A plain outline you can adapt for your own AI policy

Copy the headings below into a document and fill each blank in your own words. Keep it to a page or two. This is a layout, not finished policy text, and it isn't legal advice. For privacy, copyright and employment rules, read your own regulator's pages.

Before you start

Find out what staff already use. A quick, friendly chat or a short form is enough. The outline works best when it describes real habits.

Australia's privacy regulator wants organisations to put written rules in place for AI use, partly for openness.¹ That's the job this document does.

The outline

Why we have this policy One or two sentences. Example prompt: "We use AI tools to save time. We want no leaks and no mistakes."

Who it covers Prompt: "This applies to [employees / contractors / casual staff / owners]."

Tools we allow Prompt: "These tools are approved for these jobs: [table]. Ask [name] before using any other tool. Personal accounts: [allowed / not allowed / allowed only for ...]." Details: setting the approved list.

What never goes in Prompt: "Don't enter [customer details / staff records / passwords / contracts / other: ...]." More: what to hold back.

Checking the output Prompt: "A person reads all AI-assisted work before use. Work going outside the business is also read by [name or role]." See the checking page.

Customers Prompt: "We [do / don't] tell customers when AI helped with a document. Chatbots are labelled as AI. These jobs are never done with AI: [list]." The OAIC wants a chatbot open to the public to say plainly that it's AI.¹ Wording ideas: customer emails and chats.

Who owns this policy Prompt: "[Name] answers questions and updates the policy." The National AI Centre's guidance asks for accountable people to be named, recorded and made known.²

If something goes wrong Prompt: "Tell [name] straight away. We look at what happened. We don't hunt for someone to blame." The UK's cyber security centre asks leaders how they'd handle a serious security incident.³ Your answer goes here, in a line or two.

Training Prompt: "New staff are shown this policy on their first week. Everyone gets a short refresher [when]." The National AI Centre expects training for people who oversee or use AI systems.²

Review date Prompt: "We review this policy on [date], or sooner if a tool or the law changes."

Short or full?

Leave out

• Long legal wording. If a lawyer needs to review the document, that's a separate job.
• Rules you won't enforce.
• Tool details that go out of date fast. Keep those in the tools table, which you can update without rewriting the policy.
• Promises about compliance with a law. A policy can't make that claim for you.

The National AI Centre advises reviewing each use separately.² So when staff propose a new use, check it against the tools, data, checking and customer sections rather than assuming the old rules cover it.

Finally, sign it, date it and put it where staff will see it. A policy in a forgotten folder protects nobody. For more on what each section contains, see the main sections page.