Generative AI Policy: What to Include and How to Roll It Out

A generative AI policy is a short internal document that tells your staff which AI tools they may use, for what work, with which data, and who checks the output. For an Australian business, the National AI Centre calls an AI policy an essential guiding resource for safe, consistent and accountable use. This guide shows what to put in it, how to decide on tools, which Australian privacy duties apply, and how to keep the policy alive after you publish it.

Calibreforumcalibreforum.auSee How Your Team Uses AICalibre Forum’s tailored assessment gathers employee insights and maps current AI use into a scored report with a 90-day action plan.Visit

TL;DR

A generative AI policy sets permitted and prohibited uses, approved tools, what data staff can enter, when a human must review output, how to report problems, and when the policy gets reviewed.
Privacy law applies to what staff type into AI tools and to what the tools produce. The OAIC recommends not entering personal information, especially sensitive information, into public generative AI tools.
Approve tools for specific uses, not blanket access. The same tool can be low risk for one task and high risk for another.
Name an owner, train people, keep an inventory of tools in use, and review the policy on a set schedule.
A policy only works if it matches what staff actually do. Find out real usage first, then write the rules.

What a generative AI policy is, and why you need one
What to cover in your generative AI policy
Privacy and legal duties when staff use generative AI
Deciding which tools and uses to approve, restrict or prohibit
Human review and accuracy
Who owns it: roles for managers, IT and staff
Perspective
Training, monitoring and review
Steps to create your policy
See what your team is actually doing with AI
FAQ
Sources

What a generative AI policy is, and why you need one

It is an internal workplace policy. Sprintlaw describes it as the document that tells workers how AI tools may be used and where the limits are. The same article makes a point worth remembering: most of the legal risk comes from ordinary day-to-day behavior, not from a dramatic technology failure.

Think of a recruiter drafting job ads with a chatbot, a customer service officer pasting a complaint into a free tool, or a marketing manager asking an image generator to riff on a competitor’s campaign. None of these people think they are doing anything risky. A policy gives them a line they can see.

Service worker entering a complaint into AI

The National AI Centre lists what a policy does for you: it sets staff expectations, supports consistent decisions, shows governance and accountability, makes reviews and audits easier, and aligns AI use with legal and industry obligations.

A policy also protects the staff member. When the rules are written down, nobody has to guess whether pasting a client spreadsheet into a free tool is fine.

What to cover in your generative AI policy

The National AI Centre says a policy should include responsible-use principles, expected behaviors and internal rules, roles and responsibilities, governance and approval points, and monitoring and review guidance. Its pre-publication check asks whether the document states:

What AI can and can’t be used for.
Who approves higher-risk use cases.
What data staff can put into tools.
When staff need to oversee AI use.
How staff report issues or misuse.
When the policy will be reviewed.

business.gov.au gives a similar list for Australian businesses: what you do and don’t use AI for, who is accountable, how you identify and manage the risks of each new tool, how you protect personal data and follow privacy laws, when you tell customers you’re using AI, and what training staff need.

Sprintlaw adds practical items: define which tools are approved, restricted or banned; explain when human review is mandatory before content is used or sent; cover ownership of AI-assisted work and third-party training data; tie the policy to employment contracts, disciplinary procedures and IT security controls; and deal with bias, inaccurate outputs, misleading claims and record-keeping.

For a deeper look at governance structures at the model level, this AI model governance guide covers principles, responsibilities and approval points in more depth than a staff policy needs.

A workable structure

Keep it to a few pages. A layout that works for most small and mid-sized teams:

Section	What it answers
Purpose and scope	Who the policy covers, including contractors, and which tools (chatbots, image generators, meeting assistants, AI features inside existing software)
Principles	Short statements on responsible, accountable use
Approved, restricted and prohibited tools	A list that is easy to update without rewriting the policy
Permitted and prohibited uses	By task, not just by tool
Data rules	What may and may not be entered, by data type
Human review	Which outputs must be checked before they go anywhere
Roles	Who owns the policy, who approves exceptions
Reporting	How to flag a mistake or misuse without fear of blame
Review	How often, and what triggers an earlier review

If you want a more detailed look at the rules side, see our guide to the AI acceptable use policy and our broader piece on AI policy in Australia.

Privacy and legal duties when staff use generative AI

This is the part most policies get thin. The OAIC’s guidance on commercially available AI products says privacy obligations apply to personal information entered into AI and to output that contains personal information. Three points matter for your policy:

Generated or inferred personal information counts as collection. If an AI system generates or infers personal information, including images, that is a collection that must comply with APP 3. The OAIC also says incorrect or artificially generated information, such as hallucinations and deepfakes, is personal information when it is about an identifiable individual.
Use and disclosure are limited. APP 6 restricts use or disclosure to the primary purpose unless consent or an expected, related secondary use applies.
Public tools are the high-risk spot. The OAIC recommends that organizations not enter personal information, especially sensitive information, into publicly available generative AI tools.

HWLE Lawyers points to the wider set of exposures from unregulated use: loss of control of commercially sensitive or client information, potential Privacy Act 1988 (Cth) breaches under APP 3, 6, 8 (overseas disclosure) and 11 (security), reliance on inaccurate outputs, reputational harm and shadow IT. They also note that many organizations use generative AI with no policy at all, so staff may be putting personal, commercial or confidential information into public platforms without realizing the consequences.

The National AI Centre’s AI and Australian law page adds more context:

Privacy law requires reasonable steps to protect personal information and imposes data minimization duties to destroy or de-identify information no longer needed.
Specific provisions for automated decision-making apply from 10 December 2026, so any policy covering AI-assisted decisions about people should be reviewed against them.
Intellectual property law (including copyright), duties of confidence and contract protect the use and disclosure of data, including inputs and outputs.
The Australian Consumer Law’s prohibitions on misleading and deceptive conduct may apply to unfair data collection and use practices.

In plain policy language, this becomes a short data rule: never paste client personal information, health information, staff records, credentials or confidential commercial material into a tool that has not been approved for it. Our guides on AI data classification and AI data leakage show how to turn that into categories staff can apply in seconds.

If you run a customer-facing chatbot or other visible AI feature, the policy should also say when customers are told they are dealing with AI. This is one of the items business.gov.au lists. Check your privacy policy matches what you actually do.

Deciding which tools and uses to approve, restrict or prohibit

The National AI Centre’s implementation guidance makes a useful point: the same tool can create different risks depending on how it is used, so review each use separately and consider how a system could be reused, combined or misused. It also advises keeping an up-to-date inventory of AI systems with their purposes, risks and review dates.

Sprintlaw’s founder guide says approving a platform does not mean approving it for every task. An enterprise account might suit drafting an internal document but not processing health information or assessing job candidates. Free public tools, personal accounts, meeting assistants, browser extensions and AI features inside software you already own may each need different rules.

Before approving a tool, the same guide suggests asking where data is stored, who can access it, whether prompts or uploads train the provider’s systems, how long information is retained and what happens when an account closes.

A simple three-tier model works well:

Tier	Typical examples	Rule
Approved	Business-licensed assistant with settings reviewed	Use for listed tasks and data types
Restricted	Free public chatbots, image generators	Only with no personal, client or confidential data; output checked
Prohibited	Tools with unclear data handling, personal accounts for client work, AI for hiring or health decisions without approval	Not permitted, or only through the named approver

Our guides on AI access control and AI risk mitigation go further on who gets access to what.

Human review and accuracy

business.gov.au states that AI tools need human oversight, and that generative AI can hallucinate, meaning it presents false or misleading information as fact. Checking content before using or sharing it is essential, and how much oversight a system needs depends on its risk level.

Turn that into a rule with levels:

Internal drafts and brainstorming: the author reads and edits before sharing.
Anything sent to a client, published, or quoted in a proposal: a second person checks facts, figures, citations and tone.
Anything affecting a person’s employment, access to a service or finances: needs the named approver and a record of the review.

The Australian Government’s guidance lists record-keeping, bias and misleading claims among the things a policy should address, and the three levels above give staff an easy way to apply it.

Who owns it: roles for managers, IT and staff

The National AI Centre says organizations should assign, document and communicate accountability, including for safe policies, human oversight, testing and performance improvement, and should assess the training needs of those accountable.

The Australian Institute of Company Directors suggests embedding AI governance in existing structures and responsibilities, with the board identifying who is responsible for decisions on development, procurement, use and governance of AI, and clear reporting lines up to the board.

In a small or mid-sized business, that usually looks like this:

Owner or executive sponsor: accountable for the policy and for risk decisions.
Managers: make sure their teams know the rules, approve exceptions within their area, and raise new use cases.
IT or your IT provider: maintains the tool inventory, controls access and checks settings. See our AI security checklist.
Staff: follow the rules, check output, and report mistakes early.

Perspective

Most policies we see fail for the same reason: they were written from a template, not from what people do on a Tuesday afternoon. Leaders often believe two or three tools are in use. Staff are using more, and for different jobs.

That is why we built our assessment around an anonymous survey of every staff member. When people know their answers can’t be traced back to them, they tell you which tools they use, what they paste in, and where AI already sits inside a workflow. We think that map is the best starting point for a policy, because rules written against real usage get followed.

The scored report then shows where your capabilities are strong and where the gaps are, and gives you a 90-day action plan. Writing the policy becomes one clear step in that plan, not a guess. We don’t install software or collect individual data, and we make no compliance or legal claims. The policy and the legal questions stay with you and your advisers.

If you are going to write one policy this quarter, start by finding out what is really happening.

Anthony

Training, monitoring and review

A policy that sits in a shared folder is not a control. The National AI Centre says to evaluate and document the training needed to build broad AI understanding and a culture of accountability, deliver training to close gaps, and regularly check skills stay current. It also recommends monitoring performance, user feedback and operational impacts after deployment.

Practical steps:

Brief everyone once, then by role. A 30-minute session using your own examples beats a long document. Give the recruiter, the accountant and the support team different scenarios.
Make reporting easy. One email address or form, with a clear message that early reports are welcome.
Keep the inventory current. List tools, purposes, data types, owner and review date.
Set a review rhythm. ControlStack suggests a review at least annually with a current-as-at date, and sooner when tools or vendor prompt handling change or logs reveal tools the policy does not cover.
Report upward. The AICD checklist advises ongoing reporting from management to the board, escalation protocols for higher-risk uses and periodic reassessment given the pace of change.

Steps to create your policy

Find out what is in use. Survey staff, ideally anonymously, and check which tools and accounts exist.
List your data types and mark which can never go into an unapproved tool.
Assign an owner and an approver for higher-risk uses.
Draft the policy against the National AI Centre’s six-point check above, tailored to your business.
Have it reviewed by your lawyer or adviser, particularly where you handle health, financial or children’s information.
Train, publish and record who has read it.
Review on your schedule and whenever tools or rules change.

The AICD checklist follows a similar order: create an AI inventory, identify key risks and mitigations, establish accountability, develop policies preferably on a risk-based approach, and check data governance is fit for purpose. Our AI data governance guide and AI model risk management guide help with the later steps.

See what your team is actually doing with AI

Our AI readiness assessment gives you the evidence for step one. Every staff member completes a short anonymous survey, and you receive a scored report that maps current tool use, workflows and risks, with a tailored 90-day action plan. The report is A$1,990 one-off. If you want quarterly reports to track progress, the annual membership is A$2,388 per year.

Calibreforum

You can see what is in the report and how setup works before you decide.

FAQ

Does a small business really need a generative AI policy?

If any staff member uses an AI tool for work, yes. Sprintlaw notes the risk comes mostly from everyday staff behavior, and that applies at any size. A short policy covering approved tools, data rules and human review is enough to start.

What should staff never put into a generative AI tool?

The OAIC recommends not entering personal information, especially sensitive information, into publicly available generative AI tools. Your policy should extend that to confidential commercial material, client data and credentials, unless a tool has been approved for that data.

Who should own the policy?

Someone senior enough to make decisions, such as the owner or an executive, with managers and IT supporting. The National AI Centre advises assigning, documenting and communicating accountability so everyone knows who to ask.

How often should we review it?

At least annually, and sooner when tools, vendor data handling or the law change. Automated decision-making provisions in privacy law apply from 10 December 2026, so check your policy against them if AI informs decisions about people.