What an AI use policy is for
A good policy lets people use AI on real work without checking with you every time. It answers the questions they'd otherwise ask you one by one: which tool, what can go in, who checks it, and what happens if something goes wrong.
Australia's privacy regulator (the OAIC), the Australian Cyber Security Centre and the National AI Centre all recommend having one, and the template page sums up what each of them says. The National AI Centre's Guidance for AI Adoption (listed on ai.gov.au under Essential AI practices) puts it at the very start. Its first two steps are to name a senior leader who owns AI governance and to create an AI policy that tells staff about the risks and how to manage them.
What a good AI use policy covers
The National AI Centre has a short checklist of what to confirm before you publish a policy. Here's how it lines up with the ten sections in our template.
| Before you publish, check the policy clearly outlines... | Where it sits in our template |
|---|---|
| What AI can and can't be used for | Section 4, What to use AI for |
| Who approves higher-risk use cases | Sections 2 and 4 (the policy owner, and the uses that need a check first) |
| What data staff can put into tools | Section 5, What you can and can't put in |
| When staff need to oversee AI use | Section 6, Check everything before it goes out |
| How staff should report issues or misuse | Section 9, If something goes wrong |
| When the policy will be reviewed | Section 10, Training and review |
Our template adds four sections that we find make the difference in practice: why you have the policy, which tools are approved, being open with clients about AI, and how a new tool or new use gets added. Policies often go stale because someone starts using a new AI feature inside software you already pay for, and nobody decides whether it's allowed.
Five decisions to make before you fill in the blanks
The highlighted bits in the template are quick to fill in once you've made these calls. Make them first, with whoever runs operations.
1. Who owns it. One person decides which tools are approved and answers questions. In a smaller business that's usually the founder, a director or the operations manager. Put their name in the policy so people know exactly who to ask.
2. Which tools are approved. Pick one main tool on a business plan, signed in with work accounts, so everyone's working in the same place. Personal and free accounts come off the list. The Cyber Security Centre points out that some AI providers may use what customers type in to train their models, depending on settings and the type of subscription, so check the data settings on whatever you approve. If you're still choosing, our Claude vs ChatGPT vs Copilot comparison asks six questions and gives you a suggestion.
3. What never goes in. The template's list covers client personal details, health and financial information, passwords and anything a client has asked you to keep confidential, and none of it goes into a tool that isn't on your approved list. Add what's specific to your industry. A recruitment agency adds candidate notes, and a property firm adds tenant details.
4. Which uses need a check first. The template flags three: anything a client will rely on as advice, anything about hiring, pay or performance, and anything published under your name. Add your own. For many businesses that's quotes and pricing.
5. What you tell clients. Decide what you'll say if a client asks how you use AI, and whether any chat or message they see could have been written by AI without a person reviewing it. If your business is covered by the Privacy Act, there's a new rule to plan for. From 10 December 2026, your privacy policy has to explain when computer programs use personal information to make, or help make, decisions that could significantly affect people.
Mistakes we see with AI policies
Writing a long one. A twelve-page policy doesn't get read. Ours is designed to be read in five minutes. If you need more detail for a regulated area, put it in a separate procedure and keep the policy short.
Banning AI outright. People keep using it, quietly, on personal accounts. The National AI Centre calls this shadow AI and describes it as often a sign of unmet need or time pressure. A clear list of what's allowed brings that use back into tools you control.
Listing tools without checking them. Approving "ChatGPT" doesn't say which plan or which settings. Name the plan.
No way to own up. If people expect trouble for pasting something into the wrong tool, they keep quiet and you find out months later. Name the person to tell in the policy, and react calmly the first time someone does.
Rolling it out to your team
The template page lists the four rollout steps. The one most teams rush is the team meeting, so here's how we'd run it in under an hour:
- Say why. The policy is there so people can use AI on client work with confidence. Introduce the owner.
- Show the approved tool on a work account, and where the approved list lives.
- Work through two real jobs. Pick something like a client email someone wants help drafting, or a contract they'd like to check. For each one, decide together what can go in, what has to come out first and who checks the result.
- Read the "never goes in" list aloud and ask what's missing for your industry.
- Finish on mistakes. Tell people who to go to if something goes wrong, and that owning up early is what you want.
Then put the review date in the owner's calendar and add the policy to every new starter's first week.
Every one of our AI workshops covers safe use with your own tools and examples, if you'd rather we ran that session with your team. Workshops start from $3,500 + GST for a half day.
When you need more than a short policy
The template suits most owner-led businesses starting out. You'll want more if any of these apply:
- You're in a regulated industry, or you handle health or other sensitive information.
- AI helps make decisions about people, like screening job applicants or assessing tenant applications.
- Customers talk to an AI chatbot or receive AI-written messages without anyone reviewing them.
- You're building your own AI tools or connecting AI to your core systems.
For those, the National AI Centre publishes a longer AI policy guide and template, an AI register template for listing every AI tool you use, and a set of screening questions for checking whether a new use needs extra controls. Our guide to an AI governance framework for directors shows how they fit together on one page. And have the policy checked by a lawyer or compliance adviser who knows your industry.
Common questions
Yes. The National AI Centre published an AI policy guide and template as a Word document on 22 April 2026. It's longer and more formal than ours, with roles like a governance committee, so we think it suits organisations with more complex AI use. Ours is shorter, plainer and built for teams getting started.
No general law requires one as at November 2026. The Guidance for AI Adoption that recommends it is government guidance with no penalties attached. Your existing obligations, like the Privacy Act and any professional rules, still apply to how your team uses AI, and a policy is the simplest way to show people how to meet them.
Tell the policy owner straight away and work out what went in and which account it went into. If personal information was involved and your business is covered by the Privacy Act, check whether it's a notifiable data breach, which means telling the people affected and the OAIC. The Cyber Security Centre describes an early 2025 case where a contractor uploaded names, contact details and health records into an AI system, and it's considered one.
Yes. Our template covers everyone who works with you, including contractors, and any AI tool, including AI features built into software you already use.
Our free AI readiness check takes about two minutes and shows which area to work on first.