A staff AI use policy for an Australian business can fit on one page. It should name who owns AI decisions, list the approved tools, say which business information may and may not go into each tool, require a person to check anything AI produces before it's used, say when to tell customers or colleagues AI was involved, and explain how to report a problem or ask to use a new tool. The National AI Centre publishes a free AI policy guide and template as part of the government's Guidance for AI Adoption, and it's the best place to start. This article shows how to turn it into a one-page version your staff will actually read, and adds the part most templates leave out: a simple table linking your own systems and data to the tools allowed to touch them.
Why you need one even if you haven't "adopted AI"
Your staff are probably using AI already. The National AI Centre's page on managing unapproved AI use calls this "shadow AI": people using AI tools for work outside any official policy. It says shadow AI is often a sign of unmet need, time pressure or curiosity, and recommends making it safe for people to be open about it, with clear guidance on which tools are acceptable.
So the point of a policy isn't to stop AI. It's to stop the risky versions: a customer list pasted into a free chatbot, a contract summarised by a tool whose terms allow it to keep the text, or a quote sent to a customer with figures nobody checked.
What the government guidance gives you
The National AI Centre's Guidance for AI Adoption was published in October 2025 and replaced the earlier Voluntary AI Safety Standard. It's voluntary. It sets out six essential practices:
- Decide who is accountable
- Understand impacts and plan accordingly
- Measure and manage risks
- Share essential information
- Test and monitor
- Maintain human control
The foundations version is written for organisations starting out or using AI in low-risk ways. Its first "getting started" actions are to make a senior leader the overall owner of AI use and to create an AI policy.
The free templates, on the National AI Centre's planning tools and templates page, include:
- AI policy guide and template (Word): purpose, scope, policy statements on accountability, risk, testing, fairness, transparency and human oversight, roles and responsibilities, a screening step for new uses, incident management and an annual review.
- AI register template (Word and spreadsheet): a list of each AI system, its owner, purpose, limits, data sources and risk outcome.
- Planning tools such as a business process mapping template, a data quality checklist and questions to ask AI suppliers.
The full template is thorough, and it's written for organisations of every size, so it includes a governance committee and several formal roles. For many growing businesses, a one-page staff version sits on top of it: the rules everyone follows day to day, with the fuller policy behind it for the owner and managers.
The one-page AI use policy: what to cover
Copy this outline and fill in the brackets.
1. Purpose. We use AI tools to save time on routine work. A person stays responsible for everything we send, decide or record.
2. Who owns it. [Name, role] owns this policy and decides which AI tools are approved. Ask them before using a new tool for work.
3. Approved tools. Only these tools may be used for work, on business accounts: [tool, plan, what it's approved for]. Personal or free accounts aren't to be used for business information.
4. What information can go in. Follow the data table below. If you're not sure, leave it out and ask.
5. Never put in: [customer and staff personal information, bank details, health information, passwords, other parties' confidential documents] unless the table says that tool is approved for it.
6. Check before you use it. AI output can be wrong and sound confident. Check facts, figures, names and anything legal or financial against the source before it's sent, entered into a system or relied on. You're responsible for what you send.
7. Decisions about people. Don't use AI to decide or rank anything about a customer, applicant or staff member (credit, hiring, pay, performance) unless [owner] has approved that specific use.
8. Being open. Tell the recipient when AI has produced most of a document they'll rely on, where that matters, such as advice, reports or anything customer-facing. Never present AI output as checked if it wasn't.
9. Report problems. If AI produces something harmful, wrong in a way that reached a customer, or you think information went where it shouldn't, tell [owner] the same day.
10. Asking for something new. Want to try a new tool or use? Tell [owner] the task, the tool and the data involved. They'll check it and add it to the AI register if approved.
11. Review. This policy is reviewed every [6 or 12] months, and whenever we add a tool or the law changes. Last reviewed: [date].
The part most templates leave out: which data may go into which tool
Generic policies say "don't enter sensitive information". Staff then have to guess what counts. A short data table tied to your own systems removes the guessing. For example:
- Public website text and product descriptions (website, catalogue): approved business tool yes; free or personal tools yes.
- Internal procedures and templates (shared drive): approved business tool yes; free or personal tools no.
- Supplier invoices and delivery dockets (accounting and job systems): approved business tool for the approved invoice task only; free or personal tools no.
- Customer names, contacts and order history (CRM, ordering system): approved business tool only for [approved task]; free or personal tools no.
- Staff records, pay and leave (payroll system): no tool.
- Bank details, passwords and ID documents (various): no tool.
Each line names a system your staff recognise, so the rule is concrete.
Building that table is also a useful exercise. It shows where information moves between your systems and spreadsheets, and it often finds data already being copied into tools nobody approved.
Keep an AI register next to the policy
The policy says what's allowed. The register records what's actually in use. The National AI Centre's AI register template asks for each system's name, owner, status, provider, purpose, intended uses, known limits and prohibited uses, foreseeable misuse, data sources, date registered, screening outcome and who it affects. A spreadsheet is enough to start.
Two practical additions help a growing business:
- The process and system each AI use touches, such as "supplier invoices, read into the job system", so you can see where AI sits in your workflows.
- Automated decisions that aren't AI. The template's definition of an AI system excludes spreadsheet formulas and rule-based automations. But from 10 December 2026, businesses covered by the Privacy Act must describe in their privacy policy any decisions that software makes or substantially helps make about people, where they could significantly affect them, and that includes simple rules. The OAIC's announcement of its new guidance explains it, and our guide to the Privacy Act automated decision-making disclosure shows how to find and record them. One list covering both saves doing the work twice.
Rolling it out
- Ask first. A short, no-blame question to staff: which AI tools do you use for work, and for what? You'll learn what to approve.
- Approve a small set of tools on business plans, and check each one's data terms for your exact plan.
- Write the one-page policy and the data table, using the government template as the base.
- Walk the team through it in a short meeting, with examples from your own work.
- Start the register with the tools and uses you approved.
- Review it when you add a tool, and at least once a year.
Frequently asked questions
Is there a free AI policy template for Australian businesses?
Yes. The National AI Centre publishes a free AI policy guide and template, and an AI register template, on ai.gov.au as part of its Guidance for AI Adoption. They're Word and spreadsheet files you can adapt.
Is an AI policy legally required in Australia?
The Guidance for AI Adoption is voluntary, so there's no general legal requirement to have an AI policy. Existing laws still apply to how you use AI, including privacy, consumer and workplace law. If you're unsure what applies to your business, get legal advice.
What's the difference between an AI policy and an AI register?
The policy sets the rules: who decides, which tools are approved, what data can go in and how output is checked. The register is the list of AI systems and uses actually in place, with an owner and limits for each.
Should we ban staff from using ChatGPT or other AI tools?
A ban tends to push use out of sight. The National AI Centre recommends making it safe for staff to say what they use and giving clear guidance on acceptable tools. Approving a business-grade tool for specific tasks, with clear data rules, is usually safer than a ban.
How often should we review our AI use policy?
At least once a year, and whenever you add a new tool, change how you use one, or the rules change. The government template suggests an annual review with ad hoc reviews after a significant incident or a change in law.
Taking it further
A policy is the easy part. The harder part is knowing where AI would actually help in your processes, and which of your data is clean enough to trust. Our AI readiness checklist helps you check that before you start. Our AI readiness assessment maps how your key processes run across your systems, can help you build the data table and register from what really happens, and tells you which tasks suit AI, which suit a simple rule, and which to leave alone. If you're ready to try one task, our guide to running an AI pilot safely sets out the steps, and our AI workflow automation work keeps a person approving the output.
To talk through where AI fits in your business, book a free initial chat.