fractional CTO
- BEST FOR
- Organizations with outdated or template policies, BYOD, new AI tools or audit and insurance requests
- WHAT WE NEED
- Existing policies, compliance and contract obligations, HR input and a list of approved systems
- NEXT STEP
- Staff rollout, training and technical enforcement
Scope
What the Policy Covers
Each rule states the requirement, who it applies to, the reason and how it is monitored.
Obligations and scope
The regulations, client contracts and insurance terms the policy must meet, and the people, devices and data it covers.
Devices and BYOD
Rules for company laptops and phones, personal devices used for work, and what management is required on each.
Accounts and credentials
Passwords, multi-factor authentication, account sharing and what to do when a credential may be exposed.
Data handling
What each data classification allows: where it can be stored, shared, emailed or printed.
AI tools
Approved AI assistants for everyday work, what data can go into them and when AI use must be disclosed.
Email, messaging and file sharing
Approved channels for internal and external collaboration, and what never goes over personal accounts.
Prohibited uses
Clear, short list of what is not allowed, each with the reason behind it.
Monitoring and enforcement
What is monitored, a consequence ladder for breaches and an exception process with owners and expiry dates.
The Deliverable
What You Receive
- Plain-language acceptable use policy tailored to your systems
- Rule table with requirement, audience, reason, example and monitoring method
- Approved tools list, including AI assistants
- Exception request process with named owners and expiry dates
- Employee acknowledgement page for signature
- Enforcement map linking each rule to a technical control
How It Works
How It Runs
- STEP 01
Kickoff
We collect existing policies, obligations and the list of systems staff use.
- STEP 02
Observe the Work
We learn how people really use devices, file sharing, messaging and AI tools before writing rules.
- STEP 03
Draft and Review
We write the policy in plain language and review it with leadership, HR and legal.
- STEP 04
Readout
We finalize the policy, enforcement map and acknowledgement, and plan the rollout.
When to Start
Signs You Need a New Acceptable Use Policy
- Your current policy came from a template and names systems you do not use.
- It says nothing about AI tools, so staff use whatever they find.
- Employees use personal phones for work with no rules in place.
- Nobody has signed the policy in years.
- An auditor, client or insurer has asked to see it.
- You could not enforce the policy if someone broke it.
Compare
Acceptable Use Policy vs. AI Governance Policy
| Acceptable Use Policy | AI Governance & Acceptable Use Policy | |
|---|---|---|
| Question it answers | What may employees do with company devices, data, accounts and tools? | How does the organization choose, approve and oversee AI across the business? |
| Output | Signed employee policy with enforcement map | AI governance framework, approval process and AI-specific usage rules |
| When | Policy refresh, audits, BYOD or a new tool rollout | When AI adoption grows beyond a few individual users |
| Led by | Fractional CTO | Fractional Chief AI Officer |
Related
Often Paired With
FAQ
Acceptable Use Policy Development Questions
What should an acceptable use policy include?
Scope and obligations, rules for devices and personal devices, accounts and credentials, data handling by classification, AI tools, approved collaboration channels, prohibited uses, monitoring, enforcement, an exception process and a signed acknowledgement.
Should the policy ban AI tools?
Usually not. Bans push staff to unapproved tools. A better approach names approved AI tools, explains what data can go into them and when to disclose AI use, so people can work faster without exposing client data.
How long should an acceptable use policy be?
Short enough that people read it. We write rules in plain language with examples and keep detailed technical standards in separate documents. The test is whether an employee facing an unclear situation can find the answer quickly.
Does HR or legal need to review it?
Yes. We draft and coordinate, and your HR and legal advisers review the consequence ladder, monitoring language and acknowledgement before rollout. DAG Tech does not provide legal advice.
How much does acceptable use policy development cost?
It is scoped in hours at the CxO rate, based on the number of locations, device types and obligations involved. Your proposal shows the total before work starts.
Get Started
Request an acceptable use policy
Tell us what you need. We scope the hours and send a CxO proposal.
Sent with your request: CxO: vCTO: Acceptable Use Policy Development
- 01A scoping call with a fractional executive
- 02Every task, deliverable, hour and cost in one proposal
- 03A roadmap with start date
The CxO™ Program
Explore Every Practice Area
About DAG Tech Acceptable Use Policy Development
An acceptable use policy is the set of rules for how employees use company devices, accounts, data and software, including AI tools. DAG Tech’s fractional CTO writes it around how your people actually work, in plain language, with clear approved tools so staff can move quickly and an enforcement path so the rules hold up.
An acceptable use policy (AUP) is a plain-language document that sets out what employees may and may not do with company technology, and what happens when the rules are broken. Most policies fail from neglect, not absence. A generic template names systems you do not use. The document is too long for anyone to read. It says nothing about personal phones or AI tools. It bans things the business needs to do, so people ignore it. And there is no way to enforce it. The most common gap today is AI: staff want to use AI assistants to work faster, and with no approved tools or guidance they paste client data into whatever consumer chatbot is handy. A good AUP gives them approved options instead.