AI usage policy template: a generative AI policy for Malaysian workplaces

Why you need a generative AI policy

Staff are already using generative AI tools such as ChatGPT, Copilot and Gemini to draft emails, summarise documents and write code. Without a policy, each person decides alone what is safe to paste and whether to check the result. That is how customer data ends up in a free consumer account or a fabricated figure ends up in a board paper.

An AI usage policy (also called a generative AI policy or acceptable use policy for AI) gives everyone the same rules. It also gives managers something to train against and gives the company evidence that it took reasonable steps if something goes wrong.

Malaysia has no AI-specific statute yet. MOSTI's National Guidelines on AI Governance and Ethics (September 2024) are voluntary. In July 2026 the National AI Office consulted on a proposed AI Governance Bill built around principles such as accountability, transparency and responsible data governance; as of October 2026 it is still a proposal. The rules that already bind you are the general ones: the Personal Data Protection Act 2010 (as amended in 2024), confidentiality obligations in contracts, copyright, sector rules from your regulator, and your own information security policy. A good AI policy applies those to AI use.

What to include in an AI usage policy

The free template on this page follows this structure, with [bracketed blanks] for your company-specific choices.

Approval of AI tools

The single most useful rule is: use approved tools only, with company accounts. Consumer accounts on free tiers may keep prompts and use them to improve the service, and the company has no admin control or audit log.

Set up a simple approval route owned by IT or information security, with input from the DPO and legal. Before approving a tool, check:

• Where data is stored and processed, and whether it leaves Malaysia (relevant to the PDPA cross-border transfer rules).
• Whether prompts and files are used to train the provider's models, and whether that can be switched off.
• Retention, deletion, admin controls, single sign-on and audit logs.
• Contract terms on confidentiality, security, IP and breach notification.
• For AI agents or tools that connect to email, files or systems: what permissions they get and how actions are approved.

Publish the approved list where staff can find it, with the data classes each tool may handle. The AI Governance, Bias & Accountability lesson covers vendor due diligence for managers.

Data rules and the PDPA

The PDPA applies whenever personal data is processed, and entering it into an AI tool is processing. The 2024 amendments, in force in stages during 2025, raised maximum penalties, introduced mandatory Data Protection Officers for many organisations and mandatory data breach notification, and changed the cross-border transfer rules. See our guide to the PDPA amendment 2024.

Practical data rules for an AI policy:

• Never enter personal data, sensitive personal data, credentials, or confidential and restricted information into an AI tool that is not approved for that data class.
• Even in an approved tool, use the minimum data needed, and remove names and identifiers where you can.
• Do not use AI to make decisions about individuals (hiring, credit, discipline) without the approval of [the AI governance owner] and a human decision-maker.
• Treat AI outputs that contain personal data as personal data.
• Report suspected exposure at once, so the DPO can assess whether it is a notifiable breach. See data breach notification.

The Data Protection for AI lesson shows where personal data hides in prompts, uploaded files, memory and logs.

Acceptable use of ChatGPT at work

Give staff concrete examples. Abstract rules get ignored.

Usually acceptable with an approved tool

• Drafting and editing emails, letters and reports from your own notes.
• Summarising non-confidential documents or documents the tool is approved for.
• Brainstorming, outlines, checklists and translation drafts that a person then checks.
• Explaining a concept, a formula or a piece of code.

Prohibited

• Pasting personal or confidential information into an unapproved tool.
• Presenting AI output as verified fact without checking it.
• Creating content that impersonates a real person, or deepfake audio or video.
• Using AI to harass, discriminate or deceive.
• Letting an AI agent send, pay, delete or change records without human approval.
• Uploading third-party material you have no right to use.

The Using Generative AI Safely lesson puts staff in a 3D office where they decide what may be pasted, catch a hallucination and handle a prompt-injection attempt, which makes the policy stick far better than a read-and-sign form.

Human review, disclosure and accountability

AI tools produce fluent text that can be wrong. The policy should say plainly that the person using the tool is accountable for the output, and set review levels by risk:

• Internal, low-stakes (notes, first drafts): the author checks.
• External or decision-making (customer letters, reports, contracts, code to production): a second person or the normal approval process reviews.
• Regulated or safety-critical (legal, financial, medical, safety advice): a qualified person signs off; AI is a drafting aid only.

On disclosure, decide when AI use must be labelled. A common rule: disclose when AI generated a substantial part of external content, when a customer or regulator would reasonably expect to know, or when AI-generated images, audio or video could be mistaken for real. The AIGE guidelines name transparency and accountability among their principles, and the proposed AI Governance Bill points the same way.

The AI at Work: The Basics lesson covers owning the output and labelling AI-assisted work.

Rollout and review

1. Name an owner. A senior person or committee covering IT, legal, the DPO and HR.
2. Fill in the template and check it with legal and the DPO.
3. Publish the approved tools list alongside it.
4. Train everyone before or with the launch, then yearly. Our AI training for employees guide sets out what each role needs, and the AI for Everyone topic's AI at Work certificate maps closely to the policy sections.
5. Collect acknowledgement through your HR system or LMS.
6. Review at least yearly, and sooner when tools, the PDPA guidelines or Malaysia's AI legislation change.