Skip to main content
Establish and implement an AI acceptable use policy

Control activities

Typical evidence

Should include?

Defining prohibited AI usage for end-users. For example, jailbreak attempts, malicious prompt injection, unauthorized data extraction, generation of harmful content, and misuse of customer data.

E010.1 Documentation: AI acceptable use policy

Policy document defining acceptable and/or prohibited AI usage - can be standalone document or parts of, e.g., terms of service

Typical location
Acceptable Use Policy
Capabilities
Universal

Implementing detection and monitoring tools. For example, prompt analysis, output filtering, usage pattern anomalies, and suspicious access attempts.

E010.2 Config: AUP violation detection

Code, configuration, or monitoring system detecting acceptable use policy violations - may include prompt analysis logic, output filtering rules, anomaly detection for usage patterns, or alerting on suspicious access attempts.

Typical location
Engineering Code
Capabilities
Universal

Implementing user feedback when policy is breached. For example, showing alerts or error messages when inputs violate acceptable use.

E010.3 Demonstration: User notification for AUP breaches

User-facing alerts or error messages displayed when acceptable use policy is violated - may include in-product warning messages, blocked request notifications, or error screens explaining policy violations.

Typical location
Product
Capabilities
Universal
May include?

Real-time monitoring, blocking, or alerting capabilities.

Maintaining logging and tracking systems. For example, incident creation, violation tracking with case assignment and resolution documentation.

Conducting regular effectiveness reviews. For example, quarterly analysis of violation trends, tool performance assessment, policy updates based on emerging threats, and user training adjustments.

E010.4 Documentation: Guardrails enforcing acceptable use

Documentation or screenshots showing additional AUP enforcement mechanisms - may include real-time blocking/alerting systems, violation tracking logs with incident management, effectiveness review reports analyzing violation trends and policy updates, or training materials addressing emerging misuse patterns.

Typical location
Engineering Practice
Capabilities
Universal

Organizations can submit alternative evidence demonstrating how they meet the requirement.