An AI policy is a short document that tells staff which AI tools they can use for work, what must never go into them and when a person has to check the output. Below is a free AI policy template for Australian businesses that you can copy into Word or Google Docs. It's based on the National AI Centre's guidance and the Privacy Act's new transparency rule for automated decisions, which starts on 10 December 2026.

The short version: approve a few AI tools on business accounts you control. List what never goes in, starting with health details, tax file numbers and bank details. Treat every AI output as a draft that a person checks. Name an owner and a review date. If the Privacy Act covers you and AI makes or informs decisions that significantly affect people's rights or interests, your privacy policy must say so from 10 December 2026.

Why does your business need an AI policy now?

Because your staff are probably using AI already. KPMG and the University of Melbourne's 2025 study of trust in AI found 49% of Australian employees intentionally use AI at work on a regular basis. Only 30% said their organisation has a policy on generative AI use, and almost half of employees who use AI admitted using it in ways that go against company policies.

The study's global report adds a warning about bans. Uploading sensitive company information to public AI tools was most common where the organisation had banned generative AI. The researchers said outright bans may be ineffective, and that a policy alone doesn't guarantee people follow it, so clear guidance and training are needed too.

Small businesses are moving too. The National AI Centre's SME tracker put AI adoption among Australian small and medium businesses at 44% in February 2026, in a quarterly update first published in May 2026. About half the businesses using AI check its output before it affects customers, but telling customers about AI use lags well behind.

What changes in the Privacy Act on 10 December 2026?

First, check whether the Privacy Act covers you. The OAIC's small business page says most small businesses aren't covered because of a turnover threshold, but some are covered whatever their turnover, including health service providers. The OAIC's examples of those include allied health professionals, disability service providers that handle health information, and gyms that collect health information.

If you're covered, the OAIC published new resources on 30 September 2026 about a change that starts on 10 December 2026. From then, your privacy policy must include information where you've arranged for a computer program to make or inform decisions that significantly affect people's rights or interests. The OAIC's September 2026 fact sheet (PDF) says:

  • a computer program includes generative AI, including chatbots
  • a decision may be in scope "even where a computer program output does not replace the entire decision-making process or is subject to human review"
  • if you're in doubt, "take a cautious approach" and include the information

Its examples of decisions generally in scope include recruitment software that sorts candidates, approving or rejecting credit applications, and AI reports used to rank staff performance. Drafting a newsletter isn't on the list. Shortlisting job applicants with AI sits close to the recruitment example. Our automated decision-making privacy policy checklist helps you list the systems involved.

What does the National AI Centre recommend?

The National AI Centre's Guidance for AI Adoption, published in October 2025, is the Australian Government's guidance for responsible AI use. It sets out six essential practices: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. For a small business, the short Foundations version is the one to read. Its first step is to name a senior owner for AI use and create an AI policy.

The Centre also publishes a free AI policy guide and template as a Word document, dated 22 April 2026. It's thorough, with roles for a compliance monitor and an AI governance committee, so it suits organisations with a board or committee. Start there if that's you. The template below is shorter. It covers the six things the Centre's page says to check before you publish, from what data staff can put into tools to when the policy gets reviewed.

One catch: the government template's scope leaves out rule-based automations like if-then macros, while the OAIC's fact sheet counts pre-programmed rule-based processes as computer programs. A rule in your booking or billing system can still fall under the privacy policy rule if it makes decisions that significantly affect people.

What should an AI policy include?

SectionWhat it coversWhy it's there
1. PurposeWho it covers and who owns itThe first essential practice is deciding who is accountable
2. Approved toolsWhich tools and accounts staff can useKeeps client work out of personal accounts
3. What never goes inInformation that must never be enteredOAIC best practice for public AI tools
4. Human checksAI output is a draftThe OAIC recommends human oversight of AI outputs
5. CustomersChat assistants and AI repliesThe OAIC says public-facing AI tools should be clearly identified
6. Automated decisionsWhat AI must not decide aloneThe Privacy Act rule from 10 December 2026
7. RecordsThe AI registerShows where AI is used and who owns it
8. TrainingWho gets taken through itA policy alone doesn't guarantee people follow it
9. ReportingWhat to report, and to whomProblems get fixed while they're small
10. ReviewWhen the policy is reviewedTools and rules change

The template

Copy sections 1 to 10 into Word or Google Docs, title it "[Business name] AI use policy" and replace everything in square brackets.

1. Purpose and who this covers

This policy covers how everyone who works at [Business name], including contractors, uses AI tools on any device. That means chat assistants such as ChatGPT, Claude, Copilot and Gemini, AI features in our software, and any automation that uses AI.

We use AI to take admin off people's plates, and a person stays responsible for everything that goes out under our name. Our AI policy owner is [name, role]. Ask them if you're unsure about anything here.

2. Approved tools and what they're for

Only use these AI tools for work, through your work account:

  • [Tool and plan]: [what it's for, for example drafting, summarising and research]
  • [Tool and plan]: [what it's for]
  • AI features in [our accounting, CRM or job software]: [what they're for]

Never use a free or personal AI account for client or staff information. Ask [policy owner] before you try a new AI tool or switch on a new AI feature, so they can check where our data goes, whether it's used for training and who can see it.

3. What never goes into an AI tool

Never put these into an AI tool:

  • tax file numbers, Medicare numbers, and driver licence, passport or other ID numbers
  • passwords and login codes

Don't put any of these into an AI tool unless [policy owner] has approved that exact use in writing:

  • health, disability or NDIS information about anyone
  • bank, card or payment details
  • staff records such as pay, performance or leave
  • anything a client has asked us to keep confidential

For other client or staff details, use initials or a client code in place of names and addresses.

4. What a person must check

Everything AI produces is a draft, and you're responsible for anything you send or act on. Check names, numbers, dates and facts against the source. A second person checks AI-assisted work before it goes out when it's [advice to a client, figures a client will rely on, or anything for a regulator].

5. Using AI with customers

If customers deal with AI directly, such as a chat assistant on our website:

  • tell them it's AI, and give them an easy way to reach a person
  • keep it to uses [policy owner] has approved, such as common questions or bookings
  • don't let it give advice, quotes or promises without a person checking first

Don't publish AI-written content under someone's name unless they've read and approved it.

6. Automated decisions and our privacy policy

AI and automated rules must never be the only thing deciding something that could significantly affect a person, such as [hiring, pay, credit terms, refunds or who gets our services].

If AI or a rule helps with a decision like this, even with a person reviewing it, tell [policy owner] first. They'll add it to our AI register, check whether our privacy policy needs to describe it [if the Privacy Act covers us, from 10 December 2026], and make sure the person affected can ask for a person to review it.

7. Records

[Policy owner] keeps an AI register at [location] listing every AI tool and feature we use, what it's for, what information goes in and who is responsible. When AI helps with [client advice or a decision in section 6], note it on the client or job record.

8. Training

[Policy owner] will take you through this policy and our approved tools before you use AI for work, and new starters get this at induction. If you're not sure how to use a tool well, ask.

9. Reporting problems

Tell [policy owner] straight away if information went into an AI tool that shouldn't have, if AI output with a mistake reached anyone outside the business, or if a tool did something unexpected. You won't get in trouble for reporting a mistake quickly. If personal information may have been exposed, [policy owner] will follow [our data breach response plan].

10. Review

We review this policy every [6 or 12] months, and sooner if we add an AI tool, the law changes or something goes wrong. Version [1.0]. Approved by [name, role] on [date]. Next review [date].

Worked example: a 25-person accounting practice

Say a 25-person accounting practice in Toowoomba, running on Xero, Microsoft 365 and a practice management system. The Privacy Act covers them, and nothing about AI is written down.

  1. The practice manager becomes the policy owner and asks the team what they use. Nine people use free ChatGPT accounts to tidy up client emails, and two bookkeepers have been pasting bank transactions into a free tool.
  2. The partners pick one business AI account for everyone and stop client work in personal accounts.
  3. Tax file numbers and ID documents stay out completely. They approve one exception in writing: bank transactions can go into the business account, with a client code instead of a name.
  4. A second accountant checks any AI-assisted advice or figures, using the review step they already have.
  5. Section 6 catches one use: a partner testing an AI tool to rank graduate applicants. Recruitment software that sorts candidates is one of the OAIC's examples, so they pause it and ask their lawyer whether their privacy policy needs a new line before 10 December 2026.
  6. Every tool goes into the National AI Centre's AI register template, and the team goes through the policy at a staff meeting.

None of this needed new software. The biggest change was moving everyone onto one business account the practice controls.

How to roll it out in a week of normal work

This doesn't need to be a project. Spread these steps across a normal week:

  1. Ask the team what they use, and make it clear nobody is in trouble. Include AI features inside software you already pay for.
  2. Pick your approved tools. Choose business accounts you control, and check each vendor's privacy pages for whether what you type is used for training. Setting up Claude? Our Claude for Small Business setup guide covers permissions.
  3. Fill in the template and delete what doesn't apply.
  4. Take the team through it, and do one real task together using a client code.
  5. Get everyone to sign it, add it to your induction pack and put the review date in the calendar.

To keep it alive, ask "does this use AI?" before you buy or switch on any software, check the AI register at each review, and review early if something goes wrong or the law changes.

Not sure where AI fits yet? Our free AI readiness assessment asks seven questions and suggests what to automate first, and our guide on how to use AI in a small business in Australia has practical ideas. If you'd like a hand with tools and settings, book a free call.

When it's worth getting help

If you're a ten-person office using one AI tool for drafting, you probably don't need anyone. Fill in the template and take the team through it.

Get help if you handle health, NDIS, financial or legal information, if AI is connected to your email, files, CRM or accounting software, or if an automation informs decisions about people. Then the rules need to live in the tools as well as on paper.

When we set up Claude assistants for an NDIS provider, they used participant codes and never names, every AI output was a draft for a person to check, and every automation had an off-switch. Our post on whether ChatGPT is safe for NDIS participant data covers the data side. My own business runs on a setup I built on Claude Code. It drafts everything, and nothing goes out until I approve it.

Our AI Operating System service builds that kind of setup in your own accounts, with your policy built in. Before you give AI your documents and email, our guide to a second brain for business covers who should see what.

This page is general information, not legal advice. For the Privacy Act, start with the OAIC's guidance on using AI products and talk to a privacy lawyer.

Want your AI tools set up to match your policy? Tell us which tools your team uses and what information they handle. We'll show you what we'd set up first, and what we'd keep switched off. Book a free call.

Sources

Facts checked 24 October 2026.