AI policy for small business Australia: a practical outline

Why a small business needs an AI policy at all

Most guidance on an AI policy for small business in Australia assumes you have a legal team and a risk committee. You probably have an office manager, a bookkeeper and a handful of people already using ChatGPT or Copilot to get through the week. A policy for that business should fit on two pages, be written in the voice you use in emails, and answer the questions staff really have.

Those questions are practical. Can I paste this client email in? Which tool am I allowed to use? Do I have to tell the client? Who do I ask? A policy that answers those four does more good than forty pages of principles that nobody opens.

A policy also helps outside the building. Clients may ask how you handle their information, and insurers ask about controls at renewal. A short written position is a better answer than 'we talk about it'.

Nothing in a small-business policy needs to sound like law. Compare 'Personnel shall not input Confidential Information into Unapproved Systems' with 'Do not paste client details into a tool we have not approved.' The second one gets followed.

Four decisions to make before you write a word

A policy records decisions. If you have not made them, the document will be vague. Settle these first, with whoever runs the business.

• Which tools are approved for work use, and on whose account (a business subscription, not a personal login).
• What kinds of information must never go into any AI tool, whatever the tool's settings.
• Who is the named person staff ask when a case is unclear.
• What happens if the policy is broken by mistake, as opposed to on purpose.

AI policy for small business Australia: the sections it needs

Nine headings is enough for many businesses. Each is usually two to five sentences. Australian privacy law may apply to your business depending on its size and the information you hold, which is one reason client personal information sits on the do-not-enter list. If you are unsure whether it applies to you, find out, because the answer shapes how strict that section should be.

Leave out predictions about the future of AI, mission statements and long definitions. Leave out rules you will not enforce. A rule that is routinely ignored teaches people that the whole document can be ignored.

• Purpose and scope: why the policy exists and who it covers (employees, contractors, directors).
• Approved tools: a short named list, kept in an appendix so it can change without rewriting the policy.
• Information that must not be entered: client personal information, health details, financial account data, passwords, unreleased commercial material and anything covered by a confidentiality clause.
• Acceptable uses: examples of fine tasks, such as drafting a first version of a routine letter from a template with the details removed, or tidying your own meeting notes.
• Human review: a person remains responsible for anything sent out, signed or relied on.
• Client and third-party expectations: when to tell clients, and what engagement letters or contracts say.
• Accounts, settings and add-ons: business accounts only, model training on your inputs switched off where the tool allows it, and no browser extensions or meeting recorders installed without approval.
• Incidents: what counts, who to tell and how fast.
• Ownership and review: who maintains the policy and when it is next reviewed.

Example clauses you can adapt

These are examples written in plain language. Change the square brackets, delete what does not suit you, and add what your own contracts and industry require.

Example, scope: 'This policy applies to everyone who does work for [Business name], including employees, contractors and directors, and to any AI tool used for work, whether or not the business pays for it.'

Example, information: 'Do not enter personal information about clients, staff or other people into any AI tool unless the tool is on the approved list and that use is listed as permitted. Never enter passwords, payment card details, tax file numbers or health information.'

Example, review: 'You are responsible for anything you send, sign or rely on, whether or not an AI tool helped draft it. Check facts, figures, names and references before you use them.'

Example, clients: 'If a client asks whether we use AI on their work, answer honestly and refer the question to [role]. Do not use AI on a client's work where our engagement terms, or the client, say not to.'

Example, reporting: 'If you think you have put information into a tool that you should not have, tell [role] straight away. Reporting quickly is what we want, and it will not be treated as misconduct.'

Example, tools: 'Use only the tools on the approved list for work. If you want to use something else, ask [role] first. Do not use personal accounts for work.'

Example, add-ons: 'Do not install browser extensions, plug-ins or meeting recorders that use AI without approval, because they can read what is on your screen or record other people.'

Approved tools and an exceptions process

Keep the approved list outside the policy itself, as a one-page table: tool, what it is approved for, which account type, who reviewed it and when. 'Approved' should mean someone has read the vendor's terms on retention and training, found out where data is processed, and checked whether the business account has admin controls.

Then build a way to ask for a new tool. A staff member emails the named person with what they want to use it for, what information would go in and a link to the vendor's terms. Promise an answer within a week. If the route is slow or ends in silence, people will skip it, and you will be back to guessing.

The first version of the list will be short. That is fine. A short list people use beats a long one nobody believes.

Do not forget AI features inside software you already use. If your email or document suite adds an assistant, whether it is switched on, for whom, and what it can see are approved-tools questions too. Put those on the list, with a note of who turned them on.

Rolling it out so people follow it

Emailing the policy and calling it done is how most policies die. Walk through it in a team meeting for fifteen minutes using real examples from your own work: the supplier quote, the client file note, the rostering spreadsheet. Ask what is missing. Ask what the policy would stop people doing that they genuinely need to do.

Ask each person to acknowledge they have read it, and include it in the induction for new starters. Expect questions you did not anticipate. Write them down, because they are your first revision.

If you do not know what people already use, find out before you finalise the approved list. Calibre Forum's survey produces a tool register of what people say they use, including personal accounts, which makes that first list less of a guess. A round of plain conversations with each team gets you some of the way too.

Managers are the hinge. If a team leader says 'just use whatever works' in a meeting, the policy is finished. Brief them first, give them two or three scenarios to be ready for, and ask them to raise the first awkward case early rather than quietly work around it.

Reviewing the policy and keeping it consistent

Name an owner by role rather than by person, so the policy survives a resignation. Review it every six months at first, because tools and vendor terms change, and again after any incident or when you sign a client contract with AI terms in it. Keep a one-line change log at the bottom.

Finally, read your policy next to your other documents: confidentiality clauses in employment contracts, your privacy policy, client engagement letters and your cyber insurance proposal. If the policy says one thing and the proposal form says another, fix the mismatch now rather than when someone asks.

Keep a short list of questions that came up between reviews. Real questions from real staff are the best source for the next version, and they show you which clauses are doing nothing.

Common questions

This guide is general information, not legal, insurance or financial advice. Check your own obligations with a qualified adviser.