A good AI usage policy fits on two pages and answers five questions: which tools are approved, what data can and can’t go into them, who checks the output, when you disclose AI was used, and who owns the policy. That’s it. Write those five answers down, walk the team through them once, and you’re ahead of most Australian businesses — including plenty with an IT department.

Why you need one (the uncomfortable bit)

Every survey on workplace AI lands on the same finding: a large share of staff already use it, and much of that use is invisible to the boss. It has a name — shadow AI — and it’s the worst of both worlds: your business gets the risk (client data pasted into personal free accounts, unchecked AI text going out under your letterhead) without the productivity being shared, systematised or supported.

The risk was never AI. The risk is unmanaged AI. A policy isn’t about permission slips; it’s about moving the use you already have from personal accounts and guesswork onto approved tools and clear rules.

The five questions your policy must answer

1. Which tools are approved?

Name them. “Claude and ChatGPT on the company business accounts, and Copilot inside Microsoft 365” is a complete answer. The important part is the flip side: work data goes only into approved tools on business accounts — never personal free accounts, where training-data settings, ownership and access all sit outside your control. If someone wants a new tool approved, give them a way to ask (that’s question five).

2. What can go in? The traffic-light rule

This is the heart of the policy, and a traffic-light list is the format people actually remember:

  • 🟢 Green — fine to use: anything already public (your website copy, published prices), generic drafting with no real names or identifying details, your own working notes.
  • 🟡 Amber — think, then maybe: internal business information — processes, draft quotes, internal reports. Fine in an approved business-account tool with training turned off; not fine anywhere else. When in doubt, strip the names.
  • 🔴 Red — never, in any tool: client personal information, health and medical records, financial records and card details, passwords and credentials, anything under an NDA, and anything you’d have to report losing. If pasting it into a stranger’s laptop would be a problem, it’s red.

The red list isn’t AI paranoia — it’s the same obligation you already carry under the Privacy Act and your client agreements, applied to a new kind of destination. A leak via chat box is still a leak, and if it involves personal information it can still be a notifiable data breach.

3. Who checks the output?

One sentence does it: “AI output is a draft; a human who understands the work reviews it before it’s relied on or sent.” Add a stricter line for the sharp stuff: anything with numbers, legal wording, or commitments to clients gets checked against the source, not skimmed. AI states wrong things confidently; the person who hits send owns what it says.

4. When do we disclose?

Decide once so nobody improvises under pressure. A sensible small-business default: internal drafting needs no disclosure; client-facing work is reviewed so thoroughly it’s genuinely yours; and if a client asks, answer honestly. If AI plays a bigger role in a deliverable, say so up front.

5. Who owns this policy?

Name a person — owner, ops manager, whoever. They approve new tools, take the “can I paste this?” questions, and put the policy on the agenda twice a year, because the tools change fast and a policy nobody updates is a policy nobody follows.

Free template: don’t start from a blank page

We’ve written all five sections up as an editable, plain-English policy template — traffic-light table included. Fill in your tool names, adjust the red list to your industry, done. No email required.

Download the template (Word) Preview it (PDF)

Rolling it out (the part that actually matters)

  1. Set up business accounts first. A policy that says “use the business account” only works if one exists. Sort the accounts and their training-data settings before the announcement, not after.
  2. Walk it through in one meeting. Fifteen minutes. The traffic lights, the approved tools, who to ask. A policy emailed as a PDF attachment is a policy unread.
  3. Make the green list generous. If the policy reads like a list of nos, people route around it — back to the personal accounts you were trying to retire. The point is a wide, clearly lit path, with hard fences only where they matter.
  4. Train the habit, not just the rule. Rules say what not to paste; training shows what AI is actually for. Teams that get half a day of hands-on practice follow the policy naturally, because the approved path is also the useful one. (That’s the workshop we run, as a half day or a full day, and writing your policy together is part of it.)

Common questions

Do we need a lawyer for this?
For a small business, usually not to get started — it’s an internal working document, like a social media policy. If you’re in a regulated industry (health, legal, finance) or handle especially sensitive data, have your adviser review the finished draft rather than write it from scratch.
Wouldn’t it be safer to just ban AI?
Bans push use underground, onto personal accounts and personal phones, where you have no visibility or control — you keep all the risk and lose all the upside. A short policy with approved tools and clear data rules gives you the protection a ban only pretends to.
Can staff use their personal ChatGPT or Claude accounts?
This is the single most important thing to rule out. Personal accounts may use conversations for training depending on settings, aren’t controlled by your business, and leave with the employee. Business accounts for the approved tools remove the reason anyone reaches for a personal one.
What about Copilot — it’s already in our Office apps?
Include it like any other tool. Copilot inside a business Microsoft 365 tenancy runs under Microsoft’s commercial data protections — a better starting position than a random free tool — but the same rules apply: what goes in a prompt, who reviews the output, and nothing unchecked goes to clients.

General information, not legal advice — adapt the template to your business and check anything industry-specific with your adviser.

Keep reading

AI at work What AI can actually do The honest capability map for small business in 2026. Service AI workshops for your team Hands-on, half day or full day — policy guidance included. AI at work The slowest part of AI is us Why the bottleneck is people, and the skills that outlast every new tool.