If your business has not said anything about AI, assume some staff are trying it anyway: a free chatbot to tidy an email, an AI feature that appeared in software you already pay for, a browser extension that summarises documents. None of that is unusual. The risk is that each person is making up their own rules about what is safe.
An acceptable-use policy replaces those private rules with shared ones. The Office of the Australian Information Commissioner (OAIC) recommends that organisations establish policies and procedures for the use of AI systems. The trick is writing one people will follow.
What the policy needs to cover
Five topics do most of the work:
| Topic | What to say |
|---|---|
| Approved tools | Which tools staff may use for work, and with which accounts (work accounts, not personal ones). Anything else needs approval first. |
| What can go in | Plain categories with examples: what is fine in any approved tool, what stays inside your own systems, and what never goes into a public AI tool. |
| Checking outputs | The person using the tool owns the result. Check facts, figures, names and references before anything leaves the business. |
| Disclosure | When to tell a client or colleague that AI helped, and that any customer-facing chatbot is clearly identified as AI. |
| Who to ask | One named person or mailbox for questions, requests for new tools, and reporting mistakes. |
Some of this is not a matter of taste. The OAIC says it is best practice not to enter personal information, and particularly sensitive information, into publicly available generative AI tools. Its guidance also notes that AI systems are known to produce inaccurate or false results, and that public-facing AI tools such as chatbots should be clearly identified. Your "what can go in" and "checking outputs" rules should reflect that.
Why policy without training fails
People follow rules they understand. A line that says "do not enter confidential information" leaves each person to decide what confidential means at four o'clock on a Friday with a deadline.
Training closes that gap. A short session can show the approved tool, walk through safe and unsafe prompts using the kinds of documents your staff handle, and practise the checking step on a real output that contains a mistake. The OAIC's guidance also points to training staff to understand the design and limitations of an AI system. Training gives you something back too: the questions people ask show you what the next version of the policy needs to say.
Keep it short
A policy staff will read fits on a page or two. Some ways to get there:
- Write in plain language, with examples from your own work rather than abstract definitions.
- Link to your privacy and information security policies instead of repeating them.
- Put the five topics first; background and rationale can sit in a separate note.
- Add a review date. Tools and features change often, and an out-of-date approved list quietly stops being followed.
- Make it safe to own up. Someone who pasted the wrong file into a chatbot should feel able to say so the same day, so you can deal with it.
The policy is also one part of a wider picture. Deciding who approves new AI uses, keeping an inventory of AI tools and checking vendors belongs to AI governance, and the acceptable-use policy is the part staff see every day.
Where to start
Our AI staff training runs practical workshops built around real roles and tasks, covering approved tools, information handling and how to check AI outputs, and connects them with your acceptable-use rules. If you do not have those rules yet, we can help you write them first so the training has something clear to teach.