How to write an AI use policy for your business

Why your business needs an AI use policy now

If your team writes emails, quotes, job notes or social posts, there's a good chance someone is already using an AI tool to help. The National AI Centre puts it plainly: "Whether you have an approved policy or not, it's likely that some of your staff are already using AI at work without you knowing." It calls this shadow AI, meaning people using AI tools for work outside an official policy or approved approach.

That isn't a reason to ban AI. The Centre notes that "Shadow AI is often a signal of unmet need, time pressure, or curiosity from early adopters." The risk is in the details: a staff member pastes a customer's name, address and complaint into a free chatbot to draft a reply, or sends a quote with a price the tool made up.

A short written policy fixes most of this. It tells your team which tools they can use, what information must never go into them, who checks the output and what customers are told. The rest of this guide walks through each part, then gives you a one-page version to adapt.

Decide what information can go into AI tools

This is the most important rule, so make it simple enough to remember. The Office of the Australian Information Commissioner (OAIC) says that "As a matter of best practice, the OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available AI chatbots and other publicly available generative AI tools, due to the significant and complex privacy risks involved."

Whether the Privacy Act formally applies depends on your business. The OAIC says most small businesses with an annual turnover of $3 million or less aren't covered, though some are regardless of turnover. For businesses that are covered, the OAIC notes that APP 6 generally limits using or disclosing personal information to the purpose it was collected for. Even if you're not covered, your customers still expect their details to stay with you, so the same rule is a sensible standard.

A three-level rule works well for most small teams:

• Fine to use: public information and your own general content, such as a draft blog post, a job ad or a rewrite of your service description with no customer details in it.
• Approved business tools only: internal information that isn't about a person, such as a price list, a procedure or a supplier comparison, and only in tools the business has checked and set up.
• Never in a public AI tool: customer or staff names, contact details, addresses, health or financial details, photos of people, passwords, and anything a customer told you in confidence.

Keep readingCheck the basics of handling enquiry details

Choose approved tools and check their settings

List the AI tools your team may use for work, and set them up under business accounts rather than personal ones. That way the business controls access, can remove it when someone leaves, and knows where its information has gone.

Before approving a tool, read its terms and data settings. The OAIC warns that "Some commercial AI products will include terms or settings that allow the product owner to collect the data input by customers for further training and development of AI technologies." It also suggests measures such as turning off features that would disclose personal information, and says that any rule against entering personal information "will need to be accompanied by robust training and auditing measures."

Keep a simple register: the tool, who owns the account, what it's approved for, its key settings and the date it was last checked. The National AI Centre publishes a free AI register template for this. The OAIC adds that due diligence "should not amount to a 'set and forget' approach," so recheck each tool when its terms, features or your use of it changes.

Make a person responsible for every output

AI tools write confidently, whether or not they're right. The OAIC says "AI systems are known to produce inaccurate or false results," and that the risk is especially high with generative AI. Your policy should make it clear that whoever uses the tool owns the result.

In practice, that means checking every fact, price, date, name and promise before anything reaches a customer. It means never sending a quote, contract term or advice that only the tool has read. And it means AI can help prepare a decision about a customer or job applicant, but a person makes it.

The National AI Centre's guidance recommends meaningful human oversight matched to the stakes, with "mandatory human review for high-stakes decisions." For a small business, a good test is simple: if a mistake would cost money, upset a customer or break a promise, a named person checks it first.

Keep readingPrepare a response plan for AI mistakes

Keep readingCheck AI-written website content before it goes live

Be open with customers about AI

If a customer is talking to an automated assistant, they should know. The National AI Centre gives this exact example: "when a customer is receiving services and information from a chatbot, they should know this is not a human specialist."

The OAIC recommends that businesses "update their privacy policies and notifications with clear and transparent information about their use of AI," including making sure public-facing AI tools such as chatbots are clearly identified. A sentence or two in your privacy policy, plus a clear label on any website chat, is usually enough to start. If AI will handle customer details in a way people wouldn't expect, get advice before you begin.

Keep readingDecide whether a website chatbot suits your business

Keep readingCheck whether your privacy policy must list automated decisions

A one-page AI use policy you can adapt

The National AI Centre's first recommended step is to "Assign a senior leader as the overall AI governance owner" and create an AI policy, and it publishes a free AI policy guide and template. For a small service business, one page covering these points is a practical start:

• Owner: the person responsible for this policy, approved tools and questions from staff.
• Approved tools: the list, with business accounts, and how to request a new one.
• Information rules: the three levels above, with real examples from your business.
• Checking: who reviews AI-assisted work, and what must never be sent without a person reading it.
• Customers: how you tell people when they're dealing with AI, and where that's written down.
• Mistakes: what to do if information goes into the wrong tool, and who to tell straight away.
• Review: a date to revisit the policy, such as every six months or when you add a new tool.

Keep readingConnect an approved AI step to your systems

Put the policy to work

Write it in plain language and walk the team through it. The National AI Centre stresses that "People need to feel safe to disclose their use of AI," so make it easy for staff to say what they already use and ask for tools that would help. A policy people are scared of just pushes AI use back into the shadows.

If you'd like help choosing tools, setting safe defaults or connecting an approved AI step to the systems you already use, Demandify's AI Systems & Automation service can scope it with you. This guide is general information, not legal advice.