Free template
AI policy template for Australian businesses
A complete AI use policy you can adapt in an afternoon. It tells staff what they can and cannot do with AI, sets who approves what, and covers the Australian laws the government template leaves out.
Or read the full text free, below.
Version 1.0 · Updated · Reflects Australian law and guidance as at 30 October 2026 · Not legal advice
In short
An AI use policy is a document that sets the rules for how a business and its people use AI tools: which tools are approved, what information can go into them, who checks the output, and who is accountable. In Australia it should also cover the Privacy Act, recording laws for AI notetakers, workplace consultation and consumer law.
What the template covers
The policy has 21 short sections and 6 schedules. The sections set the rules. The schedules hold everything you fill in once: names, approved tools, retention periods and the staff sign-off.
- The short version. Ten rules for staff, on one page. If people read nothing else, they read this.
- Who is responsible. An AI owner, a tool owner for each tool, a privacy contact, and what managers and staff each do.
- Approved tools and new tools. Four risk tiers (Low, Medium, High, Prohibited), who approves each and what is needed first.
- What information can go into AI. A traffic-light rule, client contract checks, required settings and a list of prohibited uses.
- Checking output and being open about AI. Human review, customer disclosure, labelling synthetic content and honest AI claims.
- Decisions about people. What approval needs, anti-discrimination, and the privacy policy rule from 10 December 2026.
- Recording meetings and calls. One national rule for AI notetakers that works under every state's recording law.
- Our people. Consultation, health and safety, staff monitoring notice, HR decisions and the right to disconnect.
- Customer-facing AI, copyright, security, vendors, incidents, records, training and review.
- Schedules. Key details, approved tools, a recording script, a staff acknowledgement, 13 vendor questions and industry rules.
How to adapt it in an afternoon
- Fill in Schedule 1 first. Name your AI owner and privacy contact, decide who approves High risk uses, and write a one-line risk appetite.
- List your approved tools in Schedule 2. Only the tools you have set up through business accounts. Everything else is unapproved until someone asks.
- Replace the shaded fields and delete clauses that do not apply. If you do not use AI or other software to make decisions about people, section 9 shrinks to a sentence and you can delete the first point of section 17.
- Keep the rows of Schedule 6 that apply to your industry, and delete the rest.
- Have it reviewed if you are in a regulated industry or use AI in decisions about people.
- Brief your team and collect signatures (Schedule 4). Record them in the register's training log.
What it adds to the government template
The National AI Centre's free AI policy guide and template is a sound governance policy. Its own guidance says a policy should tell staff what data they can put into tools, but the template leaves that for you to write. This one fills it in.
| Government template | This template | |
|---|---|---|
| Link to the six essential practices | Wording aligns with them, under seven policy statements | Covers all six; the kit's main page maps each one to a section |
| Rules for staff | Principles, plus duties to follow the policy, train and report incidents | Ten day-to-day rules, plus a traffic-light data rule |
| Approved tools list | Not included | Schedule 2 |
| Privacy Act and the 10 December 2026 rule | Not mentioned | Sections 6, 9.3 and 21 |
| AI notetakers and recording laws | Not mentioned | Section 10 and Schedule 3 |
| Workplace consultation and monitoring notice | Not mentioned | Section 11 |
| Consumer law for chatbots and AI claims | Not mentioned | Sections 8 and 12 |
| Roles | Six roles, including a governance committee or authority | Five roles that fit a 10 to 500 person business |
| Staff sign-off | Not included | Schedule 4 |
The traffic-light rule
The everyday risk with AI tools is information going into the wrong place. The policy sorts information into three colours so staff can decide in seconds.
- Green: public and internal information that is not confidential and not about identifiable people. Any approved tool.
- Amber: confidential, client and personal information. Only tools approved for it, through business accounts with provider training switched off.
- Red: sensitive information as the Privacy Act defines it (such as health, racial or ethnic origin, religion, sexual orientation, criminal record and biometric information), plus other high-risk information: tax file numbers, bank details, passwords, legal advice and information about children. Never, unless the AI owner approves a specific tool in writing after a privacy review.
As a matter of best practice, the OAIC's guidance on commercially available AI products recommends that businesses do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. The traffic-light rule applies that advice in a practical way: free and personal accounts never receive personal information, and Amber information goes only into business accounts with contract terms that stop the provider using it for its own purposes. If you want to follow the OAIC's best practice strictly, treat all personal information as Red.
AI notetakers and recording laws by state
Recording a conversation is regulated by state and territory law, and the rules differ. In several places, recording a private conversation without everyone's consent can be a criminal offence.
| State or territory | Can someone taking part record a private conversation without everyone's consent? |
|---|---|
| New South Wales | Only in limited cases: to protect their lawful interests, or for their own use and not to share with anyone outside the conversation. Sharing is restricted. (Surveillance Devices Act 2007) |
| Victoria | Yes, but sharing the recording is restricted (Surveillance Devices Act 1999) |
| Queensland | Yes, but sharing the recording is restricted (Invasion of Privacy Act 1971) |
| Western Australia | Generally no, unless it is reasonably necessary to protect their lawful interests (Surveillance Devices Act 1998) |
| South Australia | Generally no, unless it is reasonably necessary to protect their lawful interests (Surveillance Devices Act 2016) |
| Tasmania | Only in limited cases: to protect their lawful interests, or for their own use and not to share with anyone outside the conversation. Sharing is restricted. (Listening Devices Act 1991) |
| Australian Capital Territory | Only in limited cases: to protect their lawful interests, or for their own use and not to share with anyone outside the conversation. Sharing is restricted. (Listening Devices Act 1992) |
| Northern Territory | Yes, but sharing the recording is restricted (Surveillance Devices Act 2007) |
Two points catch businesses out. First, a notetaker that joins without its owner is the riskiest case. In Victoria, South Australia and the Northern Territory its owner is not a party, so everyone must consent. In the other states and the ACT the owner may count as a party only if someone in the meeting agreed to the recording, and the rules on recording by a party then apply. Second, meetings with people in several states should meet the strictest rule. Each law has exceptions. In NSW, Tasmania and the ACT a participant may record for their own use if they do not plan to share it, but no court has decided whether sending audio to an AI vendor counts as sharing. So the policy uses one national rule: the owner attends, everyone is told, and nobody objects. Do not rely on the exceptions for routine recording.
The full template
General information, not legal advice. Have a lawyer review your final versions. Read the disclaimer
This is the complete text of the Word file. Shaded [fields] are for you to fill in.
AI use policy
[Business name] | Version [1.0] | Approved by [name, role] on [date] | Next review [date]
How to use this template. Start with Schedule 1: it holds the names, roles and settings the rest of the policy refers to. Then replace every shaded [field], delete any clause that does not apply to you, and ask every person covered by the policy to sign Schedule 4. Delete this box before you publish.
This template is general information, not legal advice. If you work in a regulated industry (financial services, health, legal, education, government contracting) or you use AI to make decisions about people, have a lawyer check your final version.
Decisions to make before you adopt. The template sets a default for each of these. Change any that do not suit you: who the AI owner is; who approves High risk uses; your risk appetite (Schedule 1); how long you keep AI chats, recordings and transcripts; whether AI notetakers are allowed; whether you apply the NSW and ACT staff monitoring notice rules in every state; whether the Privacy Act covers you; and which rows of Schedule 6 apply to your industry.
1. Why we have this policy
AI tools can save us time and improve our work. They can also leak information, make things up, treat people unfairly and break laws we already have to follow.
This policy sets the rules for how [Business name] chooses and uses AI, so that we get the benefit and manage the risk. It covers the six essential practices in the Australian Government's Guidance for AI Adoption: decide who is accountable; understand impacts and plan accordingly; measure and manage risks; share essential information; test and monitor; and maintain human control.
2. Who and what it covers
People. This policy applies to everyone who works for or with us: employees, contractors, volunteers, directors and anyone else who uses our systems or our information.
AI tools. It covers any software that generates text, images, audio, code, predictions, recommendations or decisions from data with some independence from the person using it. That includes:
- chatbots and assistants, such as ChatGPT, Claude, Gemini and Microsoft Copilot
- AI features built into software we already use (email, documents, accounting, CRM, HR, recruitment, design)
- AI notetakers, transcription and call recording tools
- AI agents that take actions, such as sending emails or updating records
- browser extensions and apps with AI features
- AI systems we build or that are built for us
Decisions about people. Section 9 also covers any computer program that makes, or helps make, decisions about people, even if it is not AI. A spreadsheet formula or a simple rule in our software can count under the Privacy Act.
Personal devices. The policy applies whenever our information is involved, on any device and in any account.
Status of this policy. This policy does not form part of any employee's contract of employment or any contract for services. We may change, replace or withdraw it at any time. Its rules are lawful and reasonable directions that everyone covered by it must follow. We require contractors to follow it through their contracts.
3. The short version
If you read nothing else, follow these ten rules.
- Use approved tools only, through your work account. The list is in Schedule 2.
- Never put sensitive information into AI (health, financial account details, tax file numbers, passwords, legal advice) unless the AI owner has approved that tool for it in writing.
- Put personal or confidential information only into tools approved for it. Never into free or personal accounts.
- Check everything AI produces before you rely on it, send it or publish it. You are responsible for it, not the tool.
- Do not let AI make decisions about people (hiring, pay, credit, pricing, discipline, access to services) without approval under section 9.
- Tell people when they are dealing with AI, and give them a way to reach a person.
- Ask before you record. Everyone in a meeting or call must agree before an AI notetaker or recorder is used.
- Do not copy. Do not ask AI to reproduce other people's work, and check outputs before you publish them.
- Ask before you try a new AI tool or turn on a new AI feature. The AI owner will help.
- Report mistakes straight away, especially if information went into the wrong tool. We will not discipline you for an honest mistake that you report promptly.
4. Who is responsible
| Role | Who | Responsibilities |
|---|---|---|
| AI owner | [Name, role] (a senior leader) | Owns this policy. Approves Medium and High risk uses. Keeps the AI register. Reports to [the board / the owners] every [quarter]. |
| Tool owner | Named for each tool in the AI register | Sets up and manages the tool, its settings and its users. Checks it still works as expected. Reviews it when the vendor changes its terms. |
| Privacy contact | [Name, role] | Advises on personal information, privacy policy updates and data breaches. Receives privacy questions about AI decisions. |
| Managers | Everyone who manages people | Make sure their team knows and follows this policy. Raise new AI uses with the AI owner. |
| Everyone | All people covered by the policy | Follow this policy. Complete AI training. Report problems. |
The AI owner can delegate tasks but stays accountable. [Board / owners] approve this policy and the risk appetite in Schedule 1.
5. Approved tools and new tools
Approved tools. Schedule 2 lists the AI tools we have approved, what each may be used for and what information may go into it. Use them only through accounts the business has set up for you.
Personal and free accounts. Do not use personal or free AI accounts for work information. Those accounts usually give us no control over how the provider stores or uses what you enter.
New tools and new uses. Before you use a new AI tool, turn on an AI feature in existing software, or use an approved tool for a new kind of task:
- Tell the AI owner what you want to do and why.
- The AI owner (or tool owner) screens the use with the questions in the AI register and gives it a risk tier.
- The use is approved, approved with conditions, or declined, as follows:
| Risk tier | Examples | Who approves | What is needed first |
|---|---|---|---|
| Low | Drafting, summarising or brainstorming with public or internal information; a person checks the output | Pre-approved for tools on the approved list | Add to the AI register |
| Medium | Personal or confidential information goes in; customers see the output; outputs are published or sent to clients | AI owner | Vendor checks (Schedule 5), settings confirmed, user training |
| High | Decisions about people; sensitive information; recording or monitoring; AI that acts on its own | AI owner and [Managing Director / board] | Written impact assessment, testing, privacy review, plan for human oversight |
| Prohibited | The uses listed in section 6.4 | Not allowed | Not applicable |
- The use is added to the AI register before it starts.
Approval is for a tool and a kind of use, not for each occasion. For example, once an AI notetaker is approved for client meetings with the consent script in Schedule 3, staff do not need fresh approval for each meeting.
6. What information can go into AI tools
6.1 The traffic-light rule
| Kind of information | Which tools | |
|---|---|---|
| Green | Public information. Internal information that is not confidential and not about identifiable people. | Any approved tool |
| Amber | Confidential business information. Client or customer information. Personal information about anyone (names, contact details, account details, opinions about them). | Only tools approved for Amber information in Schedule 2. Use the least information needed. Remove names where you can. |
| Red | Sensitive information: health, disability, racial or ethnic origin, religion, political opinions, sexual orientation, criminal record, biometric or genetic information. Tax file numbers, bank and card details, passwords and security codes. Legal advice and privileged material. Information about children. Anything a contract or NDA says we must not share. | Never, unless the AI owner approves a specific tool and use in writing, after a privacy review |
If you are not sure which colour applies, treat it as the next colour up, or ask.
6.2 Client and contract obligations
Some client contracts and NDAs limit who we can share information with, or require it to stay in Australia. Before you put a client's information into any AI tool, check the contract or ask [role]. Where the contract limits disclosure or offshore processing, get the client's consent first.
6.3 Settings
For every approved tool, the tool owner must:
- switch off any setting that lets the provider use our information to train or improve its models
- set retention to the shortest period that meets our record-keeping obligations (Schedule 1)
- use single sign-on and multi-factor authentication where available
- record where the provider stores and processes our information (Schedule 2 and the AI register)
6.4 Prohibited uses
Do not use AI, under any circumstances, to:
- create sexual, intimate or deceptive images, audio or video of a real person, or use a real person's voice or likeness without their written consent
- record, monitor or track anyone covertly
- infer someone's health, religion, sexual orientation, political views or other sensitive information without their consent and approval under section 9
- use facial recognition, voice identification or emotion recognition, unless the [board] has approved it after a privacy impact assessment (see the OAIC's guide to undertaking privacy impact assessments) and legal advice
- write fake reviews or testimonials, or post content under someone else's name
- collect email addresses or personal information by scraping websites
- compile or publish personal information about someone to harass or intimidate them
- do anything that would be unlawful or breach our other policies if a person did it
7. Check the output
AI tools make mistakes. They can invent facts, figures, quotes, case law and references, and they can sound confident when they are wrong.
- You are responsible for any AI output you use, as if you wrote it yourself.
- A person must check AI output before it is sent to anyone outside the business, published, relied on to give advice, or used in a decision about a person.
- Check facts, numbers, names, dates, citations and legal or tax references against a reliable source.
- When AI produces or changes information about a person (for example, a summary of a client meeting), check it is accurate. Records about people must be accurate, up to date and complete.
- Where it matters, record that a document was prepared with AI help and who checked it.
- Do not use AI to give professional advice (legal, tax, financial, medical) unless a qualified person reviews and takes responsibility for it. AI help does not lower the care and skill we owe our clients.
- Check AI-written content about real people or businesses for statements that could harm their reputation before it is published.
8. Be open about AI
- Customers and the public. When people deal with an AI chatbot, a voice agent or an AI that sends messages without a person checking them, tell them it is AI. Give them an easy way to reach a person, and keep a way to get help that does not depend on AI. We design customer-facing AI to be accessible to people with disability (for example to WCAG 2.2 AA).
- Collection notices. When an AI tool collects personal information (for example a chatbot, notetaker or call transcription), give people a collection notice that says so.
- AI-generated content. Label AI-generated images, video, audio or people where someone could think they are real, such as synthetic customers, staff or results in advertising.
- Clients. Tell clients how we use AI on their work if they ask, or if their contract requires it. [Optional: describe our AI use in our engagement terms.]
- Our privacy policy. Our privacy policy must accurately describe how we use AI with personal information, including the decisions in section 9.
- Claims about AI. Anything we say publicly about our own use of AI or about AI in our products must be true and backed by evidence. Do not claim a service is "AI-powered", "unbiased", "100% accurate" or "fully automated" unless we can prove it.
9. Decisions about people
9.1 The rule
No computer program, AI or otherwise, may make or substantially help make a decision that could significantly affect a person unless the AI owner and [Managing Director / board] have approved it as a High risk use. Examples:
- screening, ranking or rejecting job applicants
- setting pay, bonuses, rosters, promotions or performance ratings
- approving credit, payment terms, refunds, claims or applications
- setting personalised prices for significant goods or services
- deciding who gets access to a service, an account or support
- flagging people for fraud, risk or debt collection
A computer program may make a decision about a person on its own, with no person involved before the decision takes effect, only as an approved High risk use. [We do not allow this for decisions about recruitment, pay, discipline or termination.] People affected can ask [role] to have a person review the decision.
9.2 What approval needs
Before approval, the tool owner completes an AI use approval record (the AI register's row plus a short written assessment) that documents:
- the decision, who it affects and how much it matters to them
- the personal information the program uses
- testing for accuracy and for unfair results across different groups of people (for example by age, sex, disability, race or postcode)
- how a person reviews the outcomes, what they actually check, and when they can override the program
- how affected people can ask questions or ask for a decision to be reviewed by a person
- what record is kept of each decision
Anti-discrimination laws apply to our decisions whether or not a tool helped make them. It can be unlawful to treat someone less favourably because of a protected attribute (such as sex, age, race or disability), or to apply a rule that unreasonably disadvantages people with that attribute. The program must not use protected attributes, or obvious stand-ins for them, unless a lawyer has confirmed it is lawful.
9.3 Our privacy policy (from 10 December 2026)
From 10 December 2026, the Privacy Act requires businesses it covers to describe in their privacy policy the kinds of personal information used, and the kinds of decisions made, when a computer program makes a decision, or does something substantially and directly related to making it, and the decision could reasonably be expected to significantly affect a person's rights or interests. A person reviewing the output does not, on its own, take a decision out of the rule.
[Business name] [is / is not] covered by the Privacy Act (see Schedule 1). The privacy contact must update our privacy policy whenever a use is added to, changed in or removed from the AI register with "Yes" in the column "Privacy policy: list as an automated decision?".
10. Recording meetings and calls
AI notetakers, transcription and call recording tools record people's conversations. Recording laws differ by state and territory. In several (including NSW, Western Australia, South Australia, Tasmania and the ACT) recording a private conversation without everyone's consent can be a criminal offence. A notetaker that joins a meeting when its owner is not there may not count as "a party" to the conversation, and in some places that alone makes the recording an offence. So we follow one national rule.
- Use only notetakers and recorders listed in Schedule 2.
- Put a recording notice in the meeting invitation (Schedule 3).
- At the start, say that the meeting will be recorded and transcribed by AI, name the tool, and ask if anyone objects. Note the answer.
- If anyone objects, do not record.
- The notetaker must never join a meeting unless its owner is present. Turn off automatic joining for external meetings.
- The notetaker must show a clear name, such as "[Your name]'s AI notetaker".
- Share recordings, transcripts and summaries only with people who need them for [purpose, for example the client file], and tell attendees who that is.
- Do not record legal advice, HR investigations, disciplinary meetings, health discussions or confidential board sessions without the AI owner's approval.
- Turn off speaker voice identification unless each person has agreed to it.
- Phone systems that record or transcribe calls must play a message before the call connects. [Where we can, offer a way to continue without recording.]
- Keep recordings and transcripts only as long as Schedule 1 allows, then delete them. Keep the approved summary in the client or project file.
11. Our people
- Consultation about change. Once we decide to introduce AI that is likely to significantly affect people's jobs (for example their duties, skills, hours, rosters, job security or how their performance is measured), we consult as our awards, enterprise agreements and work health and safety laws require. [Optional: We also consult other staff the change affects.] We give written information about the change, its reasons and its expected effects, and we genuinely consider the views raised.
- Health and safety. Before we introduce AI that allocates, schedules, paces, monitors or assesses work, we assess the health and safety risks, including psychosocial risks such as excessive workload, unreasonable performance targets and excessive monitoring, and we consult the workers affected and their health and safety representatives.
- Monitoring. Before we use AI to monitor staff's computer use, communications, location or productivity, we give written notice and publish a monitoring policy that explains what we collect, why, who can see it and how long we keep it. In NSW and the ACT the law requires at least 14 days' notice, and in the ACT good-faith consultation. [Optional: We apply the same standard in every state.] This does not cover security tools described in our [IT acceptable use policy]. We do not carry out covert surveillance unless the law permits it and we have taken legal advice.
- HR decisions. AI may help prepare information, but a named manager makes every decision about recruitment, pay, rosters, promotion, performance, discipline and termination, and records the reasons in their own words. Where practical, and subject to confidentiality and the privacy of others, we show the person the information an AI-informed finding relies on and give them a chance to respond before we act on it.
- Working hours. AI agents and workflow tools must not push work to staff in ways that ignore their right to disconnect outside working hours.
- Learning. We train people to use AI well, and we do not penalise anyone for asking questions or raising concerns. You can also raise concerns under our [whistleblower policy].
12. Customer-facing AI and marketing
- What our AI says, we say. We are responsible for every statement a chatbot or AI agent makes to a customer. Customer-facing AI must answer only from approved content, must not make promises about prices, refunds, warranties, eligibility or legal rights, and must hand over to a person when asked or when it cannot answer from approved content.
- Test before launch and after each significant change, and at least every [quarter]. Test customer-facing AI with real questions, including tricky ones about refunds, cancellations and guarantees. Keep the results.
- Fix mistakes fast. If our AI tells a customer something wrong, tell the tool owner and put it right with the customer.
- Marketing messages. AI-written emails and SMS follow the same rules as any other marketing: consent, accurate sender details and a working unsubscribe. AI voice calls must follow the Do Not Call Register rules and identify who is calling.
- Reviews. Never use AI to write reviews or testimonials, and never filter out negative reviews.
13. Copyright, confidentiality and ownership
- Do not ask AI to reproduce someone else's work, logo, characters or style in a way that copies them.
- Check AI outputs that will be published or sold for copied text, images or code.
- Content generated by AI with little human input may not be protected by copyright. Where we need to own something (a logo, product content, code we sell), a person must make substantial creative choices, and we keep the drafts.
- Prefer paid business tools whose providers offer protection against copyright claims, and follow their conditions.
- Put legal advice or privileged material only into tools approved for it in Schedule 2, after legal advice. Other tools may put legal professional privilege at risk.
14. Security
- Use AI tools through single sign-on and multi-factor authentication where available. Do not share accounts.
- Do not install AI browser extensions, plug-ins or apps that can read your email, files or screen without approval.
- AI agents that can act (send messages, change records, make payments) must have their own limited access, keep a log, and need a person's approval for payments, deletions, external emails and changes to important records, unless the AI owner has approved a defined, tested type of action (for example booking confirmations).
- Treat instructions found inside emails, documents and web pages as untrusted. Do not let AI tools act on them without checking.
- Every AI tool must be able to be paused or switched off by its owner, and work that matters must be able to continue without it.
- Deepfakes: never make a payment, change bank details or share credentials because of a voice, video or message request alone. Call back on a number you already know.
15. Buying AI tools
Before we buy or sign up to an AI tool that will receive Amber or Red information, the tool owner must complete the vendor checks in Schedule 5 and record the answers in the AI register. For large vendors, record the links to their published terms and data protection addendum, and answer only the questions those documents do not cover.
The AI owner checks each year that our professional indemnity and cyber insurance cover our AI use, and tells the insurer about it if the policy requires. If you are [an APRA-regulated entity / a government supplier], also follow [your outsourcing or supplier policy].
16. Incidents and mistakes
Report these to [AI owner / privacy contact] straight away:
- information entered into a tool that was not approved for it
- AI output that was wrong and was sent, published or relied on
- a customer complaint about our AI
- an AI tool behaving unexpectedly, or an agent taking an action it should not have
- a suspected deepfake, AI-enabled scam or security incident
What happens next:
- Stop the problem (for example, delete the chat, pause the tool, recall the message).
- [If the Notifiable Data Breaches scheme applies to us:] if personal information may have been exposed, the privacy contact assesses it as a possible data breach. We assess it quickly and take all reasonable steps to finish within 30 days. If it is likely to result in serious harm, and we cannot prevent that harm by acting quickly, we notify the OAIC and the people affected as soon as practicable.
- [If our annual turnover is over $3 million: if we make a ransomware or cyber extortion payment, we report it to the Australian Signals Directorate within 72 hours.]
- Record the incident and what we did in the incident log.
- Fix the cause and update the register, settings or training.
17. Records
- For every High risk use, keep a record of each significant decision: the tool and version, the information used, the output, who reviewed it, the final decision and the reasons.
- AI prompts, outputs and transcripts that form part of business records follow our normal record-keeping rules.
- Delete AI chats, recordings and transcripts we no longer need, in line with Schedule 1.
- Do not delete AI chats, recordings or transcripts that relate to a complaint, an investigation, a dispute or legal proceedings, or that the law requires us to keep. Ask [privacy contact] first.
18. Training
- Everyone completes AI training within [30] days of getting access to an approved AI tool, and before using it with Amber or Red information, then a refresher every [12] months.
- Tool owners and anyone who reviews AI decisions get extra training on the tool's limits and how to override it.
- Training and policy sign-off are recorded in the training log.
19. Breaches of this policy
Breaching this policy may lead to disciplinary action, in line with our [disciplinary policy] and a fair process. We take prompt and honest reporting into account in your favour.
20. Review
The AI owner reviews this policy every [12] months, and sooner if:
- we have a significant AI incident
- we start using AI in a new way, especially for decisions about people
- a law, regulator guidance or our contracts change
21. Related laws and guidance
This policy is general and does not list every law. The main ones are:
| Law or guidance | Why it matters for AI |
|---|---|
| Privacy Act 1988 and the Australian Privacy Principles | Collecting, using and disclosing personal information, including in AI tools; offshore providers; accuracy; security; the privacy policy rule for automated decisions from 10 December 2026 |
| Notifiable Data Breaches scheme | Assessing and reporting data breaches, including information put into the wrong AI tool |
| State and territory surveillance and listening devices laws | Recording conversations and AI notetakers |
| Workplace Surveillance Act 2005 (NSW) and Workplace Privacy Act 2011 (ACT) | 14 days' written notice and a policy before monitoring staff |
| Fair Work Act 2009 and awards or enterprise agreements | Consultation about major change, including new technology; general protections in HR decisions |
| Work health and safety laws | Duty to consult; psychosocial risks from AI-driven workload, metrics or monitoring |
| Anti-discrimination laws (federal and state) | Discrimination on protected attributes (such as age, sex, race or disability) in AI-assisted decisions about people |
| Australian Consumer Law | Misleading statements by chatbots, AI claims, fake reviews, consumer guarantees |
| Copyright Act 1968 | Copying in AI outputs; ownership of AI-generated content |
| Spam Act 2003 and Do Not Call Register Act 2006 | AI-written marketing messages and AI voice calls |
| Corporations Act 2001 | Directors' duties of care and diligence, which extend to AI use |
| Guidance for AI Adoption (National AI Centre, October 2025) | The Government's six essential practices for responsible AI |
Schedule 1: Key details
| Item | Our details |
|---|---|
| Business name | [Business name] |
| AI owner | [Name, role, email] |
| Privacy contact | [Name, role, email] |
| Who approves High risk uses | [AI owner and Managing Director / board] |
| Is the business covered by the Privacy Act? | [Yes / No. Most businesses with annual turnover above $3 million are covered. Some smaller businesses are too, including health service providers and businesses that trade in personal information. If you are not sure, assume yes.] |
| Our AI risk appetite | [For example: We use AI to save time on drafting, research and admin. We do not use AI to make decisions about people without a person deciding. We do not put sensitive information into AI tools.] |
| Where the AI register is kept | [Location or link] |
| How long we keep AI chats, recordings and transcripts | [For example: chats 30 days; meeting recordings 90 days; approved summaries kept with the client file] |
| Reporting to [board / owners] | [Every quarter: new tools, High risk uses, incidents, training completion] |
| Policy review date | [Date] |
Document control
| Version | Date | What changed | Approved by |
|---|---|---|---|
| [1.0] | [Date] | First version | [Name, role] |
Schedule 2: Approved AI tools
| Tool and account type | Approved uses | Highest information allowed | Tool owner | Data location |
|---|---|---|---|---|
| [Example: ChatGPT Business] | [Drafting, editing, summarising, research] | [Amber] | [Name] | [Country] |
| [Example: Microsoft 365 Copilot] | [Summarising email and documents staff can already access] | [Amber] | [Name] | [Country] |
| [Example: AI meeting notetaker] | [Client meetings, with consent under section 10] | [Amber] | [Name] | [Country] |
| [Add tools] |
Tools not on this list are not approved.
Schedule 3: Recording notice and script
Meeting invitation text
This meeting will be recorded and transcribed by an AI notetaker ([tool name]) so we can keep accurate notes. The recording and transcript are shared only with people who need them for [purpose], and deleted after [period] unless we must keep them longer by law. If you would prefer not to be recorded, reply to this invitation or tell us at the start, and we will not record.
Script for the start of the meeting
Before we start: I'd like to use [tool name] to record and transcribe this meeting, so we have accurate notes. The notes are shared only with people who need them for [purpose]. Does anyone object? [Wait for each person to answer. Note who agreed. If anyone objects, turn the notetaker off.]
Phone message before a recorded call
This call may be recorded and transcribed using AI for quality and record-keeping. If you would prefer we do not record, tell us now.
Schedule 4: Acknowledgement
I have read the [Business name] AI use policy, version [1.0]. I understand it and I will follow it. I know who to ask if I am unsure, and that I must report AI mistakes straight away.
| Name | Role | Signature | Date |
|---|---|---|---|
Schedule 5: Vendor checks for AI tools
Ask the vendor, check the contract (not only the settings page) and record the answers in the AI register.
- Training. Does the vendor use our inputs or outputs to train or improve its models? Can we switch this off in the contract?
- Retention. How long are prompts, files, outputs and recordings kept, including logs kept for abuse monitoring? Can we delete them?
- Location. In which countries is our information stored and processed, including for support? Will the vendor tell us before this changes?
- Subprocessors. Who else handles our information (model providers, cloud hosts)? Is there a published list?
- Security. Which certifications does it hold (for example ISO/IEC 27001 or SOC 2 Type II)? Does it offer single sign-on, multi-factor authentication and audit logs? How fast will it tell us about a breach?
- Confidentiality. Does the contract treat our inputs and outputs as our confidential information?
- Ownership. Do we own the outputs? Does the vendor take any licence over them?
- IP protection. Does the vendor protect us against claims that outputs infringe copyright? What are the conditions?
- Liability. What is the liability cap? Are errors in outputs excluded?
- Changes. Can the vendor change its terms, model or price without notice? Can we leave without penalty if it does?
- Exit. Can we export our information in a usable format, and get written confirmation that it has been deleted?
- Agents. If the tool can take actions, can we limit what it can do and require approval for important actions?
- Decisions about people. If the tool makes or informs decisions about people, can the vendor explain at a high level how it works, what information it uses and how it was tested for accuracy and bias?
Schedule 6: Industry rules
Keep the rows that apply to you and delete the rest. These are extra to the rest of this policy.
| If you are | Extra rules to follow |
|---|---|
| A health service or practitioner | Ahpra expects practitioners to tell patients when AI is used, generally get informed consent where AI such as a scribe uses patient data, and check AI-generated records. The TGA found in October 2026 that some AI scribes are likely to be medical devices. Ask the supplier whether yours is a medical device and, if so, whether it is included in the Australian Register of Therapeutic Goods or relies on the clinical decision support exemption. Turn off diagnosis or treatment suggestions until you know. State health records laws also apply in NSW, Victoria and the ACT. |
| A registered tax or BAS agent | The Tax Practitioners Board (TPB(GS) 55/2026) says that, depending on how the tool is configured and used, entering client information into an AI tool may be a disclosure that needs the client's permission. It also expects you to verify AI outputs. |
| A law practice, or a business in litigation | Follow the generative AI practice notes of each court you appear in (for example the NSW Supreme Court's SC Gen 23 and the Federal Court's practice note). Never file AI-generated citations without checking them. Put privileged material only into tools approved for it. |
| A financial services or credit licensee | ASIC expects AI governance to keep pace with AI use (Report 798). Your general licensee obligations, design and distribution obligations and responsible lending obligations apply to AI-assisted processes. |
| An APRA-regulated entity | APRA's letter to industry on AI (30 April 2026) says existing prudential standards apply to AI risk, and expects boards to have enough AI literacy to challenge management. In practice, treat AI vendors as possible material service providers under CPS 230, apply CPS 234 to AI systems, and brief your board on the letter. |
| A government supplier | Expect agencies to ask about your AI use under the Commonwealth Policy for the responsible use of AI in government, Queensland's AI governance policy and FAIRA, or the NSW AI Assessment Framework. Keep your AI register, screening records and accountable owners ready to show. |
| A business whose customers include children | Take extra care with children's information. The OAIC must register a Children's Online Privacy Code by 10 December 2026. It will apply to apps, games, websites and other online services likely to be accessed by children. Check the final code and its start date. |
| A business with workers in NSW | New NSW duties about digital work systems (algorithms, AI, automation and online platforms, especially those that allocate work) were passed in February 2026 but had not started as at 30 October 2026. Prepare by assessing workload, performance metrics, monitoring and discrimination risks for each system. |
Based on the Australian AI Governance Kit template, version 1.0 (October 2026), by Osher Digital (osher.com.au/ai-governance-templates/).
Use this template
Download the editable Word file, or the full kit with all five templates.
Questions
Frequently asked questions
More from the kit
The rest of the Australian AI Governance Kit
Excel
AI register template: list every AI tool you use
Free AI register template in Excel. List each AI tool, owner, data and risk tier, and flag uses caught by the Privacy Act's automated decision rule.
Read it free
Word
Automated decisions and your privacy policy: what to change by 10 December 2026
From 10 December 2026, privacy policies must explain significant automated decisions. Check if APP 1.7 applies to you and adapt our sample wording.
Read it free
AI governance checklist for Australian businesses
Plain-English AI governance checklist for Australian businesses, mapped to the six practices in the Guidance for AI Adoption, with the law behind each.
Read it free
Disclaimer
General information, not legal advice. These pages and templates are general information only. They are not legal advice and do not create a lawyer-client relationship. Osher Digital is an AI and automation consultancy, not a law firm.
Current as at 30 October 2026. They reflect Australian legislation and regulator guidance as at that date. Laws, guidance and vendor terms change, so check that the content is still current before you rely on it. Adapt the templates to your business, and have a qualified Australian lawyer review your final versions, especially if you work in a regulated industry or use AI or other software to make decisions about people.
Liability. To the extent permitted by law, Osher Digital is not liable for any loss or damage, including loss caused by negligence, arising from the use of or reliance on these pages or templates. Nothing in this disclaimer excludes, restricts or modifies any right or remedy you have under the Australian Consumer Law that cannot be excluded.
Sources and endorsement. The kit covers the six essential practices in the Australian Government's Guidance for AI Adoption (National AI Centre, October 2025). Links to government and other websites are for convenience; we do not control them. Osher Digital is not affiliated with or endorsed by the Australian Government, the National AI Centre or the Office of the Australian Information Commissioner.
Permitted use. You may copy, adapt and use the templates inside your own business or organisation. You may not sell them, or republish them as templates for others, without our written permission.
Want a second pair of eyes on your AI register?
Book a free 15-minute call. We look at your register, tell you which tools to fix first, and show you where AI can save your team time without adding risk.