AI use policy generator for small businesses.

Generator

Build your staff AI policy

Pick your business type, the AI tools your team uses and the rules you want. The policy below updates as you go. Copy it, print it or download it as a text file. Nothing you type leaves your browser.

Your AI use policy

Generated in your browser. Starting template only, not legal advice. Review it with your team before you adopt it.

This policy is for your team. Want a short public version for your website? Try the free AI use statement generator.

Paid upgrade · instant download

Want the full Staff AI Policy Pack?

The free policy above is a one-page starting point. The Staff AI Policy Pack is the full kit to put it into practice, written for small businesses. Six editable documents:

• 01
  Full staff AI use policyLonger and editable (Word, Markdown or print to PDF): approved tools and accounts, red/amber/green information rules, checking AI output, decisions about people, the 10 December 2026 privacy policy rule (APP 1.7) for businesses covered by the Privacy Act, small business coverage, AI scams, incidents and training.
• 02
  Approved AI tools registerExcel, CSV and Word. One list of which tools, which accounts, which information, training settings and review dates.
• 03
  AI incident and mistake logFirst-hour steps, plus the Notifiable Data Breaches assessment points for businesses the Privacy Act covers.
• 04
  One-page staff briefing and acknowledgementThe ten rules on a page, with a sign-off block.
• 05
  30-minute team rollout checklistA run sheet for one team meeting, with a seven-question scenario quiz and answers.
• 06
  AI tool and vendor vetting checklistBuilt on the OAIC's questions for selecting an AI product, plus practical checks on security, cost and terms.

Why bother

Why a one-page AI policy is worth ten minutes

Your team is probably already using ChatGPT, Copilot or Gemini for emails and quotes. A short written policy turns "use your judgement" into clear rules: which tools, what never goes in, and who checks the result before it reaches a customer.

The Office of the Australian Information Commissioner (OAIC) suggests organisations put in place internal policies for the use of AI that clearly define permitted and prohibited uses, with human oversight of outputs and staff training. The National AI Centre's Guidance for AI Adoption (October 2025) also includes an AI policy template; see the business.gov.au announcement. This generator is a shorter, small-business starting point built around the same ideas.

Privacy

What the OAIC says about AI tools

• Privacy obligations apply to personal information you put into an AI system, and to AI output that contains personal information.
• As a matter of best practice, the OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools.
• Businesses should be transparent about their use of AI, including clearly identifying public-facing AI tools such as chatbots.
• AI output can be wrong. Human oversight and checking matter, especially where output includes information about a person.

Source: OAIC, Guidance on privacy and the use of commercially available AI products (published October 2024, updated January 2025). Summarised in plain English here; read the original for the detail.

Does it apply to me?

Does the Privacy Act cover my small business?

Not always. The OAIC says most small businesses (annual turnover of AU$3 million or less) are not covered by the Privacy Act, but some are regardless of turnover, including health service providers and businesses that trade in personal information. The OAIC has a small business privacy checklist to work out where you stand.

Even if you are not covered, the OAIC recommends protecting any personal information you hold as a matter of best practice, and your customers will expect it. The data rules in this generator are a sensible default either way.

Coming up for businesses that are covered: from 10 December 2026, an APP entity's privacy policy must include information about computer programs that make, or substantially and directly help make, decisions that could significantly affect individuals using their personal information. See the OAIC's announcement and resources. If you use AI to help decide things about customers or staff, check this with your adviser.

Roll it out

How to roll it out in a week

• Day 1: ask everyone which AI tools they already use. Add them to section 3 (or tell people to stop).
• Day 2: generate the policy above, edit the wording to suit you, and name the AI owner.
• Day 3: check the settings in each approved tool (for example data and training controls, and who has access).
• Day 4: share it at a team meeting. Ask everyone to sign the acknowledgement.
• Every few months: review it, and update it whenever you add a tool or something goes wrong.

Next step

Want the policy and a plan to go with it?

A policy says what not to do. The AI Audit says what to do: which jobs to hand to AI first, which tools, what they cost in A$, and the order to set them up, with the same privacy rules built in. A$399, delivered within 72 hours of an online form, no meetings.

Want to see the time and money first? Try the free AI hours-back calculator and the AI tools cost calculator.

Free, by email

Get the quick-wins checklist too.

Ten small, safe AI changes a non-technical team can make this week, on one page. They fit the policy you just made. You'll see the checklist straight after you sign up, and we'll send a short email when there's something new worth your time. Unsubscribe any time.

Your email is only used for these updates. See the privacy policy.

Questions

Common questions