Australian AI Governance Kit
Free AI governance templates for Australian businesses
An AI use policy, an AI register, a checklist, a board paper and privacy policy wording for the new automated decision rules. Written for Australian law in plain English, and free to adapt.
Or read each template free, below.
Version 1.0 · Updated · Reflects Australian law and guidance as at 30 October 2026 · Not legal advice
In short
AI governance is the set of rules, roles and records a business uses to keep its use of AI safe and within the law. For most Australian businesses that means five things: a named owner, an AI use policy, a register of every AI tool, checks before AI makes decisions about people, and a privacy policy that explains those decisions.
What is in the kit
Five templates, written for Australian law
Each page has the full text, free to read. The editable Word, Excel and PDF files are free to download.
Word
AI policy template for Australian businesses
Free AI use policy template for Australian businesses, with staff rules, data limits, notetaker consent and privacy law built in. Read it, then download.
Read it free
Excel
AI register template: list every AI tool you use
Free AI register template in Excel. List each AI tool, owner, data and risk tier, and flag uses caught by the Privacy Act's automated decision rule.
Read it free
AI governance checklist for Australian businesses
Plain-English AI governance checklist for Australian businesses, mapped to the six practices in the Guidance for AI Adoption, with the law behind each.
Read it free
Word
Automated decisions and your privacy policy: what to change by 10 December 2026
From 10 December 2026, privacy policies must explain significant automated decisions. Check if APP 1.7 applies to you and adapt our sample wording.
Read it free
Word
AI governance for boards: a two-page board paper and the questions to ask
A two-page AI governance board paper for Australian directors, with the questions to ask management, the decisions to make and what to report each quarter.
Read it free
The deadline: 10 December 2026
From 10 December 2026, businesses covered by the Privacy Act must explain in their privacy policy when computer programs make, or substantially help make, decisions that could significantly affect people. That includes AI, but also simple rules and spreadsheets. Automatic payment terms, CV screening, refund rules and pricing engines can all be caught. A person checking the output does not, on its own, take a decision out of the rule.
The AI register in this kit flags which of your tools are caught, and the privacy policy wording shows you what to write.
How the kit maps to the six essential practices
The Australian Government's Guidance for AI Adoption (National AI Centre, October 2025) sets out six essential practices. It is the Government's update to the Voluntary AI Safety Standard (September 2024), and it condensed the standard's 10 guardrails into these six. The checklist is organised by the six practices, and the table below shows where each template covers them.
| Practice | What it means in practice | Where it is in the kit |
|---|---|---|
| 1. Decide who is accountable | A senior person owns AI, every tool has an owner, and the board or owners approve the rules | Policy sections 4 and 5; board summary |
| 2. Understand impacts and plan accordingly | Think about who could be harmed, consult staff, and give people a way to raise concerns | Policy sections 9 and 11; checklist section 2 |
| 3. Measure and manage risks | Screen every new tool or use, limit the data that goes in, check vendors | Register screening sheet; policy sections 6 and 15 |
| 4. Share essential information | Keep a register, tell people when they deal with AI, update the privacy policy | Register; privacy policy wording; policy section 8 |
| 5. Test and monitor | Check outputs, test customer-facing AI, review tools when vendors change them | Policy sections 7 and 12; checklist section 5 |
| 6. Maintain human control | A person decides about people, agents need approval, every tool can be paused or switched off | Policy sections 9 and 14; checklist section 6 |
The Australian laws that apply to AI use
Australia has no AI Act. The National AI Plan (December 2025) chose to rely on existing laws, and regulators are applying them. These are the ones that matter most for a business using AI, and where the kit deals with each.
| Law | What it means for AI | In the kit |
|---|---|---|
| Privacy Act 1988 (Australian Privacy Principles) | Personal information put into AI tools is still covered: purpose, security, accuracy and overseas disclosure rules apply. AI-generated information about a person is a new collection. | Policy section 6; register data and location columns |
| Privacy Act, APP 1.7 to 1.9 (from 10 December 2026) | Privacy policies must describe significant automated decisions | Privacy policy wording; register calculated column |
| Notifiable Data Breaches scheme | Information put into the wrong AI tool may be a data breach. Assess it within 30 days. | Policy section 16; register incident log |
| Statutory tort for serious invasions of privacy (from 10 June 2025) | People can sue over serious intrusions, including recording. No small business exemption. | Policy sections 6.4 and 10 |
| State and territory surveillance and listening devices laws | Recording a private conversation without consent can be an offence in every state and territory. In NSW, WA, SA, Tasmania and the ACT this can apply even to a person taking part. | Policy section 10 and Schedule 3 |
| Workplace Surveillance Act 2005 (NSW), Workplace Privacy Act 2011 (ACT) | 14 days' written notice and a policy before AI monitoring of staff | Policy section 11 |
| Fair Work Act 2009, awards and enterprise agreements | Consult once you decide on a major change in technology; if an employee says adverse action was taken for a prohibited reason, the employer must prove it was not | Policy section 11 |
| Work health and safety laws | Consult before AI allocates, paces or monitors work; manage psychosocial risks | Policy section 11 |
| Anti-discrimination laws | Discrimination because of a protected attribute (such as sex, age, race or disability) can be unlawful, whether or not a tool helped make the decision | Policy section 9 |
| Australian Consumer Law | You are responsible for what your chatbot tells customers; AI claims must be true; no fake reviews. The fixed maximum penalty for companies doubled to $100 million from 28 March 2026. | Policy sections 8 and 12 |
| Copyright Act 1968 | Outputs can copy others' work; AI-only output may have no copyright owner | Policy section 13 |
| Spam Act 2003, Do Not Call Register Act 2006 | AI-written emails and SMS need consent, sender details and a working unsubscribe. AI marketing calls, including synthetic voices, follow the Do Not Call Register rules and the telemarketing standard. | Policy section 12 |
| Corporations Act 2001 | Directors' duty of care and diligence extends to AI use | Board summary |
| Cyber Security Act 2024 | Ransomware payments must be reported within 72 hours (turnover over $3 million) | Policy section 16 |
Industry rules sit on top of these: Ahpra and TGA rules for health, the Tax Practitioners Board's guidance for tax agents, court practice notes for lawyers, ASIC and APRA expectations for financial services, and government AI policies for suppliers. Schedule 6 of the policy covers them.
Set it up in a week
- Day 1: name an owner and list your tools. Pick a senior person to own AI. Ask each team what AI they use and add a row to the register for each tool and use.
- Day 2: screen and set the rules. Use the register's screening sheet to give each use a risk tier. Adapt the AI use policy, starting with Schedule 1.
- Day 3: fix the settings. Move work onto business accounts, switch off provider training, and record where each tool stores data.
- Day 4: check your decisions about people. Look at the register's privacy column. If anything is flagged, adapt the privacy policy wording and plan the review.
- Day 5: brief the team and the board. Walk staff through the short version of the policy and have them sign it. Table the board summary.
How this differs from the government templates
The National AI Centre publishes a free AI policy template, AI register template and screening questions on ai.gov.au, alongside the Guidance for AI Adoption itself. They are a good start, and they are where we started. Then we filled the gaps a business hits in its first week.
The government policy sets principles, plus duties to follow the policy, train and report incidents. It has no approved tools list and no rules on what information can go into AI, which is the first thing staff ask about. Ours has both, with a traffic-light rule for information.
None of the three government templates mentions the Privacy Act or the 10 December 2026 rule. The government policy also leaves spreadsheet formulas and rule-based automations out of scope, and the rule covers both. Our register flags automated decisions, and the kit includes privacy policy wording.
The government templates do not deal with AI notetakers, state recording laws, workplace consultation or notice before monitoring staff. Ours do.
The government register has one example row. Ours has seven, for a fictional Brisbane accounting practice, plus a training log and an incident log.
The government screening questions flag almost any use of a general-purpose AI tool, so ChatGPT for drafting an email gets the same flag as AI that screens job applicants. Ours sorts uses into four tiers: everyday drafting with public or internal information is pre-approved, and decisions about people get the scrutiny.
Questions
AI governance in Australia: common questions
Disclaimer
General information, not legal advice. These pages and templates are general information only. They are not legal advice and do not create a lawyer-client relationship. Osher Digital is an AI and automation consultancy, not a law firm.
Current as at 30 October 2026. They reflect Australian legislation and regulator guidance as at that date. Laws, guidance and vendor terms change, so check that the content is still current before you rely on it. Adapt the templates to your business, and have a qualified Australian lawyer review your final versions, especially if you work in a regulated industry or use AI or other software to make decisions about people.
Liability. To the extent permitted by law, Osher Digital is not liable for any loss or damage, including loss caused by negligence, arising from the use of or reliance on these pages or templates. Nothing in this disclaimer excludes, restricts or modifies any right or remedy you have under the Australian Consumer Law that cannot be excluded.
Sources and endorsement. The kit covers the six essential practices in the Australian Government's Guidance for AI Adoption (National AI Centre, October 2025). Links to government and other websites are for convenience; we do not control them. Osher Digital is not affiliated with or endorsed by the Australian Government, the National AI Centre or the Office of the Australian Information Commissioner.
Permitted use. You may copy, adapt and use the templates inside your own business or organisation. You may not sell them, or republish them as templates for others, without our written permission.
Want a second pair of eyes on your AI register?
Book a free 15-minute call. We look at your register, tell you which tools to fix first, and show you where AI can save your team time without adding risk.