The short answer
A useful AI policy fits on one page. It names the approved tools, says what data can and cannot go into them, requires a human to review anything sent to customers, sets disclosure rules, and names who to ask. Review it every quarter as tools change.
- List approved tools and use business accounts with data controls.
- Never paste personal, health or financial details into unapproved tools.
- A person reviews and owns anything sent outside the business.
- Revisit the policy every quarter.
1. Approved tools
Name the tools staff may use for work, on business accounts where training on your data is off. Personal accounts are not for company information.
2. Data rules
Customer personal information, health or financial details, passwords and confidential contracts only go into approved tools configured for them. When unsure, remove names and identifiers first. Australian Privacy Principles still apply. Sources: OAIC guidance on privacy and AI
3. Human review
Anything sent to a customer, published or used in a decision is checked by the person whose name is on it.
4. Disclosure
Tell customers when they are talking to an automated system, and when recordings or transcripts are made.
5. Security
Two-factor sign-in on all AI tools. Connected apps and integrations are approved by the owner of the data.
6. Who to ask
Name one person who answers questions and keeps the policy current.
Questions people ask
Do small businesses need an AI policy?
If staff use AI with customer information, yes. One page is enough.
Should we ban free AI tools?
Ban them for company data, and provide an approved alternative so people are not tempted.
How often should we update it?
Quarterly, or when you add a new tool.
No affiliate links on this page at publication. Product names link to official sites so you can check current pricing. How we work.
