Do employers allow AI coding assistants, and what do their policies say?

Is there a standard company policy for AI coding tools?

No. A company AI policy is an internal document, and most are not published, so nobody outside can tell you what "employers" in general allow. What you can read are policies that public bodies and open source foundations publish, and the admin settings vendors document for companies that buy their tools. Those two sources show what a policy usually covers and how it is enforced.

Before you rely on anything below, find your own employer's document. It may be called an acceptable use policy, an AI policy or an engineering handbook page. Your employment contract matters too, because its intellectual property clause decides who owns what you write, with or without AI help.

What do published policies actually say?

The table below shows public policies, all opened by the CodeLifter editors when building the AI code policy tracker or this answer. The open source rows govern contributions to those projects, which often come from people doing it as part of their job.

Organisation	Allows AI coding help?	Key rule, in their words
UK government (AI Playbook, published 10 February 2025)	Yes, under ten principles	"You should follow any organisation-specific policies, especially ones about security and data handling."
Linux Foundation (generative AI policy)	Yes, with conditions	"Code or other content generated in whole or in part using AI tools can be contributed to Linux Foundation projects."
LLVM (AI tool policy)	Yes, human in the loop	"Contributors must read and review all LLM-generated code or text before they ask other project members to review it."
Fedora (Council policy proposal, approved 22 October 2025)	Yes	"The contributor is always the author and is fully accountable for their contributions."
Gentoo (Council AI policy, vote of 14 April 2024)	No	"It is expressly forbidden to contribute to Gentoo any content that has been created with the assistance of Natural Language Processing artificial intelligence tools."

The UK Playbook is a good model of a workplace policy because it is written for staff, not contributors. Its principles include knowing what AI is and its limits (Principle 1), using it securely (Principle 3), which names "prompt injections and hallucinations" as AI-specific threats, and keeping "meaningful human control at the right stages" (Principle 4). The Linux Foundation policy adds a condition that matters in any company: the tool's terms must be compatible with the project's licence, and any third-party material in the output needs permission.

For the full list of 16 open source policies, including the projects that ban AI output outright, see the thread on which projects ban AI-generated contributions.

How do employers enforce a policy in the tools?

A policy document says what you should do. Admin settings decide what the tool will let you do. Two vendors document these settings in detail, as of their docs read on 16 October 2026:

Control	Tool	What the vendor documents
Organisation policies	GitHub Copilot Business or Enterprise	Organisation owners set an enforcement option per feature and per model; an enterprise owner's choice cannot be overridden at organisation level
Third-party coding agents	GitHub Copilot	The same page lets owners allow or block Anthropic Claude and OpenAI Codex as coding agents in their repositories
Content exclusion	GitHub Copilot Business or Enterprise	Paths listed in settings are ignored by Copilot, but "Copilot CLI and Agent mode in Copilot Chat in IDEs do not support content exclusion"
Managed settings	Claude Code	managed-settings.json, an MDM policy or server-managed settings take top precedence; "Nothing in your own settings files or --settings overrides a managed key"

The content exclusion note is worth reading twice. If your employer relies on exclusion to keep a folder of secrets away from Copilot, that protection does not apply in agent mode or the CLI. A written rule still has to cover those cases.

How do you find out what your employer allows?

1. Search the intranet or handbook for "AI", "LLM", "Copilot" and "acceptable use". Read the whole document, not a summary.
2. Read the intellectual property and confidentiality clauses in your contract.
3. Ask which tools are approved and on which accounts. A company seat usually comes with the admin controls above; a personal account does not.
4. Ask what may go into a prompt: source code, customer data, credentials, internal documents. Keep secrets out regardless; the API keys thread covers how.
5. Ask whether AI use must be disclosed in commits or pull requests, and in what format.
6. If there is no policy, get the answer in writing, even an email, before you use a tool on company code.

If you write the policy yourself, the CodeLifter guide to disclosing AI in commits covers the commit side, and the MIT licence thread covers what changes when the code is published.

Short version

• No general rule exists; your employer's written policy and your contract decide.
• Published policies agree on approved tools, no sensitive data, human review and disclosure.
• Some open source projects, such as Gentoo, ban AI-generated contributions outright.
• Admin settings in Copilot and Claude Code enforce parts of a policy, with gaps (Copilot content exclusion skips agent mode and the CLI).
• If there is no policy, ask in writing before you start.