How to write an AI use policy for your business

By the ITLAW Team · Last reviewed November 2026 · General information, not legal advice

Guides › AI & Automated Decisions › AI use policy

Staff are already using generative AI tools, whether or not the business has approved them. An AI use policy sets clear rules so the business gets the productivity benefit without leaking confidential information, breaching privacy law or publishing inaccurate content. Australia has no AI-specific statute, so the policy is how you show you are managing risk under existing laws. See our AI law guide for the legal background.

What the policy should cover

• Scope: who the policy applies to (employees, contractors) and what counts as an AI tool, including AI features built into existing software.
• Approved tools: a list of tools approved for work use, preferably enterprise versions with contractual data protections, and a process to request new ones.
• Prohibited information: personal information, sensitive information, client confidential information, trade secrets, passwords and source code, unless the tool is specifically approved for it.
• Human review: AI output must be checked for accuracy, bias and suitability before it is sent, published or used to make decisions about people.
• Transparency: when to tell customers that AI was used, and how automated decisions are disclosed in your privacy policy from 10 December 2026.
• Intellectual property: do not use AI to copy third-party content, and understand that purely AI-generated output may not be protected by copyright.
• Recording and accountability: who owns each AI use case, and how incidents are reported.
• Training and review: staff training at onboarding and a review date for the policy.

Privacy checks before deploying AI

Before using AI with personal information, run a privacy impact assessment. Ask whether the use is consistent with why the information was collected, whether the provider will use your data to train its models, where the data is stored, and how inaccurate outputs about individuals will be corrected. See AI and privacy.

AI vendor contracts

• who owns inputs and outputs
• whether your data can be used to train the vendor’s models
• security standards and breach notification
• data location and overseas disclosure
• liability caps, indemnities for IP infringement, and exit rights

Keep it short

A two to three page policy that staff actually read is more effective than a long document nobody follows. Pair it with a one-page “do and don’t” summary.

Frequently asked questions

Does my business need an AI policy?

There is no legal requirement for a standalone AI policy in Australia, but if staff use AI tools a policy is the most practical way to manage privacy, confidentiality, accuracy and IP risks.

Can staff use free AI tools for work?

Many businesses prohibit using free public AI tools with work data because providers may retain or use the data. Approved enterprise versions with contractual protections are safer.

What should be banned from AI tools?

Commonly prohibited inputs include personal and sensitive information, client confidential information, passwords and credentials, and proprietary source code.

← Back to the AI & Automated Decisions guide