Australia has no standalone AI Act for private businesses. Your AI policy is how you apply existing law (privacy, work health and safety, consumer law, workplace relations and directors’ duties) to the tools your staff already use. A good one is short, names the approved tools, says what data can go in, sets human review points, and explains what happens when someone steps outside it. A policy that sits in a drawer does nothing, so the second half of this guide covers enforcement and review.
CalibreforumBuild an AI Policy on Real UsageCalibre Forum’s AI readiness assessment surveys employee tool use and produces a scored report with a clear 90-day action plan.Explore the AI assessmentTL;DR
- An Australian AI policy should define permitted and prohibited uses, data rules, approval points for higher-risk uses, human oversight, incident reporting and a review date, as the National AI Centre sets out.
- Existing laws already apply: the Privacy Act, WHS duties, the Fair Work Act, Australian Consumer Law and directors’ duties.
- Enforcement works best when staff can safely admit what they already use. Punishing disclosure pushes AI use out of sight.
- Check compliance on a schedule, and again whenever tools, data or risks change.
- Start from what your people actually do with AI today, not from what you assume they do.
Table of Contents
- What an AI policy has to do in an Australian business
- The laws and guidance behind your policy
- What to put in the policy
- Enforcing the policy
- Checking compliance and improving the policy
- Training and consultation
- Our perspective
- Start from what your staff actually do
- FAQ
- Sources
What an AI policy has to do in an Australian business
A policy has two jobs. It tells staff what is allowed, and it gives management a basis for acting when something goes wrong. If it does only the first, it becomes a list of good intentions. If it does only the second, staff stop reading it.
The National AI Centre’s guidance on creating an AI policy says the document should cover core principles for responsible use, expected behaviors, roles and responsibilities, governance and approval points, and monitoring and review. It also needs clear definitions of permitted and prohibited uses, data handling rules and human oversight requirements (National AI Centre).
For a small or mid-sized business, that translates into a policy of two to four pages. Anything longer tends not to be read by the people it governs.
The laws and guidance behind your policy
No single statute is “the AI law” for private employers. The National AI Centre’s overview says workplace AI use may engage several existing obligations: Fair Work Act consultation duties, WHS duties for physical and psychosocial risks, Privacy Act and Australian Privacy Principle obligations, and Australian Consumer Law rules on misleading representations and consumer guarantees. It adds that directors’ duties of due care and diligence extend to governing organizational risks, including non-financial risks from AI and data (AI and Australian law).
Three of these shape the policy text most directly.
Privacy
The Office of the Australian Information Commissioner (OAIC) advises businesses to avoid entering sensitive information into publicly available generative AI tools because of the significant and complex privacy risks (OAIC guidance). That belongs in your policy as a plain rule.
There is also a coming change. On 10 December 2026, organizations covered by the Australian Privacy Principles must add information to their privacy policy where they have arranged for a computer program to make or inform decisions that significantly affect individuals’ rights or interests (OAIC). If you use AI in hiring, credit, tenancy or client triage, check whether this applies to you.
Work health and safety
Persons conducting a business or undertaking (PCBUs) must identify reasonably foreseeable hazards, including those from AI and digital technologies, and manage them with the same risk process used for other hazards (Safe Work Australia). Think of workload pressure from AI-driven targets, monitoring that staff find intrusive, or errors in AI-assisted safety decisions.
Workplace consultation
The Fair Work Act includes a requirement to consult employees in certain circumstances, which can include introducing AI in the workplace (National AI Centre). Check your award or enterprise agreement for its consultation clause before you roll out a policy or new tools. Seek legal advice from an employment lawyer if you are unsure whether a clause is triggered.
What to put in the policy
Use these headings as a working structure. Each one answers a question staff will otherwise settle for themselves.
| Section | What it should say | Question it answers |
|---|---|---|
| Purpose and scope | Who and what the policy covers, including contractors | “Does this apply to me?” |
| Approved tools | A named list, and how a new tool gets added | “Which tools can I use?” |
| Permitted and prohibited uses | Concrete examples for your business | “Can I use AI for this task?” |
| Data rules | What data may and may not enter a tool | “Can I paste this in?” |
| Human oversight | When a person must review AI output before it is used | “Do I need to check this?” |
| Approval for higher-risk uses | Who signs off, on what basis | “Who decides?” |
| Reporting | How to flag issues or misuse | “What if something goes wrong?” |
| Consequences | What follows from breaches | “What happens if I ignore it?” |
| Review | Owner and date | “Is this kept current?” |
The National AI Centre’s pre-finalization checklist covers the same ground: what AI can and can’t be used for, who approves higher-risk use cases, what data staff can put into tools, when staff need to oversee AI use, how to report issues or misuse, and when the policy will be reviewed (National AI Centre).
Approved tools and access
Name the tools. “Approved AI tools” with no list invites guesswork. For each one, record who may use it and for what. The Australian Cyber Security Centre recommends granting AI access on a need-to-know basis and the principle of least privilege (ACSC). In practice that means fewer broad accounts and tighter permissions on anything connected to company systems. Our guide to AI access control walks through how to set this up.
Data rules
This is the section that prevents the most harm. Write it as a short list of data categories with a yes or no beside each: customer personal information, health or financial records, staff records, client contracts, source code, publicly available material. National AI Centre guidance also expects data governance covering usage rights for AI data, including intellectual property, Indigenous Data Sovereignty, privacy and confidentiality (Guidance for AI adoption). See our guides on AI data governance and AI data leakage for worked examples.
Human review
Define review by the consequence of an error, not by tool. Internal brainstorming needs little. Anything sent to a customer, used in a hiring decision, or relied on for a safety or financial judgment needs a named person to check it. Businesses should also make clear when customers are dealing with an AI tool such as a chatbot (OAIC).
Leadership ownership
Someone senior must own the policy, and that person needs the authority to say no to a tool. Because directors’ duties reach AI risk, this is not a task to leave to whoever is most enthusiastic about the technology. Leaders also need a clear view of where AI should support judgment rather than replace it, a theme explored in this piece on AI informing decisions, not making them.
Enforcing the policy
Enforcement is the part most policies skip, and it is what readers searching for “AI policy enforcement” are really after. Official guidance is direct about it: organizations should communicate consequences for acting outside their policies and risk appetite, document how non-compliance is identified and corrected, and monitor compliance. Audits should happen when the risk assessment calls for them (Guidance for AI adoption).
Here is a workable sequence.
- State consequences in the policy itself. Tie them to your existing disciplinary process, so there is nothing new to invent mid-incident.
- Define what counts as a breach. Pasting client data into an unapproved tool is a breach. Trying a new approved-category tool for a harmless task is probably a conversation.
- Write down how you will find breaches. That might be manager spot checks, a review of tool subscriptions on expense reports, or a staff survey.
- Decide the response for each level. A first low-risk lapse might mean coaching. A repeat or a data exposure triggers formal steps, and possibly your privacy incident process.
- Record what happened and what changed. Corrective action should show up in the policy or in training.
Our separate guide on AI policy enforcement goes deeper on making these steps stick.
Make disclosure safe
Staff will use AI whether or not you approve it. The National AI Centre’s advice on unapproved use is to make it safe for people to disclose their AI use without fear of negative impacts (Manage unapproved AI use).
This changes how you introduce the policy. Open with an amnesty: for a set period, anyone who tells you what they use is thanked, not disciplined. You then learn which tools are in use, which tasks they serve, and which approved tools are missing from your list. A heavy-handed rollout does the opposite and teaches people to hide.
Checking compliance and improving the policy
Compliance checking is not a once-a-year ritual. Guidance from the National AI Centre points to monitoring AI system performance, monitoring compliance with organizational policies, and reassessing risks across the system lifecycle, including when a significant change occurs or a new risk is identified. It also expects continual improvement of risk management processes (Guidance for AI adoption).
That guidance also expects you to document your organization’s risk tolerance, with criteria for what counts as acceptable or unacceptable AI risk. Write that down in a paragraph. It gives managers something to point to when a staff member asks whether a new use is fine.
From a WHS angle, control measures must be reviewed regularly. Review is also required before a change that may create new or different risks (a software update is the example given), when a new hazard or risk is identified, or when consultation shows a review is needed (Safe Work Australia).
A simple review rhythm:
- Quarterly: compare the approved tool list against what is actually in use. Look at incidents and near-misses.
- On change: when a vendor updates terms, adds AI features to an existing product, or you connect a tool to new data, reassess before staff start using it.
- Annually: read the whole policy against current law and guidance, including the privacy transparency change due on 10 December 2026.
For wider controls, our AI security checklist and guide to AI risk mitigation give you a place to start.
Training and consultation
Safe Work Australia says PCBUs should consult workers and their representatives about risks and control measures, and support workplace digital technology policies with training and supervision. It also notes that workers often have a good idea of what would control the risks for them (Safe Work Australia).
Practically:
- Draft the policy with a few people from different roles, not only IT and management.
- Run a short session using real examples from your own business, such as a quote, a client email or a job ad.
- Give managers a one-page script for responding when someone discloses a risky use.
- Repeat the training when the policy changes. Our guide to AI security awareness suggests what staff should know.
Our perspective
Most AI policies we see are written from the top down, on assumptions. A manager guesses which tools staff use, writes rules around the guess, and then discovers months later that the real picture looks different.
We built Calibre Forum around the opposite order. Start by asking every staff member, anonymously, how they use AI in their work. When answers are anonymous, people tell you the truth, and that truth is the only sound foundation for a policy you can enforce.
Our assessment does not install software or collect individual data, and it makes no compliance or legal claims. What it gives you is an organization-wide map of tool usage and workflows, a scored report, and a 90-day action plan. That is the evidence a policy needs: what is in use, where the gaps are, and what to fix first.
A policy is a living document. We think the businesses that do best treat it as something measured against reality each quarter.
Anthony
Start from what your staff actually do
If you are drafting or reworking a policy, a Calibre Forum readiness report gives you the staff-level picture first. We survey your staff anonymously, combine the responses into a scored report, and set out a 90-day plan with concrete operational and security recommendations. The report is A$1,990 one-off on our pricing page. If you want quarterly repeat assessments to track whether your policy is working, membership is A$2,388 per year.
You can see how it runs from setup to report in how Calibre Forum works, or see what is in the readiness report before you decide.
FAQ
Does Australia have an AI law my business must follow?
There is no standalone AI Act for private businesses. Existing laws apply, including the Privacy Act, WHS legislation, the Fair Work Act and Australian Consumer Law (National AI Centre). Your policy should show how you meet those duties when staff use AI. For a specific situation, speak with a lawyer.
How long should an AI policy be?
Long enough to cover permitted and prohibited uses, data rules, approvals, oversight, reporting and review, and short enough that staff read it. For most small and mid-sized businesses that is a few pages. Put detail such as the approved tool list in an appendix you can update without rewriting the policy.
How often should we review our AI policy?
Set a regular review date in the policy, and reassess earlier when a significant change occurs or a new risk is identified (Guidance for AI adoption). A quarterly check of tools and incidents plus an annual full read is a sensible pattern.
What should we do when we find someone breaking the policy?
First establish what data or decision was involved, then apply the consequences your policy already states. Treat a personal information exposure as a privacy matter and follow your incident process. Afterward, ask why the rule was missed and whether an approved tool or clearer wording would have prevented it.
Sources
- Create an AI policy, National AI Centre
- AI and Australian law, National AI Centre
- Guidance for AI adoption: implementation guidance, National AI Centre
- Manage unapproved AI use, National AI Centre
- Artificial intelligence and digital technologies: managing risks, Safe Work Australia
- Guidance on privacy and the use of commercially available AI products, OAIC
- New resources on transparency for use of AI and automated decision-making, OAIC
- Engaging with artificial intelligence, Australian Cyber Security Centre
- AI informing decisions, not making them
Recommended
- AI Policy Enforcement: How Australian Businesses Make It Stick
- AI Data Governance: A Practical Guide for Australian Businesses
- AI Access Control: A Practical Guide for Australian Businesses
- AI Data Leakage: How It Happens and How to Stop It
General information only. Articles on this blog are written with the help of AI writing tools and published by Calibre Forum. They are not legal, insurance, tax or financial advice, so check anything important with a qualified adviser.