An AI acceptable use policy is a short document that tells staff which AI tools they may use, what data they may put into them, who checks the output, and who to tell when something goes wrong. For an Australian business, the version that works is one page to three pages long, sorts tools into approved, limited and not approved, and is written after you have found out what your people already use. A policy that ignores real usage gets ignored in return.
This guide walks through what to put in the policy, how Australian guidance shapes it, and how to make it stick.
CalibreforumSee How Your Team Uses AICalibre Forum’s AI readiness assessment gathers employee insights and produces a scored report with a 90-day action plan for your business.Explore the AI assessmentTL;DR
- Sort every AI tool and use into three tiers: approved, approved with limits, not approved. Publish the list where staff will see it.
- Ban personal and sensitive information in public AI tools, and name the data types in plain words.
- Require a human to check AI output before it reaches a customer, a contract or a decision about a person.
- Name an owner, a reporting path and a review date. Review at least yearly, and quarterly if AI use is growing fast.
- Survey staff first. You cannot write rules for tools you do not know are in use.
Table of Contents
- What an AI acceptable use policy is, and why you need one
- Start with what your staff actually do
- The core sections of the policy
- A short example of the wording
- Roll it out so people follow it
- Get the evidence for your policy
- Sector notes
- FAQ
- Sources
What an AI acceptable use policy is, and why you need one
The National AI Centre describes an AI policy as an organization’s guiding resource for AI activity. It helps support safe, consistent and accountable use, sets staff expectations and helps align AI use with legal and industry obligations.
The practical reason is simpler. Staff are already using AI. Someone in accounts is pasting a supplier contract into a chatbot to summarize it. Someone in sales is drafting proposals with a free account on a personal email. Without a policy, each person decides alone what is safe, and the decisions are inconsistent.
You may see the same document called an AI usage policy, a company AI policy or an AI content policy. The names differ, but the job is the same: set the boundaries for staff using AI at work. Some businesses split it in two, one document for tool and data rules and another for AI-generated content such as marketing copy, client reports and website text. For a small or mid-sized business, one document with a content section is easier to maintain.
Start with what your staff actually do
Most policy templates start with a blank page. Start instead with a picture of current use. The National AI Centre advises creating a safe space for employees to disclose AI use, which is how you surface unapproved, or “shadow”, AI.
That only works if people are not afraid of being punished for answering. Three things help:
- Make the survey anonymous. People admit to using a personal chatbot account when they know it will not be traced back to them.
- Ask about tasks, not just tools. “What do you use AI for in a normal week?” gets better answers than “Which tools do you use?”
- Say what happens next. Tell staff the goal is a workable policy and better approved tools, not discipline.
The result tells you which uses to approve first. If half the team uses AI to draft emails, a policy that bans it will fail on day one. A policy that approves a specific tool for that purpose, with data limits, will be followed.
Our AI security assessment guide covers how to find shadow AI in more detail.
The core sections of the policy
Purpose, scope and who it covers
One short paragraph on why the policy exists, then who it applies to: employees, contractors, temps and anyone using company accounts or data. State that it covers AI features built into other software, not just chatbots. Many staff do not realize the assistant in their email or design tool counts.
Approved, limited and prohibited tools
This is the heart of the document. A simple three-label system is easy for staff to remember: approved, approved with limits, or not approved.
A tiered approach also ties tools to data. One widely shared approach is that fully vetted enterprise tools may handle internal and confidential data, while unvetted public tools are for public data only. You can adopt that logic directly.
| Tier | What it means | Typical data allowed | Example rule |
|---|---|---|---|
| Approved | Reviewed by the business, business-grade account, admin controls | Internal and confidential data, as the review allows | Use the company login only |
| Approved with limits | Reviewed for specific tasks only | Public or de-identified data | Drafting and summarizing, no client details |
| Not approved | Not reviewed, or reviewed and rejected | None | Do not use for work |
Before you place a tool in a tier, do the homework. The Office of the Australian Information Commissioner (OAIC) advises businesses to conduct due diligence on commercially available AI products, checking suitability for the intended use and weighing privacy and security risks. Keep a one-line record for each tool: who reviewed it, when, and for which uses.
Two rules are worth stating outright. First, no work on personal AI accounts. Business data should only pass through accounts the business controls. Second, AI agents need their own approval step if they can take actions such as reading files, browsing sites or creating records. A chatbot that only answers questions is a different risk from one that can open your shared drive.
New tools appear weekly, so include a request route: a named person and a short form, with a promised reply time. If asking is easy, staff ask. If it is slow, they go around you.
Data rules: what must never go in
Be concrete. “Do not share sensitive data” is too vague to act on. List the categories in the words your staff use:
- Customer, patient, student or client names, contact details and identifiers
- Health, financial, employment and other sensitive information
- Passwords, access keys and internal system details
- Unreleased financials, contracts, pricing and tender material
- Source code and proprietary methods
The Australian Cyber Security Centre’s guidance says staff should not enter sensitive or classified information into AI tools unless approved, and should be trained on what data, including personal information and intellectual property, can be input.
Privacy law adds weight. The OAIC recommends, as best practice, that organizations do not enter personal or sensitive information into publicly available generative AI tools because of significant privacy risks. It also states that when AI systems generate or infer personal information, that counts as a collection of personal information and must comply with the Australian Privacy Principles. So an AI tool that builds profiles or guesses details about individuals is a privacy question, not only a security one.
The National AI Centre adds that data governance should cover the management of intellectual property, privacy, confidentiality and contractual rights when using AI models. Check your client contracts: some already restrict what you can share with third-party processors.
For the mechanics of how data escapes and how to close the gaps, see our guides on AI data leakage and AI data governance.
Reviewing AI-generated content
This is the part that covers the “AI content policy” side. AI output can be wrong, biased or confidently invented. Your policy should say that the person who publishes or sends AI-assisted work owns it.
The OAIC advises testing AI products for inaccurate or biased answers, embedding human oversight in your processes and clearly identifying public-facing AI tools. Turn that into rules:
- Check facts, figures, quotes and citations against a primary source before use.
- Review anything customer-facing before it goes out, with a named reviewer for higher-risk material such as legal, financial or health content.
- Do not use AI alone for decisions about people, such as hiring, performance or access to services.
- Label public-facing AI, such as a website chatbot, so customers know they are talking to a machine.
- Check for copied or protected material in images, text and code before commercial use.
A coming change makes the decision-making point more pressing. The OAIC notes that from 10 December 2026, organizations covered by the Privacy Act must include information in their privacy policy where a computer program makes or informs decisions that significantly affect individuals’ rights or interests. If you use AI in screening, pricing or eligibility, list those uses now and ask your lawyer whether the obligation applies to you.
Security basics
Keep this section short and pointed at behavior: use single sign-on or company logins, turn on multi-factor authentication, limit who can connect AI tools to company systems, and never paste credentials. Our AI access control guide and AI security checklist give the detail, and AI security awareness covers what to teach staff.
Roles, reporting and consequences
The National AI Centre says policies should clearly outline how staff report issues or misuse of AI tools. Name one person who owns the policy, and give staff one email address or form for questions and incidents. In a small business that owner may be the managing director or the IT lead.
Involve more than one function in drafting. TechTarget stresses that legal, IT and compliance input helps balance the benefits of AI against its risks. In a ten-person firm, that can mean an hour with your accountant or lawyer, your IT provider and a couple of team leads.
State consequences in one sentence and keep them proportionate. An honest mistake that is reported quickly should not be punished like deliberate misuse, or people stop reporting.
A short example of the wording
Plain language beats legal language. Here are three sample clauses to adapt:
- “Use only AI tools on the approved list for work. If a tool is not listed, ask [owner name] before using it.”
- “Never enter client or staff personal information, passwords or confidential documents into a tool marked ‘limits’ or ‘not approved’.”
- “You are responsible for anything you send or publish, including AI-assisted work. Check it before it goes out.”
These are starting points, not legal advice. Have a lawyer review the final version, especially if you handle health, financial or children’s information.
Roll it out so people follow it
- Survey first. Learn current tools and tasks before you write a word.
- Draft in one to three pages. Long policies are not read.
- Approve something useful. Staff stop using personal accounts when a good approved option exists.
- Train for 30 minutes. Walk through real examples of what is allowed and what is not.
- Publish where staff look. Intranet, onboarding pack and team chat, not a forgotten folder.
- Measure again. Repeat the survey after a quarter to see whether behavior changed.
On timing, TechTarget advises reviewing the policy at least annually, and quarterly given the pace of change in AI. Put the date in the policy header and a recurring reminder in the owner’s calendar.
Our view: a policy is only as good as the picture behind it
We see the same pattern in Australian and New Zealand businesses. Leadership writes a careful policy, staff nod, and nothing changes, because nobody knew which tools were actually in use or what for. The policy describes the company management imagines, not the one that exists.
That is why we start with every staff member, not a sample and not the IT team alone. An anonymous survey gets honest answers about personal accounts, copy-and-paste habits and the workarounds that save people an hour a day. Our method does not install software or collect individual data, so there is little reason for anyone to hold back.
The result is a scored report that shows where you are strong, where the gaps are, and a 90-day action plan. A policy built on that is specific: these tools approved, these limited, these needs still unmet. We think that is a far better foundation than a downloaded template.
Anthony
Get the evidence for your policy
Our AI readiness assessment is built for this step. It runs an anonymous survey across your staff, then combines the answers into a scored report with a tailored 90-day action plan. The report is A$1,990 as a one-off, and you can see what is in the report and how it works from setup to report.
If you want to re-measure every quarter, the membership is A$2,388 per year and includes recurring surveys and reports. You can start from our pricing page, and read how we handle staff answers and privacy. Accountants, IT providers and brokers advising several clients can look at our page for firms.
Sector notes
The core policy is the same everywhere, but the risky data differs. A medical clinic worries about patient records, a training provider about student information, a recruiter about candidate data, and an aged care provider about client care notes. If your sector is one of these, our industry pages show how the assessment is framed, for example for medical clinics, recruitment agencies or aged care and NDIS providers.
FAQ
How long should an AI acceptable use policy be?
One to three pages is enough for most small and mid-sized businesses. Cover scope, the tool tiers, data rules, content review, reporting and review date. Put detail in an appendix, such as the approved tool list, so you can update it without rewriting the policy.
Do I need a separate AI content policy?
Usually not. A section on AI-generated content inside the main policy is easier to maintain. It should say who checks output, when AI use must be disclosed, and that staff remain responsible for what they publish. Create a separate document only if marketing or publishing is a large part of your work.
Should we ban public AI tools completely?
A blanket ban often pushes use onto personal devices where you cannot see it. A better approach is to allow public tools for public information only, keep personal and confidential data out, and provide an approved business-grade option for sensitive work.
How often should we update the policy?
Review it at least once a year, and quarterly if staff are adopting new tools quickly. Also review it after an incident, when you adopt a new AI product, or when privacy rules change, such as the December 2026 transparency requirement for automated decisions.
Who should own the policy?
Name one accountable person, usually a director, operations manager or IT lead, and involve legal or compliance advice and team leads in drafting. Staff should know exactly who to contact with questions or to report a problem.
Sources
- Create an AI policy, National AI Centre
- Manage unapproved AI use, National AI Centre
- Guidance for AI adoption: implementation guidance, National AI Centre
- Guidance on privacy and the use of commercially available AI products, OAIC
- New resources on transparency for use of AI and automated decision-making, OAIC
- Engaging with artificial intelligence, Australian Cyber Security Centre
- How to create an AI acceptable use policy, TechTarget
- Creating clear AI policies and guardrails, GitHub
- AI governance: How to govern employee AI and SaaS use, Flexera
Recommended
- AI Policy Enforcement: How Australian Businesses Make It Stick
- AI Adoption Playbook for Australian Businesses: A 90-Day Plan
- AI Access Control: A Practical Guide for Australian Businesses
- AI Security Awareness: What Your Staff Need to Know
General information only. Articles on this blog are written with the help of AI writing tools and published by Calibre Forum. They are not legal, insurance, tax or financial advice, so check anything important with a qualified adviser.