BYOD policy in the age of AI: 12 clauses to include and how to enforce them

Most BYOD policies in use today were written before anyone had heard of ChatGPT. They cover lost phones, passcodes and what happens when someone leaves. Very few say anything about staff pasting client emails into a personal AI assistant on their own phone, even though, for many organisations, that is now one of the easiest ways for company data to leave the building. 

There is a second problem too. A BYOD policy is often an HR document that staff sign once, and IT never sees. The rules say one thing and the settings in Microsoft 365 say another. This guide covers the 12 clauses we think a modern bring your own device policy needs, with example wording for each, and shows how to turn every rule into a control your IT team can actually enforce. 

Key takeaways 

• A BYOD policy should cover 12 areas, from eligibility and approved devices to privacy, leavers and now, AI. 
• The first decision is whether to allow BYOD at all. A no BYOD policy with a clear exceptions process is often the safest option. 
• Every clause should map to a Microsoft control, such as Conditional Access or an Intune app protection policy, or it will rely on goodwill. 
• AI needs its own clause. A 2026 survey found 51% of UK office workers had entered work correspondence into public AI tools. 
• The best policies are written by IT, HR, legal and the business together, then reviewed at least once a year.

What is a BYOD policy?

In simple terms, the BYOD policy meaning is this: a set of rules governing how employees, contractors and others can access company data from devices the organisation does not own. It covers who can do it, on which devices, what they can reach and what security measures they must accept in return. 

A good policy protects both sides. The organisation keeps control of its data. The employee gets clarity on what is expected and reassurance that their personal content stays private. A BYOD policy for employees should be readable without a glossary, while still being precise enough for IT to configure against. 

Why most BYOD policies are now out of date 

Three things have changed since many policies were written. 

• BYOD is the default. Microsoft 365 does not block personal devices unless you configure it to, so most organisations already have BYOD whether their policy allows it or not. 
• Work happens in apps, not on devices. Company data now lives in Outlook, Teams and OneDrive, which means the controls that matter sit at the app level. 
• AI has arrived on personal phones. A 2026 PagerDuty survey found that 51% of UK office professionals had entered work correspondence into public AI tools, and around a third of all respondents had entered customer data. A policy that says nothing about AI leaves staff to make it up. 

The first decision: BYOD or no BYOD policy? 

This is the question most BYOD guidelines skip, and it is the one Virtual Engine always asks first. BYOD introduces risk. If there is no clear business need, the most secure choice is not to allow it. 

That is not a theoretical position. At Virtual Engine, new starters cannot access company data on a personal device by default. They have to give a business justification, which is reviewed before access is granted. A no BYOD policy with a formal exceptions process is still a BYOD policy, and often a better one. 

If you do allow it, the 12 clauses below are what we would expect to see. They follow the same thinking as our BYOD Control Framework, which takes organisations from discovery and design through to rollout and handover. 

12 clauses every BYOD policy should include 

The BYOD policy examples below are a starting point, not legal wording to copy. Your own policy should reflect your risk appetite, your sector and advice from your HR and legal teams. 

1. Purpose and scope 

Example clause: “This policy applies to all employees, contractors and partners who access company email, files or applications from a device not owned by the company.” 

How to enforce it: Scope your Conditional Access policies to all users and cloud apps by default, with any exclusions documented and reviewed. 

2. Who is eligible 

Example clause: “Access from personal devices is only available to roles with an approved business justification, agreed by the employee’s manager and IT.” 

How to enforce it: Create a Microsoft Entra ID security group for approved BYOD users and target access policies at that group. Everyone else is blocked. Different groups can have different rules: one local authority we work with gives councillors, who do not have corporate devices, broad access from their own phones while blocking BYOD for staff with company laptops. 

3. Approved devices and operating systems 

Example clause: “Personal iOS and Android smartphones running a supported operating system may be used. Personal Windows and macOS computers may not be used to access company data.” 

How to enforce it: Allow or block each platform with Conditional Access and set minimum operating system versions in app protection. 

4. What users can access 

Example clause: “Approved users may access company email, calendar, Teams and OneDrive through approved apps only. Browser access from personal devices is not permitted.” 

How to enforce it: Use Conditional Access to require an app protection policy on personal devices and block browser access where it is not needed. Check every business app against Microsoft’s list of supported apps. 

5. Security requirements 

Example clause: “Users must set a PIN or biometric to open company apps and must not disable device security features.” 

How to enforce it: Set app protection access requirements for a PIN or biometric, and use conditional launch to block jailbroken or rooted devices. This is the core of any BYOD security policy. 

6. Data handling 

Example clause: “Company data must not be copied into, saved to or shared through personal apps or personal cloud storage.” 

How to enforce it: Restrict cut, copy and paste between managed and unmanaged apps and block “save as” to personal storage locations. 

7. AI acceptable use 

Example clause: “Company and client data must only be used with AI tools approved by the company and accessed through your work account. Company data must not be entered into personal AI apps or services.” 

How to enforce it: App protection data transfer restrictions stop company data being pasted into unmanaged apps, including personal AI tools. Pair this with approved AI tools that sign in with work accounts, so staff have a safe alternative rather than a ban. 

8. Privacy 

Example clause: “The company manages company data within approved apps only. It cannot see personal emails, photos, messages, browsing history or personal apps.” 

How to enforce it: Use mobile application management rather than full device enrolment for personal phones wherever possible, and say so plainly in onboarding. 

9. Lost or stolen devices 

Example clause: “You must report a lost or stolen device used for work to the IT service desk as soon as you realise it is missing. Company data will be removed remotely.” 

How to enforce it: Issue a selective wipe from the Microsoft Intune admin center, which removes company data from managed apps and leaves personal content untouched. 

10. Leaving the organisation 

Example clause: “When you leave, all company data will be removed from your personal device and your access will be revoked.” 

How to enforce it: Build the selective wipe and account disablement into every leaver process so it happens automatically. 

11. User responsibilities and support 

Example clause: “You are responsible for keeping your device updated and for not sharing it with others while company apps are signed in. IT will support company apps only, not the device itself.” 

How to enforce it: Back the rule up with minimum operating system checks so out of date devices are blocked until they are updated, and use app PIN timeouts so work sessions do not stay open on shared devices. 

12. Acceptance, exceptions and review 

Example clause: “By using a personal device for work you confirm you have read and agree to this policy. Exceptions must be approved in writing. The policy will be reviewed at least once a year.” 

How to enforce it: Capture acceptance as part of your BYOD agreement, for example through Microsoft Entra terms of use enforced by Conditional Access and keep a register of approved exceptions. 

From policy to control: a quick reference 

If you cannot point to a control for a rule, that rule is relying on goodwill. Our endpoint security and compliance service includes a policy review that checks exactly this gap. 

BYOD policy best practices 

• Write it together. IT, HR, legal and the business should all contribute, so the policy works in practice as well as on paper. 
• Record every design decision. Virtual Engine documents each decision, the options considered and its recommendation and has them signed off. If anyone later asks why a control exists, the answer is written down. 
• Start strict and relax with evidence. It is far easier to loosen a control than to tighten one people are used to. 
• Do not create quiet exceptions. If senior leaders need different rules, write them down and review them. Often the better answer is a company-owned device. 
• Give people an alternative to personal AI. A ban on its own pushes behaviour underground. Approved tools give staff a safe way to work faster. 
• Test before rollout. Pilot the controls with a small group so the experience matches what the policy promises. 

Getting these details right is what makes a rollout smooth. When Burges Salmon moved its mobile device management to Microsoft Intune with Virtual Engine, the two teams worked closely to make sure every design decision was incorporated and changes in requirements were adopted quickly. Once controls are live, our endpoint management service keeps them aligned with your policy, and you can see our full range of endpoint services for the bigger picture. 

Make your BYOD policy enforceable 

Whether you are writing your first BYOD policy or updating an old one for the age of AI, Virtual Engine can help you decide what to allow, design the right controls and put them in place in Microsoft 365. Explore The BYOD Control Framework to see how to turn your BYOD policy into controls you can enforce.