To write an AI policy for a small business, keep it short and answer six questions: what AI can and cannot be used for, who approves riskier uses, what data staff may put into tools, when a person must check the output, how problems are reported, and when the policy is reviewed. Start from the National AI Centre’s free template, then change it to match how your business works.
A policy is the first step before you automate anything. If you are still choosing a first job, read what to automate first. If you plan to try a tool on real work, see our Claude for business guide. For one common use, see how to get AI to reply to business emails. If you are choosing a tool, read the latest AI models explained for small businesses. To plan a safe automation for your own business, discuss an automation project.
Key facts
- The National AI Centre says that if your organisation uses AI, you should have a clear policy that explains how it can be used, who is responsible and what rules people need to follow. It publishes a policy guide and template (published 22 April 2026). National AI Centre, accessed 10 November 2026.
- Its Guidance for AI adoption: foundations sets out six essential practices and says you do not need to do everything at once; adapt them to your size, use cases and risk profile. National AI Centre, accessed 10 November 2026.
- The OAIC recommends, as best practice, that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. OAIC, published 21 October 2024, updated 17 January 2025.
What should a small-business AI policy cover?
The National AI Centre lists six things to check before you publish a policy. Use them as the outline. Each one is a question you answer in a sentence or two.
| Policy section | The question to answer | Example of a plain answer |
|---|---|---|
| Permitted use | What can AI be used for, and what can it not? | Drafting and summarising yes; hiring decisions no |
| Approvals | Who approves higher-risk uses? | The owner, before any new tool or use |
| Data | What data can staff put into tools? | Public or fictional text only, unless approved |
| Oversight | When must a person check or supervise the AI? | Before anything goes to a customer |
| Reporting | How do staff report issues or misuse? | Tell the owner the same day |
| Review | When will the policy be reviewed? | A date you set, and when you adopt a new tool |
The questions come from the National AI Centre’s checklist. The section names and the examples in the last column are ours: they show the level of detail to aim for and are not official wording.
Where do you start?
Start from the template rather than a blank page. The National AI Centre’s template includes core principles, expected behaviours and internal rules, roles and responsibilities, governance and approval points, and guidance for monitoring and review. Its advice for adapting it is practical:
- Make sure it reflects your values, goals and legal obligations.
- Match roles and responsibilities to how your business already works.
- Use terms your team already knows.
- Test the draft with the people who will use, review or oversee it.
That last step matters more than the wording. A policy that staff have not read, or that does not match what they do, protects nobody.
Before you write anything, ask your team what they already use. The policy should deal with current habits honestly, not pretend you are starting from zero.
What data should stay out of AI tools?
This is the section most likely to matter. The OAIC says that if personal information is entered into an AI system, the Australian Privacy Principles on use and disclosure apply. It also says AI output about an identifiable person can itself be personal information. As best practice, it recommends not entering personal information, and particularly sensitive information, into publicly available generative AI tools.
For a small business, a workable rule has three parts:
- List what is off limits. Customer names with contact details, health information, bank or card details, ID documents, passwords and confidential client documents.
- Name the approved tools and account types. Say which tools staff may use for work, and that they must use a business account, not a personal one.
- Say what to do instead. For example, remove or replace the identifying details before asking for help.
Whether the Privacy Act applies to your business is a separate question. Check with the OAIC or an adviser rather than assuming either way.
Who checks what the AI produces?
Put a named person on every use. The National AI Centre’s sixth practice is to maintain human control: make sure a person oversees any AI system in a way that matches how much autonomy it has and how high the stakes are, and build in clear points where a human can pause, override or shut the system down.
The Australian Government’s business guidance adds a plain rule: generative AI can present false or misleading information as fact, so check AI-generated content before you use or share it (business.gov.au, accessed 10 November 2026).
In practice, your policy can say that anything going to a customer, quoting a price or date, or making a legal, financial or health statement must be read by a person first.
Do you have to tell customers you use AI?
The National AI Centre says to make disclosure standard practice, especially where AI makes or influences decisions, generates content that can meaningfully impact people, or can be mistaken for a human being. Its example is a customer using a chatbot, who should know it is not a human specialist.
Write down where this applies in your business: a website chatbot, a phone assistant, or AI-drafted messages sent without a person reading them. The Centre also suggests keeping an AI register that documents each AI system you use, including AI embedded in other tools.
How do you keep the policy working?
- Keep records. The National AI Centre advises keeping clear records of what you do under each practice.
- Test before you deploy and monitor after. Its guidance says to test before deploying a system and to monitor it afterwards.
- Give people a way to complain. It also recommends channels for people to report problems or challenge AI decisions.
- Set a review date. Put it in the policy, and review sooner if you adopt a new tool.
None of this needs to be heavy. The National AI Centre says the same tool can carry different risks depending on how you use it. Using AI to draft marketing emails is different from using it to assess job applicants, so judge each use on its own.
Frequently asked questions
Does my small business need an AI policy?
The National AI Centre says that if your organisation uses AI, you should have a clear policy explaining how it can be used, who is responsible and what rules people must follow. It publishes a template to adapt.
Is there a free AI policy template for Australian businesses?
Yes. The National AI Centre publishes an AI policy guide and template (a Word document) on its “Create an AI policy” page. Adapt it to your business rather than copying it unchanged.
What should staff never put into an AI tool?
The OAIC recommends, as best practice, not entering personal information, and particularly sensitive information, into publicly available generative AI tools. Your policy should say what data staff may enter and into which approved tools.
Do I have to tell customers when I use AI?
The National AI Centre says to disclose your use of AI, especially where it influences decisions, generates content that can meaningfully affect people, or can be mistaken for a human. A customer talking to a chatbot should know it is not a human.
Who should own the AI policy in a small business?
The National AI Centre suggests assigning a senior leader as the overall AI governance owner, with enough authority and understanding to oversee all AI use. In a small business, that may be the owner or a director.
What should you do next?
Download the National AI Centre template, fill in the six answers above and share the draft with your team this week. If you want help turning the policy into a tested workflow, start with an automation audit.
