AI Policy for Australian Business: What to Put in It

The people in your business are already using AI tools. The only question is whether they're doing it safely. Left alone, you end up with a handful of different habits, a few quietly risky ones, and no shared sense of what's okay. A short AI use policy fixes that, and it doesn't need to be a legal document to work.

What an AI policy is actually for

A policy is there so your team can use these tools with confidence and without creating a problem. Its whole job is to answer the questions everyone is quietly asking: what's fine to put in, what isn't, and who's responsible for what comes out. Answer those clearly and people stop avoiding the tools out of caution, or using them recklessly. Both cost you. Think of it as a permission slip with guardrails.

What it should cover

A useful policy is short and specific. Here's what it needs:

• What data must stay out of public tools. Client-identifying details, confidential records, anything personal about a real person. This is the most important line in the document, because it's where the privacy risk lives.
• Which tools are approved, and whether there's a preferred option that keeps data in your own environment for sensitive work.
• Human review. Anything that goes to a client, or that carries legal, financial or reputational weight, gets checked by a person before it leaves. AI drafts, a person signs off.
• Accuracy. A plain reminder that these tools can be confidently wrong, so nothing they state as fact goes out unchecked.
• Who to ask. One named person to take questions, so someone who's unsure has an option other than guessing.

Keep it to one page

The best AI policy is the one people read, which means it's short. A page of plain English beats a ten-page document sitting unread in a shared drive. You don't have to start from blank, either: our free AI policy template gives you a one-page draft to adapt. Skip the hypotheticals. Aim for the eighty per cent of situations that come up every week. If your business handles genuinely sensitive information or sits in a regulated field (a law firm, say), have someone qualified review the wording. For most businesses, a clear one-pager is the right size.

Rolling it out

Introduce the policy alongside a short, practical session on using the tools well, so the rules land in context rather than in an email nobody opens. The two belong together. We cover the policy side in using ChatGPT in an Australian business and the training in how to train your team on AI. Write it, explain the reasons once, and revisit it when the tools change. Run the session on the team's own work, because a rule people have tried on a real task is one they remember on Monday.

People also ask

Does a small business need an AI policy?

If anyone on your team uses AI tools for work, and they almost certainly do, then yes, a short one is worth having. It doesn't need to be formal or long. One page of ground rules on what's safe to put in and who checks what comes out covers most of the risk.

Is it legal to use AI tools with customer data in Australia?

It depends on how you do it. Under the Privacy Act, businesses have obligations about how personal information is used and disclosed, and a public AI tool counts as a third party. The safe default is to keep client-identifying data out of public tools, and to get advice on your specific obligations if a process genuinely needs that data. This is general guidance, not legal advice.

The short version of what we tell clients. A policy nobody reads changes nothing, and plenty are written to survive an audit rather than to be followed on a Tuesday. Keep it to one page, name the tools people are actually allowed to paste into, and revisit it when something changes. Where the policy usually needs to be firmest is customer-facing output, for reasons we set out in AI slop, trust and energy. We have yet to see a longer one get used.