The Complete Guide to AI Policy for Australian Businesses

An AI policy for business is a short, plain-English document that tells your people which AI tools they can use, what information must never go into them, who checks the output and who is accountable when something goes wrong. For an Australian business with 10 to 200 staff, it is usually the cheapest piece of AI governance you can put in place, and often the first. Australia has no standalone AI Act, but privacy, consumer, workplace and confidentiality obligations already apply to how you use AI, and some new privacy rules start in December 2026.

This guide covers the rules, what to put in your policy, how to write it and how to run AI governance that suits a small or medium business (SME) without drowning anyone in paperwork.

In this guide:

• Does your business need an AI policy?
• What Australian law says about using AI
• What to include in an AI use policy
• How to write your AI policy in seven steps
• Setting data rules people can remember
• Approving AI tools and vendors
• AI governance that fits a business of 10 to 200 staff
• Accuracy, human review and accountability
• Reporting AI to your board or leadership team
• Rolling the policy out so people follow it
• Keeping your policy current
• Frequently asked questions

Does your business need an AI policy?

Yes. If anyone in your business uses AI tools, and in most established SMEs someone already does, you need written rules for how. Without them, every staff member is making their own call about client data, accuracy and which tools are safe, often on free personal accounts nobody in management knows about.

That "shadow AI" usually comes from good intentions, but it means client files, pricing and employee information can end up in tools with no business data protections, with no record of what went where.

Australia's privacy regulator is clear that the law follows the data. The OAIC's guidance on privacy and commercially available AI products states: "Privacy obligations will apply to any personal information input into an AI system."

What Australian law says about using AI

Your AI policy needs to reflect privacy, consumer, employment and workplace safety law, confidentiality obligations and any industry-specific rules. This section is general information only, not legal advice. Laws are changing quickly, so speak to a lawyer or privacy adviser about your situation.

No AI Act, but plenty of existing law

In December 2025 the Australian Government released its National AI Plan. As MinterEllison's summary explains, the Plan confirmed the government will not mandate the mandatory guardrails it had earlier proposed for high-risk AI, and there will be no standalone AI Act. Instead it relies on existing laws, including privacy, consumer protection, copyright and workplace law, and the government announced a national AI Safety Institute.

For a business, the practical message is simple: if something would be unlawful done by a person, it is generally still unlawful done with AI. "The chatbot said it" is unlikely to be a defence for a misleading claim to a customer.

The Privacy Act and AI

The Privacy Act generally applies to businesses with annual turnover above $3 million, which can include many established SMEs, plus some smaller businesses such as private sector health service providers. Coverage depends on turnover and activities, not staff numbers.

If the Act applies, the OAIC's AI guidance sets out several expectations, including:

• Privacy obligations apply to personal information you put into an AI tool, and to output that contains personal information.
• Using AI to generate or infer personal information counts as collecting it.
• Personal information should generally only be used for the purpose it was collected for, unless an exception applies.
• You must take reasonable steps to make sure personal information is accurate, which matters because AI can be confidently wrong.
• As best practice, don't enter personal information, especially sensitive information, into publicly available generative AI tools.

Even if your business sits under the turnover threshold, a written policy is still a sensible way to control how client and staff information is handled in AI tools.

New transparency rules for automated decisions from 10 December 2026

From 10 December 2026, businesses covered by the Privacy Act must explain in their privacy policy when they use computer programs to make, or do something substantially and directly related to making, decisions that could reasonably be expected to significantly affect people's rights or interests, using personal information.

The OAIC's fact sheet on the new obligation says your privacy policy will need to cover the kinds of personal information used, the kinds of decisions made solely by the program, and the kinds of decisions where the program does a substantially and directly related step. Its examples include recruitment software that sorts candidates and ranking employees for performance, promotions or bonuses.

Note that human review does not automatically take a decision out of scope, and the OAIC says generative AI output will generally be in scope unless it is subject to extensive human oversight and control. If you use AI to screen applicants, rank staff, assess eligibility or prioritise clients, review this now.

More privacy reform is on the way

On 31 August 2026 the Attorney-General's Department released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, the second tranche of privacy reforms. According to Gadens' summary, the draft keeps the small business exemption, adds no standalone AI-specific obligations, and broadens "collects" to include information generated or derived through processes such as AI. MinterEllison notes it also proposes a "fair and reasonable" test for handling personal information and no commencement date has been announced.

The draft may change before it becomes law, so treat it as a signal of direction rather than a rule you must follow today.

NSW workplace laws: surveillance and digital work systems

Two NSW laws are worth knowing if you employ people in this state.

• Workplace surveillance. Under the Workplace Surveillance Act 2005 (NSW), computer surveillance of employees must follow a written policy that staff have been notified about, generally with at least 14 days' written notice before it starts. AI tools that monitor how staff use computers, email or the internet may fall within this, so check before switching on monitoring or analytics features.
• Digital work systems. In February 2026 NSW passed the Work Health and Safety Amendment (Digital Work Systems) Act 2026. Once the relevant parts commence, businesses will need to ensure, so far as reasonably practicable, that using algorithms, AI, automation or online platforms to allocate work doesn't put workers' health and safety at risk, and consider whether it creates excessive or unreasonable workloads, performance metrics or monitoring, or unlawful discrimination. As of October 2026 those duties had not started and no commencement date had been announced, with SafeWork NSW guidelines still being developed.

Workplace consultation obligations under modern awards and enterprise agreements can also apply when AI significantly changes people's jobs. Our guide on questions to ask your team before buying AI tools covers that conversation.

What to include in an AI use policy

A good AI use policy answers the questions your staff would otherwise guess at: what can I use, what can I put in it, who checks it and who do I ask? Most SMEs can cover this in two to four pages.

The National AI Centre publishes a free AI policy guide and template as part of its Guidance for AI Adoption. It is designed to be customised, including scaling roles to your organisation's size, so an SME can trim it down. This table shows the core sections and what they mean in practice.

Make the scope wide enough to catch AI built into software you already use. The template suggests covering AI built in-house, bought from vendors or embedded in other software. That last group matters, because CRM, HR, accounting and Microsoft 365 or Google Workspace tools may switch on AI features by default.

How to write your AI policy in seven steps

In our experience, a useful first AI policy often takes two to four weeks with a small group, a template and a couple of focused workshops. Aim for a version people will read, then improve it.

1. Name an owner. Pick one senior person, usually a director, general manager or operations manager, who is accountable for AI decisions and for the policy.
2. Find out what's already in use. Run a short, no-blame survey asking which AI tools staff use, for which tasks and on which accounts. Check what's already switched on in your Microsoft 365 or Google Workspace admin settings.
3. Decide your approved tools. Choose a small number of business-grade tools for general use, ideally ones that work with the systems you already run.
4. Set your data rules. Agree what information can go into approved tools, what needs approval first and what is off-limits.
5. Agree who checks what. Decide which outputs need human review before they go to a client, regulator, the board or the public.
6. Draft with the template, then test it on real work. Ask two or three team leads to apply the draft to tasks they actually do. Anything they can't answer from the policy needs fixing.
7. Approve, communicate and train. Have the directors or leadership team formally approve it, then walk every team through it with examples from their own work.

Setting data rules people can remember

The most useful part of any AI policy is a simple rule for what information can go where. A traffic-light system works well in SMEs because people can apply it in the moment without looking anything up.

Two habits help: remove names first ("Client A" often works just as well), and make it easy to check with the AI owner when in doubt.

Approving AI tools and vendors

Approved tools should be on business plans with proper data protections, and someone should check the vendor's terms before anyone signs up. The OAIC's guidance recommends due diligence before adopting an AI product and says it "should not amount to a 'set and forget' approach."

Business plans and personal plans can treat your data very differently. As one example, OpenAI's enterprise privacy page states that "By default, we do not use your business data for training our models" for ChatGPT Business, Enterprise and its API platform. Free and personal plans don't come with the same commitments, which is why your policy should name the plan, not just the product.

Before approving a tool, check:

• Is our data used to train the vendor's models, and can we switch that off?
• Where is our data stored, and for how long?
• Can we manage users centrally?
• Does it meet our client contract and industry requirements?

AI governance that fits a business of 10 to 200 staff

At SME size, AI governance means a named owner, a simple register, a quick risk check for new uses and clear human oversight, not a hundred-page framework.

The National AI Centre's Guidance for AI Adoption, released in October 2025, sets out six essential practices:

1. Decide who is accountable
2. Understand impacts and plan accordingly
3. Measure and manage risks
4. Share essential information
5. Test and monitor
6. Maintain human control

Its foundations version is written for organisations just getting started, and it comes with free tools including the AI policy template, an AI register template and an AI screening tool. Here's how that translates for an established SME.

One owner, plus a person for each system

The guidance suggests a senior leader as overall AI governance owner, plus a specific person accountable for every AI system you use.

An AI register

An AI register is a simple list of every AI tool and AI feature you use: what it does, who owns it, what data it touches and when it was last reviewed. A spreadsheet is fine.

A quick risk check for new uses

Drafting an internal newsletter is low stakes; screening job applicants is not. A short screening step, a few questions about the data involved and who could be affected, lets you wave through the easy uses and focus on the ones that matter.

Who sets direction

Some SMEs give AI strategy and governance to an existing senior manager; others bring in a part-time senior lead. Our guide to fractional Chief AI Officers explains when that makes sense.

Accuracy, human review and accountability

AI can produce confident answers that are wrong, so your policy must say who checks what. The person who sends or approves the work stays accountable for it.

A practical approach is to match the level of review to the stakes:

• Low stakes (internal notes, first drafts): the user checks it makes sense.
• Medium stakes (client emails, proposals): the user checks facts, figures and tone.
• High stakes (advice, contracts, anything affecting someone's job, money or rights): a qualified person reviews it and records the decision.

The National AI Centre's policy template puts it plainly: "Humans must be able to pause, override or shut down AI systems when necessary."

Be careful with claims, too. If AI drafts marketing copy, quotes or product descriptions, the Australian Consumer Law still applies to what you publish. Someone needs to check that every claim is true and can be backed up.

Reporting AI to your board or leadership team

Directors and owners need to know what AI the business uses, what it is delivering, what the risks are and whether the rules are being followed. A one-page update each quarter usually covers it.

Cover five things: use (tools and active users), value (results against a baseline), risk (incidents and register changes), compliance (training and upcoming legal changes) and decisions needed (budget, new tools or new uses).

Rolling the policy out so people follow it

A policy only works if people understand how it applies to their job. Emailing a PDF rarely gets you there.

• Train on real examples. Show each team how the rules apply to the tasks they do every week.
• Have managers go first. If managers use approved tools openly and follow the data rules, staff follow.
• Make the safe option the easy option. Give people access to good approved tools. Bans without alternatives tend to push AI use back into the shadows.

Our complete guide to AI training for staff covers how to build those skills across departments.

Keeping your policy current

Review your AI policy at least once a year, and sooner when something significant changes. The National AI Centre's template suggests annual review with formal approval, plus extra reviews after significant AI incidents, new technology or changes to laws and standards.

For the next 12 months, likely triggers include:

• The new automated decision transparency rules from 10 December 2026
• The progress of the tranche 2 privacy reforms through Parliament
• Commencement of the NSW digital work systems duties
• A new use of AI that affects customers or staff decisions

Put a date in the calendar and make the owner responsible for it.

Frequently asked questions

Is there a free AI policy template for Australian businesses?

Yes. The National AI Centre publishes a free AI policy guide and template, along with an AI register template and AI screening tool, as part of its Guidance for AI Adoption. It is designed as a starting point, so adapt it to your size, industry and the tools you actually use.

Is an AI policy a legal requirement in Australia?

There is no general law requiring businesses to have a document called an AI policy. However, privacy, consumer, workplace and confidentiality obligations already apply to AI use, and a written policy is one of the most practical ways to show you are managing them. Get legal advice if you are unsure about your obligations.

Should we ban staff from using ChatGPT and other AI tools?

Outright bans tend to push AI use onto personal accounts where you have no visibility or control. Most businesses get better results by approving a few business-grade tools, setting clear data rules and training people to use them well.

How NovoPro can help

Writing the policy is the start. The harder part is keeping governance running as the business keeps adopting AI.

That's what NovoPro's Fractional Chief AI Officer service is for. A senior AI lead works with your leadership team part time to set AI direction, put sensible governance in place and help keep your policy, register and reporting current, without the cost of a full-time executive.

If you're not sure where your business stands, book a 15-minute Problem First Call and bring your biggest AI risk or question.

More guides on AI policy, privacy and risk

We're adding detailed guides on the topics in this article, including AI register templates, the December 2026 privacy changes and AI vendor checks. They'll be listed here as they're published.

Written by Kesley Kernes, Founder and Principal Consultant of NovoPro. Kesley holds an MBA and a Lean Six Sigma Black Belt, previously established an RPA Centre of Excellence, and helps small and medium businesses across Newcastle, the Hunter and Australia use AI and automation to make and save money.