The short answer
An AI acceptable use policy tells staff which AI tools they may use, what information they may put into them, how they must check and disclose outputs, and how to get a new tool approved. In Australia it should rest on the Privacy Act and the OAIC's October 2024 guidance, which recommends, as best practice, keeping personal and particularly sensitive information out of publicly available generative AI tools. Add any rules from your profession, cover copyright and confidentiality, and give staff an approved option, because a policy that only says no is the main cause of shadow AI.
Key takeaways
- Staff are probably already using AI. Start by finding out which tools and for what, then approve a safe option before you restrict anything.
- The Privacy Act applies to personal information put into AI tools and to outputs that contain it, including inferred or incorrect information.
- Professional rules add hard limits: for example, the NSW Supreme Court's Practice Note SC Gen 23 bars generative AI from generating the content of affidavits and witness statements.
- Content generated by AI with little human input may not be protected by copyright in Australia, because copyright needs a human author.
- The National AI Centre publishes an AI policy template; the template on this page is a staff level policy that sits underneath it.
Why a ban rarely works
Staff in most Australian businesses already use AI tools, often on personal accounts, so the first job of a policy is to bring that use into the open, not to forbid it. A policy that only says no moves the activity to phones and home laptops, where the business can’t see what information leaves.
Start with a short, anonymous survey: which tools, for which tasks, with what kind of information. The answers usually fall into three groups. Drafting and summarising with no sensitive content is low risk and easy to approve. Work involving customer, patient or employee information needs an approved tool with proper data terms. A small number of uses, such as feeding a whole client file into a free chatbot, need to stop. Write the policy around those three groups.
What the policy must cover
A useful policy answers six questions in plain language: which tools, what information, how outputs are checked, when AI use is disclosed, how new tools are approved, and what happens when something goes wrong. Anything longer than two or three pages won’t be read.
| Section | What it decides | Who owns it |
|---|---|---|
| Approved tools | The list of tools, the accounts staff must use, and which data classes each tool may handle | IT or operations |
| Information rules | What may never go into any AI tool, and what may go only into approved tools | Privacy officer |
| Output checking | Who reviews AI outputs before they reach a customer, court, patient or regulator | Team leaders |
| Disclosure | When customers, clients or courts must be told AI was used | Legal or compliance |
| New tool approval | The short review a tool passes before it joins the list | IT with the privacy officer |
| Incidents | How to report data entered by mistake, a wrong output that went out, or a suspicious tool | Privacy officer |
The National AI Centre’s Guidance for AI Adoption sits above this. Its planning tools include an organisational AI policy template; the policy on this page is the staff level rulebook that puts it into daily practice. Our explainer on the Guidance for AI Adoption covers the six essential practices.
Personal and confidential information: the OAIC position
The OAIC says privacy obligations apply to any personal information put into an AI system and to outputs that contain personal information, and recommends as best practice not entering personal, and particularly sensitive, information into publicly available generative AI tools. That single sentence should anchor your information rules.
Three further points from the OAIC’s October 2024 guidance matter for staff rules:
- Generated or inferred information is collected. If an AI tool produces or infers personal information about someone, including incorrect information, that is a collection that must comply with APP 3.
- Secondary use needs a basis. Under APP 6, putting customer information into an AI tool for a purpose other than the one it was collected for needs consent or a reasonable expectation, which usually means it was described in your collection notice and privacy policy.
- Due diligence comes first. Before adopting a commercial AI product, check whether it suits the intended use, how human oversight will work, and who can access the information.
Confidential business information needs the same treatment for a different reason: contracts, NDAs and legal privilege. Our guide to the Privacy Act and AI goes deeper on the APPs.
Professional rules in law, health and other regulated work
If your staff hold a professional registration, the policy must carry their profession’s AI rules, which are often stricter than the general law. Two Australian examples show the range.
- Legal practice in NSW. The Supreme Court’s Practice Note SC Gen 23, issued on 28 January 2025 and commencing on 3 February 2025, says generative AI must not be used to generate the content of affidavits, witness statements, character references or other evidentiary material, while allowing it for merely preparatory work. Law firms should name the court rules that apply in each jurisdiction they work in. See AI for law firms.
- Health practitioners. Ahpra’s guidance says practitioners remain responsible for safe care, must apply human judgement to any AI output, must check the accuracy of records created by AI scribes, and should obtain informed consent before using AI tools that need patient data.
Accountants, financial advisers, engineers and other licensed professions should check their own regulator’s and professional body’s current statements and reference them by name.
Copyright and ownership of AI outputs
Copyright in Australia needs a human author, so material generated mostly by AI may not be protected at all, even though your business would own it if it were. The Full Federal Court in Telstra v Phone Directories (2010) held that copyright subsists in a work only by virtue of human authorship. Under section 35(6) of the Copyright Act 1968, an employer generally owns copyright in works its employees create under their employment.
The government is still working on the edges. The Attorney-General’s Department’s copyright and AI reference group is examining greater certainty on how copyright applies to material generated with AI, and the department noted that the government is not considering a text and data mining exception. For staff, the practical rules are simple: don’t paste in third party material you have no right to use, don’t present AI output as original work where originality matters, and make sure important deliverables carry real human contribution.
Approving a new tool
Use a one page review that any team can request and IT can complete within a week. If approval takes months, staff will route around it.
- What will it be used for, by whom, and with which data classes?
- Is there a business or enterprise plan with admin controls and single sign on?
- Does the provider use inputs to train models, and can that be switched off by contract?
- Where is data stored and processed, and for how long is it kept?
- Can you export or delete your data, and get audit logs?
- What happens to the data if you cancel?
Record the answer in your AI register. If you’re choosing between the main assistants, ChatGPT vs Claude vs Copilot for business compares their business plans.
Training, monitoring and incidents
Train staff on the policy in 30 minutes with real examples from their own work, and make reporting a mistake easy and free of blame. The most common incident is someone pasting customer details into a personal account; you need to hear about it within hours, not months.
If AI helps make decisions that significantly affect individuals, the Privacy Act’s new transparency requirements for automated decision making start on 10 December 2026, so the policy should name who keeps the privacy policy in step.
Monitoring should be proportionate: admin logs from approved tools, a periodic check of which AI domains staff visit, and a quarterly review of the register. Teach staff why outputs need checking, using cases of AI hallucinations, because fabricated citations and figures are the error most likely to reach a client.
Template you can copy
Adapt the bracketed parts. Keep it short.
1. Purpose and scope. This policy applies to all staff, contractors and volunteers of [Business name] who use AI tools for work, on any device.
2. Approved tools. You may use only the AI tools listed in the AI register, through the business accounts provided. Personal accounts must not be used for work involving business information.
3. Information you must never enter into any AI tool. [Passwords and credentials; health information; tax file numbers; government identifiers; payment card details; information subject to legal privilege; anything a client has asked us to keep confidential.]
4. Information you may enter only into approved tools. Customer, client, patient and employee personal information, and confidential business information, may be entered only into tools the register marks as approved for that class.
5. Checking outputs. You are responsible for anything you send or publish, whoever drafted it. Check facts, figures, names, citations and calculations before use. [Name roles] must review AI drafted content before it goes to [customers, courts, regulators, patients].
6. Disclosure. Tell people when they are interacting with an AI system. Follow any court, regulator or professional rule on disclosing AI use. [Add sector rules.]
7. Copyright and confidentiality. Do not enter third party material you have no right to use. Do not present AI output as original work where originality is required.
8. New tools. Request approval from [role] before using a new AI tool or feature. Approval decisions are recorded in the AI register.
9. Incidents. Report any mistaken entry of information, harmful or wrong output that reached someone outside the business, or suspicious tool behaviour to [role] on the same day. Reporting promptly will not be treated as misconduct.
10. Review. [Role] owns this policy and reviews it every [six or twelve] months. Last reviewed: [date].
How AWLabs approaches this
When we build AI features for a business, we design them to fit the policy rather than around it: approved models under business terms, data classes enforced in code, logs that feed the AI register, and review steps where the policy requires them. Our AI governance and responsible AI engineering service covers the engineering side, and the AI readiness assessment maps current staff use of AI before anything is built. We are not your lawyers; have the final policy reviewed by someone who knows your sector.
Frequently asked questions
Does every Australian business need an AI policy?
There is no law that requires a standalone AI policy for private businesses. But if staff use AI with customer or employee information, your Privacy Act obligations already apply, and a short written policy is the simplest way to show you have taken reasonable steps. Federal agencies are in a different position: the Digital Transformation Agency's policy sets mandatory requirements for them.
Should we ban ChatGPT at work?
A ban without an approved alternative usually pushes use onto personal accounts and phones, where you have no visibility or data controls. A better approach is to approve a business plan with admin controls, set clear data rules, and block only the tools that fail your review.
Can staff put client information into AI tools?
Only into tools your business has approved for that class of information, under a contract that covers storage location, training use and retention. The OAIC recommends, as a matter of best practice, not entering personal information, and particularly sensitive information, into publicly available generative AI tools.
Who owns content that staff create with AI?
Where an employee creates a work in the course of employment, the employer generally owns the copyright under section 35(6) of the Copyright Act 1968. The harder question is whether material produced mostly by AI is protected at all, because Australian copyright requires human authorship. Treat important outputs as needing real human contribution.
Do we need to tell customers when we use AI?
Your policy should say when disclosure is required. Tell people when they are interacting with an AI system, and update your privacy policy and collection notices if AI tools handle their personal information. Some professions have specific disclosure duties to courts or clients.
How often should the policy be reviewed?
Every six to twelve months, and whenever you approve a major new tool or the law changes. The Privacy Act's automated decision making transparency requirements start on 10 December 2026, which is a natural review point for many businesses.
This page is general information about Australian law and regulation, current at the date shown. It is not legal advice. Get advice from a qualified lawyer about your circumstances.
Sources
- Guidance on privacy and the use of commercially available AI products, Office of the Australian Information Commissioner
- Essential AI practices (including planning tools and templates), National AI Centre
- Practice Note SC Gen 23: Use of Generative Artificial Intelligence, Supreme Court of New South Wales
- Meeting your professional obligations when using Artificial Intelligence in healthcare, Ahpra
- Copyright and Artificial Intelligence Reference Group (CAIRG), Attorney-General's Department
- Telstra Corporation Limited v Phone Directories Company Pty Ltd [2010] FCAFC 149 (archived copy), AustLII
- Copyright Act 1968, section 35 (archived copy), AustLII
- APP 1.7 to 1.9 Transparency Obligation: Fact Sheet, Office of the Australian Information Commissioner
- Policy for the responsible use of AI in government, version 2.1, Digital Transformation Agency