What should the policy cover?
The National AI Centre's guidance lists the points a policy should make clear before it is finalised, and they work as a table of contents. Its template adds core principles, expected behaviours, roles and responsibilities, governance and approval points, and monitoring and review guidance. Write in the terms your staff already use, and match roles to the governance structure you already have, so the policy describes how your business actually works.
- What AI can and cannot be used for.
- Who approves higher-risk use cases.
- What data staff can put into tools.
- When staff need to oversee AI use.
- How staff report issues or misuse.
- When the policy will be reviewed.
Which tools and accounts are approved?
Name the approved tools in an appendix you can update without rewriting the policy, and state the account type for each. A business plan managed by the company can carry different data terms and admin controls from a free or personal account of the same product, so the account matters as much as the brand. Say whether staff may use AI features built into software the business already licenses, and how they request a tool that is not on the list. If you have not yet found out what staff already use, do that first, or the approved list will not match what happens at work.
What information can staff put into AI tools?
This is the rule staff most need, so make it concrete. Group information into a few types your staff recognise and give a rule for each type and each class of tool. The OAIC's best-practice recommendation is that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. It also notes that privacy obligations apply to personal information put into an AI system and to outputs that contain it, so the same care applies to what comes out. Cover passwords, access keys and commercially confidential material too. Privacy law may not reach them, and exposing them still causes real harm.
When must a person check the output?
Set review rules by consequence. Internal brainstorming may need no review. Anything sent to a client, published, used in a quote, contract or financial figure, or used in a decision about a person should be checked by someone accountable for the result. Say what checking means: confirming facts, figures and references against the source. If your business tells clients when AI has been used in their work, state when and how. The OAIC also expects organisations to update privacy policies and notifications with clear information about their use of AI, including identifying public-facing tools such as chatbots.
Who approves new tools and higher-risk uses?
Name one senior owner for the policy. The National AI Centre's foundations guidance asks for a senior leader as the overall AI governance owner, with enough authority and understanding to oversee all AI use. Then set a simple approval route: tools on the approved list need no further approval for their listed uses, a new tool needs the owner's sign-off, and any use that makes or informs decisions about customers or staff needs a documented risk check first. The risk screening template published with the guidance is a reasonable gate for that last step.
How do staff report a problem?
Give one reporting route, such as a named person or a shared mailbox, and say what to report: wrong output that reached a client, personal or confidential information entered into an unapproved tool, a tool behaving unexpectedly or someone using AI against the policy. Make it clear that prompt reporting is expected and will not be punished in itself. Where personal information may have been exposed, the report should reach whoever handles privacy incidents, because the implementation guidance reminds organisations to meet data breach reporting requirements such as the OAIC's Notifiable Data Breaches scheme.
How do you get staff to follow it?
Write it with the people who will use it. The National AI Centre recommends testing the draft with the people who will use, review or oversee it, and its readiness guidance notes that employers have obligations to consult under workplace and work health and safety laws. Run a short session at launch using real tasks from your business, publish the approved tool list where staff work and set a review date. Review sooner if a major tool changes its terms, a new use is proposed or an incident shows a gap.