Ten sections to include
- Purpose and scope. What the policy covers, including generative AI, machine learning, automated decisions and AI features in existing tools.
- Principles. A few plain statements, such as “people remain accountable for decisions” and “we are transparent about how we use AI”.
- Roles and accountability. Who approves new AI uses, who owns each system and who oversees the policy.
- Approved tools and approval process. Which tools staff may use and how to request a new one.
- Data rules. What must never be entered into AI tools, for example personal, sensitive, confidential or client information in public tools.
- Human oversight. Which outputs must be checked before use, and which decisions about people need human review.
- Transparency. When customers or staff should be told AI is involved, including privacy policy disclosures from December 2026.
- Vendors. Minimum checks before buying AI products (see our vendor due diligence questions).
- Incidents. How to report AI errors, data leaks or harmful outputs, and how they are escalated.
- Training and review. Who needs training, and when the policy will next be reviewed.
Make it usable
- Write a one-page summary of what staff should and should not do, backed by the fuller policy.
- Use real examples from your business, such as drafting emails versus making credit decisions.
- Link every rule to a process: the AI register, procurement or incident reporting.
- Make the approved process easy to follow, or people will find workarounds (shadow AI).
Keep it proportionate
A small professional services firm and a national lender need very different levels of detail. Match the policy to how you actually use AI and the impact it can have on people, then improve it as your use matures. See how this plays out in your industry.
Where to find authoritative guidance
Refer to the OAIC, the Federal Register of Legislation, and the Australian Department of Industry. New to the terminology? See our AI governance glossary. This article is general information, not legal advice.
Not sure where you stand? Try the free automated decision scope check or the AI governance readiness checker. Both are indicative starting points, not certifications.