What to put in an AI use policy: a practical guide for Australian organisations

Why you need one now

Banning AI rarely works; people use it anyway, out of sight. A policy does the opposite: it tells staff which tools are approved, what they can use them for and where the lines are. It also gives you an answer when a board member, funder, insurer or customer asks how you manage AI risk, and it supports your obligations under the Privacy Act when personal information is involved.

The eight sections to include

1. Purpose and scope

Say who the policy applies to (staff, contractors, volunteers) and which tools it covers: chat assistants, AI features built into software you already use, and anything staff sign up for themselves.

2. Approved tools

Name the tools and plans the organisation has approved, and say that work must be done in those, signed in with a work account. State plainly that personal AI accounts are not to be used for work information.

3. Information that must never be entered

This is the section people will actually look up, so make it a list. Typically: client or patient records, health information, identity documents, payment card and bank details, passwords and security configurations, and anything covered by a confidentiality agreement, unless the tool has been specifically approved for that information.

4. Acceptable and unacceptable uses

Give examples from your own work. Drafting, summarising, analysing spreadsheets and preparing first versions are usually fine. Making decisions about individuals, giving professional advice without review and generating content that impersonates a real person are not.

5. Checking the output

AI can be confidently wrong. Require a person to review anything before it is sent, published or relied on, and make clear that the person who uses the output is responsible for it.

6. Transparency

Decide when staff should tell clients or the public that AI was involved, for example when an AI agent answers enquiries or when AI has substantially written a report.

7. Privacy and security controls

Record how the approved tools are configured: who administers them, how sign-in is protected, whether content is used for model training, where data is processed and what is connected. Staff do not need the technical detail, but the organisation needs it written down.

8. Accountability and review

Name the person or role that owns the policy, how staff request a new tool, how to report a mistake or suspected breach, and when the policy will be reviewed. Every six months is sensible while the technology is moving this quickly.

Keep it short

Two pages that people read are worth more than twenty they don't. Put the banned-information list and the approved tools on the first page, and move definitions and background to the end.

A policy needs controls behind it

A document on its own changes little. Back it with the settings that make the right thing the easy thing:

• business plans with central administration and single sign-on, so access ends when someone leaves;
• data protection rules in Microsoft 365 that stop sensitive information being pasted or uploaded where it should not go;
• administrator approval for connections between AI tools and your systems;
• short, role-based training so the policy is understood, not just signed.

Privacy obligations in brief

If AI tools handle personal information, the Australian Privacy Principles apply to how you collect, use and disclose it, just as they do anywhere else. The Office of the Australian Information Commissioner has published guidance on using commercially available AI products, which is worth reading alongside your own legal advice. This guide is general information, not legal advice.

Need a hand?

Our AI governance and security service writes the policy with you, sets up the approved tools and puts the controls in place. If you are not sure where AI fits yet, start with an AI readiness review.