A company AI policy should cover eight things: scope, ownership, approved tools, data rules, human review, disclosure, incident reporting and review. This AI policy template gives one example clause for each section, so you can draft your own and take it to your lawyer.
An AI policy tells staff which AI tools they can use, for what work, and with what data. Softwired is a Brisbane consultancy that helps Australian organisations put AI rules and ownership in place. A policy exists so people can use AI with confidence, without guessing where the edges are. Keep it short enough to read in one sitting. A policy staff read beats a thorough one they skip. The rules are one part of AI adoption, and our AI Adoption Playbook covers the change work that gets people using them.
The eight sections of an AI policy template
Each section below has a one-line purpose and an example clause. Replace the bracketed parts with your own details.
1. Scope
Say who the policy covers and what counts as an AI tool.
This policy applies to all staff, contractors and volunteers who use AI tools for [Company] work, on any device or account, including AI features built into software we already use.
2. Ownership
Name the person who owns the rules and keeps them current. We call this person the AI Lead.
The AI Lead, [name and role], owns this policy, the approved tools register and the approved uses register, and answers questions about them.
3. Approved tools
Point to a register of approved tools. Keep the list itself out of the policy, because it changes more often than the rules do.
Staff may use AI tools listed on the approved tools register, using a [Company] account. Ask the AI Lead before using any other tool for work.
4. Data rules
Set out what must never go into an AI tool. This is the section most likely to prevent harm.
Never enter personal information about customers or staff, client confidential information, passwords, or financial account details into an AI tool unless the approved uses register allows it for that tool.
5. Human review
Say when a person must check AI output before it is used.
A person must check AI-generated content for accuracy before it is sent to a customer, published, or used to make a decision about a person.
6. Disclosure
Say when staff must tell people that AI was involved.
Tell the recipient when AI wrote a substantial part of a document they will rely on, and always disclose when an AI tool records or transcribes a meeting.
7. Incident reporting
Make it easy to report a mistake, and make it safe.
If you think information went into the wrong tool, or AI output caused a problem, tell the AI Lead the same day. Reporting early will not count against you.
8. Review
Set a date for the policy to be checked.
The AI Lead reviews this policy and both registers each quarter, and after any incident or major change to an approved tool.
Privacy questions to check with your lawyer
This page is general information. Take these questions to your legal adviser before the policy is final.
- Does the Privacy Act 1988 apply to your business, and to which information?
- If staff enter personal information into an AI tool, is that a use or disclosure the person was told about when you collected it? The Office of the Australian Information Commissioner (OAIC) discusses this under Australian Privacy Principle 6 in its guidance on commercially available AI products.
- Does an approved tool store or process information overseas, and what does that mean for your obligations?
- How will you keep personal information accurate when AI tools summarise or rewrite it?
- Do you need consent before an AI tool records or transcribes a meeting?
The OAIC recommends that organisations do not enter personal information, "and particularly sensitive information", into publicly available generative AI tools. Your data rules section is where that recommendation becomes a rule your staff can follow.
How to roll out an AI policy so staff read it
A policy emailed as an attachment is rarely read. These four steps help staff read it and use it.
- Find out first which AI tools staff already use. Our guide to shadow AI shows how, including a no-blame survey with an amnesty for past use.
- Approve at least one tool before the policy goes out, so staff have a safe option on day one.
- Walk each team through the policy in a short session, using examples from their own work.
- Check your software's admin settings for AI features vendors have switched on. Our list of AI features switched on by default is a starting point.
In AI Onramp, the policy is written in the third step, after discovery and the tool decision, and the AI Lead owns it from then on. Our walkthrough of how an AI adoption program runs shows where it fits.
Getting people to work under the rules
The policy sets the rules. Getting people to change how they work is a change job, and that is what the AI Adoption Playbook covers: a change-management method for AI with 36 pages and 21 templates, including guardrails, each with a worked example.
Frequently asked questions
What should a company AI policy include?
Eight sections: scope, ownership, approved tools, data rules, human review, disclosure, incident reporting and review. Keep each section to a few lines, and keep the list of approved tools in a separate register.
Do small businesses need an AI policy?
If staff use AI tools for work, a short written policy helps, whatever the size of the business. One page covering approved tools, data rules and human review is enough to start.
Who should own the AI policy?
Name one person, often called an AI Lead, who owns the policy and the registers of approved tools and approved uses. They answer staff questions and review the policy each quarter.
Is an AI policy a legal requirement in Australia?
Ask your legal adviser what applies to your business. Privacy obligations may affect what staff can put into AI tools, and the OAIC has published guidance on commercially available AI products.
If you want the method that gets people working under the rules, get the AI Adoption Playbook.
Want to talk through how this applies to your team? Book a call with Softwired.
