AI Ethics Policy: A Practical Guide for Australian Businesses

An AI ethics policy is a short document that says how your business will and won’t use AI, who is accountable, and what staff must do. In Australia you build it on the government’s eight voluntary AI Ethics Principles. It only works if it matches what your people really do with AI tools, so the first job is to find that out before you write a word.

That is where most policies fail. They are written from a template, filed away, and never meet the browser extensions, personal chatbot accounts and meeting recorders already in use. This guide covers what Australian guidance expects, what to put in the policy, and how to make it stick.

TL;DR

• Australia has no general AI Act. The AI Ethics Principles and the national guidance are voluntary, but they are the benchmark a sensible policy follows.
• The eight principles cover wellbeing, human-centred values, fairness, privacy and security, reliability and safety, transparency, contestability and accountability.
• A good policy states permitted and prohibited uses, what data staff can enter, who approves higher-risk uses, how to report problems and when it is reviewed.
• Name an owner, keep the policy short, and link each rule to detail staff can use.
• Survey your staff anonymously first. A policy built on real usage gets followed; one built on assumptions does not.

Table of Contents

• What an AI ethics policy is, and why Australia has no single rulebook
• The eight AI Ethics Principles in plain terms
• What your policy should cover
• From principles to policy: five steps
• Managing the risks behind the policy
• Who should own it
• What has changed in Australian guidance
• Where Calibre Forum fits
• Our perspective
• FAQ
• Sources

What an AI ethics policy is, and why Australia has no single rulebook

An AI ethics policy turns broad values into rules a team can follow on a Tuesday afternoon. It answers practical questions. Can I paste a client email into a chatbot? Who signs off on using AI to screen job applications? What do I do if the tool gives a wrong answer that goes to a customer?

You will see several names for the same thing: AI ethics policy, responsible AI policy, AI use policy, AI guidelines. The National AI Centre uses the plain label “AI policy”, and says any organization using AI should have a clear policy explaining how AI can be used, who is responsible and what rules people follow. A policy that carries ethical commitments and operating rules in one document is normal and sensible for a small or mid-sized business.

There is no general AI Act in Australia. The material you build on is voluntary guidance, and it has moved in the past two years, which is covered below. Voluntary does not mean optional in practice: customers, insurers and partners increasingly ask how you manage AI, and a written policy is the first thing they expect to see.

The eight AI Ethics Principles in plain terms

The Department of Industry, Science and Resources published Australia’s AI Ethics Principles on 7 November 2019 to guide businesses and governments in designing, developing and using AI responsibly. They are voluntary. Here is what each means for a business that mostly buys and uses AI tools rather than building them.

The OECD’s catalogue describes the principles as aspirational and meant to complement existing regulation, not replace it. That is a useful way to read them: they set the direction, and your policy supplies the rules.

What your policy should cover

The National AI Centre gives a checklist to test a draft against. Before you finalize, check that it states:

1. What AI can and can’t be used for.
2. Who approves higher-risk use cases.
3. What data staff can put into tools.
4. When staff should oversee AI use.
5. How to report issues or misuse.
6. When the policy will be reviewed.

Those six items are the spine of a workable policy. Here is how to write each so it is usable rather than decorative.

Permitted and prohibited uses

List uses by task, not by tool. Tools change every month; tasks don’t. “Drafting internal documents and summarizing public information: permitted. Making or recommending decisions about hiring, pay, credit or discipline: prohibited without approval.” Team-specific examples help. A sales team using AI for outreach needs different guidance from a finance team; AI sales prospecting is a typical case where the policy should say what data may be used and who reviews the messages.

Data rules

This is the clause staff look for first. State which categories of information never go into an AI tool (client personal information, health records, passwords, unreleased financials), which can go into approved tools only, and which are fine anywhere. For the privacy side, our guide to what staff can paste into AI tools under the Privacy Act turns this into examples, and the AI data governance guide covers the wider handling of data.

Approvals for higher-risk uses

Decide in advance what counts as higher risk: anything affecting people’s employment, finances, health or access to services, anything using sensitive personal data, and anything customer-facing without human review. Name the person or group who approves these. A one-line approval route beats a long process nobody uses.

Human oversight and reporting

The Department of Industry’s guidance on human control says meaningful human oversight lets organizations intervene when needed and reduces unintended harm. In policy terms: a person checks AI output before it reaches a customer, a regulator or a decision, and staff know exactly who to tell when something goes wrong, without fear of blame.

Review date

Put a review interval in the document, such as every six or twelve months, and an owner for the review. AI use changes faster than most policies.

From principles to policy: five steps

The National AI Centre advises starting from its AI policy template and tailoring it: reflect your values, goals and legal obligations, match roles to your existing governance, use familiar terms, and test it with the people who will use, review or oversee it. Here is that advice as a working sequence.

1. Find out what AI is actually in use

Most owners underestimate it. Staff use personal accounts, browser extensions, note-taking bots and AI features inside software you already pay for. Without a map, your policy regulates an imagined workplace. An anonymous staff survey gets honest answers because nobody fears being singled out. Our guide to running an AI staff survey honestly and anonymously shows how, and shadow AI in the workplace explains the hidden categories to ask about. Where this goes wrong: asking in a way that sounds like an audit. People then say “none” and keep going.

2. Choose the principles that matter most to you

You do not need eight chapters. The CSIRO and National AI Centre report on putting the principles into practice says organizations must contextualize principles like fairness or transparency to each AI system and balance them against its business purpose. A clinic leans on privacy and safety; a recruiter on fairness and contestability. Pick the principles your survey shows are most exposed.

3. Draft short and role-based

Telstra’s experience is a good model even for a business a fraction of its size. A University of Technology Sydney case study describes how Telstra rewrote its AI policy to be role-based, with distinct expectations for users, owners and providers of AI systems, and kept it to around two pages with each obligation linking to more detailed material. For you that means one page of rules for everyone, plus short notes for managers and whoever owns the tools. A starting outline is in our AI policy for small business guide, and the AI policy in Australia and generative AI policy articles go deeper on clauses and rollout.

4. Test it with the people who will use it

Give the draft to three or four staff from different teams and ask them to apply it to a real task. If they can’t tell whether a task is allowed, the clause is too vague. The same UTS case study notes Telstra redrafted its triage templates into plain English yes/no questions because non-technical staff increasingly complete them. Plain wording is not a courtesy; it decides whether the policy is used.

5. Communicate, train and review

A policy staff have not read changes nothing. The National AI Centre’s implementation guidance calls for evaluating training needs and providing up-to-date training to build understanding and accountability. Explain the reasons as well as the rules, and address worries directly, including concerns about AI and jobs, because staff who feel threatened tend to hide their usage. Our AI security awareness guide covers what staff need to know day to day.

Managing the risks behind the policy

A policy states intent. Risk management is how you find out whether it is holding. The National AI Centre’s guidance calls for a documented risk management framework covering AI-specific risks, your risk tolerance, criteria for acceptable and unacceptable risk, impact and risk assessment, and criteria for reassessing over an AI system’s life.

For a small or mid-sized business, a light version works:

• Define your tolerance. Allens’ AI impact assessment guide suggests defining risk tolerance and sorting uses into low, medium, high and unacceptable, aligned with your internal risk matrix and the principles in your policy.
• Match checks to the category. Low risk: staff judgment. High risk: a written assessment and named approver.
• Limit personal information. Government guidance asks whether collecting, using and disclosing personal information is necessary, reasonable and proportionate for each use, and notes that de-identification and encryption can reduce privacy risk.
• Pilot small. The same guidance recommends evaluating AI systems in small-scale pilots to find and fix problems before wider use.
• Reassess. Write down when a use gets looked at again, for example after a tool update, a new data type or an incident.

For more on this, see our guides to AI risk mitigation, AI access control and the AI security checklist.

Who should own it

Ethics policies stall when everyone is responsible, which means no one is. The Department of Industry’s first guardrail asks for an overall owner for AI use, an AI strategy and any training the organization needs, with risk assessments done on an ongoing basis. In a small business the owner might be the managing director, the operations manager or the IT lead. What matters is that the name is in the document.

Spread the rest by role. Managers answer for their team’s use. IT oversees tools and access. Everyone reports problems. Government guidance adds a point that applies to any business: avoid overreliance on AI outputs, and remember that you stay responsible for what the AI produces. For the structure around all this, our generative AI governance guide is the next read.

What has changed in Australian guidance

The Voluntary AI Safety Standard arrived in September 2024 with ten guardrails covering accountability, risk management, data governance, testing, human oversight, transparency, contestability, supply-chain transparency and record-keeping. It is voluntary and creates no new legal duties.

In late October 2025 the Guidance for AI Adoption followed, condensing the guardrails into six essential practices. According to White & Case, it supersedes the earlier standard and is non-binding; organizations can keep relying on policies developed with the earlier standard in mind and review them against the new guidance later. The same analysis notes the new guidance is more prescriptive and puts more weight on the whole lifecycle of an AI system, with the eight AI Ethics Principles still underpinning it.

The practical reading: you don’t need to start over. Build around the eight principles, use the National AI Centre template and guidance as your structure, and check the official pages for the current position when you review. Existing laws, privacy law in particular, still apply to how you handle personal information in AI tools; if a use touches sensitive personal data or employment decisions, take advice from your lawyer.

Where Calibre Forum fits

The hardest part of a policy is step one: knowing what is really happening. Our AI readiness assessment is a structured, anonymous survey of your staff on the AI tools they use, their workflows and how technology is integrated. It combines the answers into one scored report that maps your current capabilities and risks, and sets out a tailored 90-day action plan with concrete operational and security recommendations. Nothing is installed, and no individual’s data is collected.

The single report costs A$1,990 one-off. If you want quarterly surveys and reports to track progress against your policy, the membership is A$2,388 per year. You can see what is in the report and how it works from setup to report before you decide.

Our perspective

Most AI policies we read start with values and end with rules, and skip the part in the middle: what your people actually do. A business that has never asked its staff cannot know whether its data rule is already being broken, or whether the tool it is about to ban is the one holding a team together.

That is why we built the assessment around every staff member answering anonymously. People tell the truth when they are not worried about being named. The result is an organization-wide picture of tools and workflows that management can see, not guess at.

From that picture, a policy nearly writes itself. The scored report shows where you are strong and where the exposure sits, and the 90-day plan gives you the order of work: which rules to write first, which tools to bring into the open, what staff need to hear. Then a quarterly repeat shows whether the policy is changing behavior.

An ethics policy is a commitment to your staff, your customers and yourself. Make it on facts.

Anthony

FAQ

Is an AI ethics policy legally required in Australia?

There is no general AI Act, and the AI Ethics Principles and national guidance are voluntary. Existing laws, such as privacy law, still apply to how you use AI. A written policy is the practical way to show you take both seriously, and your lawyer can confirm obligations specific to your industry.

How long should an AI ethics policy be?

Short enough that staff read it. Telstra’s role-based policy is around two pages, with each obligation linking to more detailed guidance. A single page of rules for all staff plus brief notes for managers and tool owners suits most small and mid-sized businesses.

Is an AI ethics policy different from a responsible AI policy?

In practice they are the same document under different names. Both set out principles, permitted uses, data rules, accountability, oversight and review. Use whichever label your staff and customers will recognize, and base the content on the eight AI Ethics Principles.

How often should we update it?

Set a fixed review date in the policy, commonly every six to twelve months, and review sooner after an incident or a major new tool. The National AI Centre’s checklist asks that the policy state when it will be reviewed.

Sources

• Australia’s AI Ethics Principles, Department of Industry, Science and Resources
• Create an AI policy, National AI Centre
• Guidance for AI adoption: implementation guidance, National AI Centre
• Implementing Australia’s AI Ethics Principles, CSIRO and National AI Centre
• Implementing Australia’s AI Ethics Principles in government, Department of Finance
• The 10 guardrails, Department of Industry, Science and Resources
• Lighthouse Case Study: Telstra, UTS Human Technology Institute
• AI impact assessment guide, Allens
• Australia launches new AI guidance, White & Case
• Will AI take my job?
• AI sales prospecting

Recommended

• AI Policy in Australia: What to Include and How to Enforce It
• AI Policy Enforcement: How Australian Businesses Make It Stick
• AI Policy for Small Business Australia: Outline and Clauses
• AI Data Governance: A Practical Guide for Australian Businesses

General information only. Articles on this blog are written with the help of AI writing tools and published by Calibre Forum. They are not legal, insurance, tax or financial advice, so check anything important with a qualified adviser.