An AI policy template for Australian business

This policy sets out how [Organisation name] ("we", "us") uses artificial intelligence and other automated systems responsibly. It applies to every director, employee and contractor, and to every AI system we build, buy, configure or permit staff to use in our work, including general-purpose AI assistants.

It covers AI used in products and services we provide to customers, AI used internally in operations, and automated systems that make or help make decisions about people, whether or not those systems use machine learning.

This policy is owned by [role, e.g. Chief Operating Officer] and approved by [the board / the executive team]. It is reviewed at least annually and whenever we adopt a new AI system or a law or regulator's guidance changes.

AI system: a machine-based system that, for a given set of objectives, generates outputs such as predictions, recommendations, content or decisions. Includes generative AI, machine learning models, rules engines and scoring formulas where they influence outcomes.

Automated decision: a decision about a person that a computer program makes on its own, or a decision where a program does something substantially and directly related to making it, such as scoring, ranking, triaging, recommending or flagging, even where a person makes the final call.

Significant decision: a decision that could reasonably be expected to significantly affect a person's rights or interests, including eligibility for a service, product or benefit; pricing or terms; employment, promotion or performance; credit or insurance; and access to accommodation, education or health services. Beneficial effects count as well as adverse ones.

AI owner: the named person accountable for a specific AI system throughout its life.

AI register: our record of every AI system in use, maintained under section 4.

We design, buy and use AI in line with the eight Australian AI Ethics Principles.

Human, societal and environmental wellbeing. We use AI to benefit the people we serve and the community, and we consider the environmental cost of the systems we run.

Human-centred values. Our AI respects human rights, diversity and the autonomy of individuals. We do not use AI to deceive or manipulate people.

Fairness. We test for and act on bias so that our AI does not lead to unfair discrimination against individuals, communities or groups.

Privacy protection and security. We handle personal information in AI systems in accordance with the Privacy Act 1988 (Cth) and our Privacy Policy, and we secure AI systems and their data.

Reliability and safety. Our AI systems operate reliably for their intended purpose, and we monitor them for the life of the system.

Transparency and explainability. We tell people when AI materially affects them, and we can explain, in plain language, how our significant automated decisions are made.

Contestability. Where an AI system significantly affects a person, that person can challenge the outcome and have a human review it.

Accountability. Named people are responsible for every AI system we use, and human oversight of AI is enabled at every stage.

[Role] is the executive accountable for AI across the organisation and the first point of contact for regulators, customers and staff on AI matters.

Every AI system has an AI owner recorded in the AI register. The AI owner is responsible for the system's impact assessment, risk controls, testing, monitoring, documentation and decommissioning.

The AI register records, for each system: its name and purpose; the AI owner; whether it makes or assists decisions about people and, if so, what kinds; the kinds of personal information it uses; its vendor or source; the date of its last impact assessment and test; and its status.

[The board / the executive team] receives a report on AI use, incidents and risks at least [quarterly].

No AI system is used in a product, service or significant decision until it has an AI owner, a completed impact assessment and an entry in the AI register.

Before we adopt an AI system, or materially change how one is used, the AI owner completes an impact assessment that answers:

- What is the system for, who does it affect, and what happens if it is wrong?
- Does it make or help make decisions about people, and could those decisions be significant?
- What personal information does it use, and do we have a lawful basis to use it this way?
- Could it produce unfair or discriminatory outcomes for any group, and how will we know?
- What human oversight applies, and how can a person contest an outcome?
- What regulator guidance or industry rules apply to this use? [For example: OAIC, ASIC and APRA, Ahpra and the TGA, court practice notes, the Fair Work Commission, the Department of Education.]

Assessments are proportionate to the stakes. A system that drafts internal text needs a short record. A system that screens job applicants or affects credit, insurance, health care or access to a service needs a full assessment reviewed by [role] and, where personal information is involved, by [our privacy officer].

Assessments are repeated at least annually for significant systems and whenever a vendor adds automated features.

AI risks are recorded and managed in our [enterprise risk register], with controls proportionate to the harm a system could cause.

Approved uses. Staff may use approved AI tools listed in the AI register for [drafting, summarising, research, coding, analysis and customer support], subject to this policy and the acceptable use rules in section 12.

Uses requiring approval. Any use of AI to make or help make a significant decision about a person, to generate content published under our name, or to process sensitive information requires approval from [role] following an impact assessment.

Prohibited uses. We do not use AI to:
- make a significant decision about a person with no way for them to reach a human;
- infer or use sensitive information without a lawful basis and a clear need;
- deceive people about whether they are interacting with AI or about who produced content;
- monitor staff beyond what is lawful, proportionate and disclosed; or
- [add any uses specific to your sector, for example clinical diagnosis without practitioner review].

We tell people when they are interacting with an AI system, and when AI materially shapes content or a decision that affects them.

Automated decision-making disclosure (Privacy Act, from 10 December 2026). Our Privacy Policy discloses, in accordance with Australian Privacy Principles 1.7 to 1.9: the kinds of decisions made solely by computer programs; the kinds of decisions a computer program substantially and directly helps to make; and the kinds of personal information used in the operation of those programs. The AI owner for each in-scope system supplies this information from the AI register, and [our privacy officer] updates the Privacy Policy before any new in-scope system goes live.

AI-generated content published under our name is reviewed by a person before publication and labelled where a reasonable reader would want to know.

We keep plain-language explanations of how our significant automated decisions are made, available to customers and staff on request, without disclosing commercial-in-confidence detail.

Before use, each AI system is tested against its intended purpose, including accuracy, reliability, and fairness across the groups of people it affects. Results are recorded in the AI register.

In use, the AI owner monitors performance, error rates, complaints and contested outcomes at a frequency proportionate to the stakes, and at least [quarterly] for systems that make or assist significant decisions.

A system is paused or withdrawn where monitoring shows it is unreliable, unfair or being used outside its approved purpose.

Vendor claims are not a substitute for our own testing where a system affects people.

Every AI system has a person who can intervene, override or switch it off.

For decisions that significantly affect a person, we provide a clear route to a human review. [Describe the route: for example, a customer can email privacy@[domain] or reply to the decision notice, and a person will review the decision within ten business days.]

Staff who rely on AI outputs in their work remain responsible for the decisions they make. AI output is an input to a person's judgement, not a replacement for it, and staff are trained to recognise when an output should not be relied on.

Personal information is used in AI systems only for purposes permitted under our Privacy Policy and the Privacy Act 1988 (Cth). Sensitive information is not used in AI systems without a specific lawful basis and approval from [our privacy officer].

Staff do not enter personal information, confidential information or client material into AI tools that have not been approved for that purpose, and never into tools that train on inputs by default.

AI systems and their data are covered by our information security controls, including access control, logging, vendor security assessment and incident response.

Training data, prompts and outputs are retained and deleted in accordance with our records policy.

Before buying or subscribing to a product that includes AI, or when a vendor adds AI features to a product we already use, the AI owner establishes: what the AI does; whether it makes or helps make decisions about people and what kinds; what personal information it uses and where it is processed; whether inputs are used to train the vendor's models; what testing the vendor has done; and how outputs can be explained and contested.

Contracts with AI vendors require notice of material changes to automated features, cooperation with our impact assessments, and security and privacy terms consistent with this policy.

Responsibility for disclosing and governing a vendor's AI rests with us as the organisation that arranged to use it.

AI incidents and near misses, including harmful, incorrect or discriminatory outputs, security events and uses outside this policy, are reported to [role] within [one business day] and recorded in the AI register. Serious incidents are escalated under our incident response plan, assessed for notification obligations, and may be reported to the AI Incident Exchange operated by Responsible AI Australia.

Acceptable use. Staff use only approved AI tools, follow the data rules in section 10, verify AI output before relying on it, disclose AI assistance where this policy or a client requires it, and never represent AI-generated work as independently verified when it is not.

Training. All staff complete responsible AI training on induction and at least annually. AI owners and staff who rely on AI in significant decisions receive role-specific training.

Policy owner: [role]
Approved by: [board / executive]
Version: [1.0]
Effective date: [date]
Next review: [date, no later than 12 months]

This policy is published to staff at [location] and summarised for customers at [URL]. Changes are recorded below.

[Date] [Version] [Summary of change] [Approved by]