# Do employers allow AI coding assistants, and what do their policies say?

Source: https://codelifter.com/forum/posts/do-employers-allow-ai-coding-assistants-and-what-do-their-policies-say/
Site: CodeLifter Forum, category AI code policies
Published: 2026-10-26. Updated: 2026-10-31. Replies: 2.

## Question by CodeLifter editors (staff), 2026-10-26

Whether you may use an AI coding assistant at work depends on your employer's written policy; there is no legal default that allows or bans it. Published policies from governments and open source foundations tend to set the same rules: use approved tools with acceptable terms, keep sensitive data out, keep a human reviewing output, and disclose AI use.

## Is there a standard company policy for AI coding tools?

No. A company AI policy is an internal document, and most are not published, so nobody outside can tell you what "employers" in general allow. What you can read are policies that public bodies and open source foundations publish, and the admin settings vendors document for companies that buy their tools. Those two sources show what a policy usually covers and how it is enforced.

Before you rely on anything below, find your own employer's document. It may be called an acceptable use policy, an AI policy or an engineering handbook page. Your employment contract matters too, because its intellectual property clause decides who owns what you write, with or without AI help.

## What do published policies actually say?

The table below shows public policies, all opened by the CodeLifter editors when building the [AI code policy tracker](https://codelifter.com/provenance/ai-code-policy-tracker/) or this answer. The open source rows govern contributions to those projects, which often come from people doing it as part of their job.

| Organisation | Allows AI coding help? | Key rule, in their words |
| --- | --- | --- |
| UK government ([AI Playbook](https://www.gov.uk/government/publications/ai-playbook-for-the-uk-government/artificial-intelligence-playbook-for-the-uk-government-html), published 10 February 2025) | Yes, under ten principles | "You should follow any organisation-specific policies, especially ones about security and data handling." |
| Linux Foundation ([generative AI policy](https://www.linuxfoundation.org/legal/generative-ai)) | Yes, with conditions | "Code or other content generated in whole or in part using AI tools can be contributed to Linux Foundation projects." |
| LLVM ([AI tool policy](https://llvm.org/docs/AIToolPolicy.html)) | Yes, human in the loop | "Contributors must read and review all LLM-generated code or text before they ask other project members to review it." |
| Fedora ([Council policy proposal](https://communityblog.fedoraproject.org/council-policy-proposal-policy-on-ai-assisted-contributions/), approved 22 October 2025) | Yes | "The contributor is always the author and is fully accountable for their contributions." |
| Gentoo ([Council AI policy](https://wiki.gentoo.org/wiki/Project:Council/AI_policy), vote of 14 April 2024) | No | "It is expressly forbidden to contribute to Gentoo any content that has been created with the assistance of Natural Language Processing artificial intelligence tools." |

The UK Playbook is a good model of a workplace policy because it is written for staff, not contributors. Its principles include knowing what AI is and its limits (Principle 1), using it securely (Principle 3), which names "prompt injections and hallucinations" as AI-specific threats, and keeping "meaningful human control at the right stages" (Principle 4). The Linux Foundation policy adds a condition that matters in any company: the tool's terms must be compatible with the project's licence, and any third-party material in the output needs permission.

For the full list of 16 open source policies, including the projects that ban AI output outright, see the [thread on which projects ban AI-generated contributions](/forum/posts/which-open-source-projects-ban-ai-generated-contributions/).

## How do employers enforce a policy in the tools?

A policy document says what you should do. Admin settings decide what the tool will let you do. Two vendors document these settings in detail, as of their docs read on 16 October 2026:

| Control | Tool | What the vendor documents |
| --- | --- | --- |
| Organisation policies | GitHub Copilot Business or Enterprise | [Organisation owners](https://docs.github.com/en/copilot/how-tos/administer-copilot/manage-for-organization/manage-policies) set an enforcement option per feature and per model; an enterprise owner's choice cannot be overridden at organisation level |
| Third-party coding agents | GitHub Copilot | The same page lets owners allow or block Anthropic Claude and OpenAI Codex as coding agents in their repositories |
| Content exclusion | GitHub Copilot Business or Enterprise | [Paths listed in settings](https://docs.github.com/en/copilot/how-tos/configure-content-exclusion/exclude-content-from-copilot) are ignored by Copilot, but "Copilot CLI and Agent mode in Copilot Chat in IDEs do not support content exclusion" |
| Managed settings | Claude Code | [`managed-settings.json`](https://code.claude.com/docs/en/settings), an MDM policy or server-managed settings take top precedence; "Nothing in your own settings files or `--settings` overrides a managed key" |

The content exclusion note is worth reading twice. If your employer relies on exclusion to keep a folder of secrets away from Copilot, that protection does not apply in agent mode or the CLI. A written rule still has to cover those cases.

## How do you find out what your employer allows?

1. Search the intranet or handbook for "AI", "LLM", "Copilot" and "acceptable use". Read the whole document, not a summary.
2. Read the intellectual property and confidentiality clauses in your contract.
3. Ask which tools are approved and on which accounts. A company seat usually comes with the admin controls above; a personal account does not.
4. Ask what may go into a prompt: source code, customer data, credentials, internal documents. Keep secrets out regardless; the [API keys thread](/forum/posts/how-do-you-keep-api-keys-out-of-a-vibe-coded-app/) covers how.
5. Ask whether AI use must be disclosed in commits or pull requests, and in what format.
6. If there is no policy, get the answer in writing, even an email, before you use a tool on company code.

If you write the policy yourself, the CodeLifter guide to [disclosing AI in commits](https://codelifter.com/provenance/disclosing-ai-in-commits/) covers the commit side, and the [MIT licence thread](/forum/posts/can-you-put-ai-generated-code-under-the-mit-licence/) covers what changes when the code is published.

## Short version

- No general rule exists; your employer's written policy and your contract decide.
- Published policies agree on approved tools, no sensitive data, human review and disclosure.
- Some open source projects, such as Gentoo, ban AI-generated contributions outright.
- Admin settings in Copilot and Claude Code enforce parts of a policy, with gaps (Copilot content exclusion skips agent mode and the CLI).
- If there is no policy, ask in writing before you start.

## Reply 1 by CodeLifter editors (staff), 2026-10-26

**Can I use my personal Copilot or ChatGPT account for work code?** Only if your employer says so, and there is a technical reason many will not. The controls a company buys apply to the company's seats and devices. GitHub describes its organisation policies as controlling features "for users granted a license by your organization", and [content exclusion](https://docs.github.com/en/copilot/how-tos/configure-content-exclusion/exclude-content-from-copilot) is available to "Organizations with a Copilot Business or Copilot Enterprise plan". A personal subscription sits outside both, so a folder your employer excluded is not excluded for you.

Claude Code works the same way. Its [settings documentation](https://code.claude.com/docs/en/settings) says managed settings reach "every project on every machine your organization deploys it to, or that you sign in to with your organization account." Sign in with a personal account on a personal laptop and none of your employer's deny rules or model limits apply.

The UK government's [AI Playbook](https://www.gov.uk/government/publications/ai-playbook-for-the-uk-government/artificial-intelligence-playbook-for-the-uk-government-html) names ChatGPT, Claude and Gemini as examples of "publicly accessible generative AI tools", and lists separately the generative AI built into mainstream products, such as Microsoft 365 Copilot. Ask before you mix personal and work accounts on company code.

## Reply 2 by CodeLifter editors (staff), 2026-10-31

**Do I have to say in my commits that I used AI?** Only if your employer or the project requires it, but the formats already exist, so agree one. The Linux kernel's [coding assistants guide](https://docs.kernel.org/process/coding-assistants.html) says "Contributions should include an Assisted-by tag" and that "AI agents MUST NOT add Signed-off-by tags", because a sign-off is a human's legal statement. The [Apache Software Foundation](https://www.apache.org/legal/generative-tooling.html) recommends a different token: "Generated-by: <Name of Tool> <Version>". Mesa's [patch guide](https://docs.mesa3d.org/submittingpatches.html) says disclosure "is always required" when AI "was involved in the creative process", and keeps `Co-authored-by` for humans.

Not everyone requires it. CPython's [developer guide](https://devguide.python.org/getting-started/ai-tools/) says disclosure in the pull request description "is appreciated, while not required." A workplace can pick any of these, as long as it is written down and checked. The [Assisted-by trailer thread](/forum/posts/how-can-a-team-enforce-an-assisted-by-trailer-on-commits/) shows how to enforce a trailer with a commit hook, and the thread on [who authors a commit made through an MCP server](/forum/posts/who-is-the-author-of-a-commit-made-through-an-mcp-server/) covers commits an agent makes for you.

---
Cite as: CodeLifter Forum, "Do employers allow AI coding assistants, and what do their policies say?", https://codelifter.com/forum/posts/do-employers-allow-ai-coding-assistants-and-what-do-their-policies-say/, accessed 2026-11-12.