Your staff are already using AI. Some draft emails with ChatGPT, some ask Copilot to summarize meetings, some paste a spreadsheet into a chat window for a quick analysis. Most of them are simply trying to work faster. What is usually missing is a clear statement of where the limits are.

An AI acceptable-use policy sets those limits. A good one lets people keep the productivity gains while confidential and personal data stays where it belongs. Below is what the policy should contain and how to roll it out in a Saudi organization.

Why banning AI rarely works #

Some organizations block every AI website. It feels safe, but it usually fails. Staff move to personal phones and personal accounts, where you see nothing at all, and the business loses real productivity. AI features also arrive inside software you have already approved, so a blanket ban is hard to enforce.

It works better to approve the right tools, set clear rules for data, and give people an easy way to ask when they are unsure.

What can go wrong #

The risks are concrete:

  • A contract, a tender response or a customer list pasted into a public AI tool may be stored or processed outside your organization.
  • Employee files, patient details or customer records entered into an AI tool can raise obligations under the Personal Data Protection Law.
  • AI can produce confident text that is wrong. If it goes into a report, a contract or a customer reply without review, the mistake is yours.
  • Developers pasting source code may include passwords, keys or internal addresses.
  • AI tools that read emails, files or web pages can be steered by instructions hidden in that content, a technique called prompt injection.

The seven parts of a good policy #

Keep the policy short enough to read in five minutes. These seven parts cover what matters.

1. Approved tools #

List the AI tools approved for work, and state that work data goes only into approved tools, using work accounts. Business versions usually come with stronger data commitments than free personal accounts, so check the terms before approving.

2. Data rules by classification #

Tie the rules to your data classification so staff do not have to guess:

  • Public information may be used with approved tools.
  • Internal information may be used with approved business tools only.
  • Confidential information is not entered unless a specific tool has been approved for that purpose.
  • Personal and regulated data is never entered unless a reviewed and approved process exists.
  • Passwords, keys and access codes are never entered, under any circumstances.

3. Human review #

Treat AI output as a draft. Anything that goes to a customer, a regulator, a contract or production code must be reviewed by a person who is accountable for it.

4. Transparency #

Agree when staff should say that AI helped produce a piece of work, for example in customer-facing material or official documents.

5. Building with AI #

If a team wants to build AI features, connect AI to company data or let AI agents take actions, that goes through an approval step with a security review first. This is where the larger risks are.

6. Reporting #

Tell staff what to do if they think they entered the wrong data or saw an AI tool behave oddly: whom to tell, and how quickly. An early report is far more useful than silence.

7. Ownership and review #

Name the owner of the policy and review it at least every six months. AI tools change quickly, and so will the guidance from the National Cybersecurity Authority.

Rolling it out #

A policy only works if people know about it and understand it.

  1. Start with an inventory. Ask teams which AI tools they already use. A short survey tells you more than a firewall log.
  2. Approve before you restrict. Make sure a good approved option exists before blocking the alternatives.
  3. Train with real examples. Show staff a safe prompt and an unsafe one, using the kind of documents your organization actually handles.
  4. Make it easy to ask. A named contact for AI questions prevents most mistakes.
  5. Measure and adjust. After the first three months, review usage, incidents and questions, and update the rules.

A simple test for staff #

When in doubt, ask one question before pressing Enter: would I be comfortable if this text appeared outside our company? If not, do not paste it, or use a tool approved for that kind of data.

How it connects to national requirements #

The National Cybersecurity Authority's AI Cybersecurity Guidelines place AI use within cybersecurity governance, and an acceptable-use policy is one of the clearest signs that this governance exists. If personal data is involved, the Personal Data Protection Law applies as well.

We help organizations write and roll out AI acceptable-use policies as part of our AI cybersecurity readiness service, alongside PDPL compliance and security awareness training.

Frequently asked #

Is it safe to use ChatGPT at work?

It can be, with the right account type and clear rules. Use approved business tools with work accounts, keep confidential and personal data out unless a tool is approved for it, and review AI output before it is used.

Should we block AI tools?

A blanket ban usually pushes staff to personal devices and accounts where you have no visibility. Approving the right tools and setting data rules is more effective.

What should never be entered into an AI tool?

Passwords, keys and access codes should never be entered. Personal and regulated data should only be entered through a reviewed and approved process.

Does the PDPL apply to AI use?

If personal data is entered into or processed by an AI tool, the Personal Data Protection Law applies to that processing, just as it does for any other system.

Official Sources and References #

The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.