AI Use Policy Template for Australian Small Businesses

List your current AI uses, the accounts involved and the information each use handles before writing the rules. Otherwise the policy can approve a tool in principle while missing the feature or connection staff actually use. Speak with staff about drafting, meeting notes, research, document uploads and connected assistants. Ask which account owns the material and whether the business can manage access. Record any feature that reads from an inbox, shared drive or customer system. Its access can matter even when the person only types a short question. Use a register with an owner, task, product and account, information category, permitted features and review date. Keep unreviewed uses visibly unapproved. Do not assume that a supplier's business branding or a no-training term settles retention, access, storage or the purpose for which information may be processed. Ask the relevant people to review uncertain arrangements. That may include an administrator, the person responsible for privacy or a professional adviser. Keep a decision record with the terms and configuration checked at the time. Our client-data checklist gives questions to bring into that assessment.

The following example gives a fictional office team a structure to adapt and approve. Replace the bracketed fields and resolve any uncertain rule before staff rely on it. Purpose and responsibility Our team uses approved AI features to assist with specified work. [Responsible role] owns this policy, the approved-use register and decisions about new uses. Staff ask [contact] when the rules do not answer a question. Approved tools and tasks Staff may use the accounts, features and tasks listed in the register. Approval for one task does not approve every feature of the product. New connections, uploads or externally used outputs need the review specified in the register. Information rules Staff use public, fictional or specifically approved material within the conditions recorded for the task. Client, employee, commercially sensitive and other restricted information stays outside an AI feature unless an authorised decision expressly permits that use. Output and actions The named reviewer checks relevant facts, source material, calculations and commitments before an output is used externally. AI features may not send messages, change records or make commitments beyond the authority recorded for the task. Questions and incidents Staff report suspected inappropriate disclosure, incorrect external output or unexpected tool access to [contact]. The owner decides whether to pause the use, preserve relevant records and follow the organisation's incident process. Review [Owner] reviews this policy on [date] and when products, settings, tasks or obligations change. Approved versions and related instructions are kept in [location].

An approved-use register connects the policy to a particular task, account and reviewer. Give staff enough detail to identify the allowed activity without guessing from a product name. This is an illustrative register, not a determination that the tasks suit your organisation. Add the actual product, account type, settings, owner and review date. Different tools with similar names can have different access and information arrangements. Keep the register where people work, with a clear link to the current policy. When a use changes, update the record rather than assuming its previous approval still applies. A new connector, broader permission or different information category can change the decision. Assign someone to review supplier notices that affect approved uses.

Useful information rules name the material staff may use and the conditions that apply to a particular account and task. Broad labels such as safe or enterprise are insufficient instructions on their own. Classify the material your business handles in terms people recognise. Examples include public service descriptions, internal procedures, customer correspondence, employee records and commercially sensitive proposals. Decide who can authorise each use and which information must stay out of a tool. Keep the decision tied to the purpose and process, rather than treating every document as interchangeable. Check redacted examples before relying on them. A document can contain names in comments, tracked changes, file properties or embedded images even when its visible body looks anonymous. If safe preparation requires more effort than the exercise justifies, use a fictional example instead. The OAIC's commercial AI guidance recommends due diligence about the intended use, access, privacy and security risks, and human oversight. Which Australian privacy obligations apply varies by organisation and activity. Your policy should fit those requirements and any professional or contractual duties. No wording in this example automatically approves processing client or employee information.

Name a reviewer with the knowledge and authority needed for the task. The person checking a draft should be able to inspect its evidence and decide whether the final result can be used. For a customer response, review the original request, names, dates, service details and commitments. For a technical summary, inspect its references, assumptions and limitations. Where the output involves a professional judgement, the appropriately authorised person retains that responsibility. An AI-generated assurance that an answer is correct does not replace review. Treat drafting and execution as separate permissions. A feature that prepares an email does not automatically need authority to send it. A feature that suggests a record update does not automatically need authority to change the record. Write the permitted action and the approval step in the register so both staff and the person configuring the system understand the boundary. Agree what happens when the reviewer is unavailable or evidence is missing. Pausing, escalating or completing the task manually should be normal options. The human approval guide explains how to carry those decisions into a working process.

Introduce the policy with examples from the team's work, then ask staff to make decisions using it. A document that has been circulated but never practised gives limited evidence that people can apply the rules. Walk through a permitted task, a clearly restricted task and an uncertain case. Ask participants to identify the account, information and reviewer involved. Let them explain where the wording is unclear. Revise the instructions when several reasonable people interpret them differently. Keep the first practice exercise low risk. A fictional customer enquiry can teach the difference between drafting and approving a promise. A sample report can show how unsupported claims are recorded. Staff should leave knowing where the current register lives and who answers a question before they proceed. Record the policy version and the roles that need further help. Use your onboarding process to teach new staff the same method. Our small business AI training guide explains how to organise practical exercises. Review questions from real work after the introduction, rather than treating attendance as proof that every use is understood.

Review the policy when a tool, permission, task or obligation changes and at a regular date set by the owner. A short change record helps staff understand which instruction is current and why it changed. Give people a simple way to report an unexpected output, questionable disclosure or feature that accessed more information than expected. Record the task, account, timing and known facts. Avoid circulating sensitive material more widely while trying to explain the problem. The responsible person should decide whether to pause the use and follow the organisation's existing response process. Use incidents and near misses to improve the register, examples and training. A problem may reveal a missing approval, an unclear information rule or a task that cannot be checked reliably. Changing the prompt alone may not address the underlying issue. Keep a record of approved versions, account owners and supplier decisions. Review access when people change roles or leave. The aim is a policy that continues to match the real workflow. Our AI adoption roadmap shows how policy, practice and measured review can fit into the same plan.

Can we use this policy without changing it? Adapt it before approval. Replace the roles and contacts, define your information categories and check the actual accounts and tasks staff use. Align it with your existing policies, agreements and applicable requirements. Test the wording with the people who will follow it. The National AI Centre's official template provides a further structure and examples for that work. Does buying a paid AI account make client data safe? A paid account may provide useful controls and terms, but it does not by itself establish that a particular task or information use is suitable. Check the product, account, configuration, supplier arrangements, purpose and authorised access. Consider the obligations that apply to your organisation. Record the approval and its limits rather than relying on a general product label. Should our policy ban every unapproved use? Make the approval boundary clear and give staff a practical route for suggesting a new use. A rule is easier to follow when people know what is already allowed and who can decide an uncertain case. Listen to existing informal uses before writing the register. You can then assess useful ideas while keeping decisions about information and authority explicit. How often should a small team review its AI policy? Set a review date that someone owns, and revisit relevant decisions when tasks, accounts, permissions or supplier arrangements change. Also review incidents and recurring questions from staff. A fixed calendar alone will not catch every change. Keep a short record of updates and explain the effect on everyday work so people can follow the current version.