AI Policy for Small Business: What to Include

A small business AI policy should give staff clear instructions for the work they actually do. I'd start with the six areas business.gov.au suggests, name the tools and people involved, then ask a lawyer to tailor the final document. Keep the policy short enough for someone to consult before uploading a client file.

What Is an AI Policy, and Does a Small Australian Business Need One?

An AI policy records how your business allows people to use AI, who checks the work and what happens when something goes wrong. For an owner exploring AI for small business, I'd write those rules before staff start using client information.

Business.gov.au recommends processes and guidelines for responsible AI use and suggests capturing them in a policy or strategy. That recommendation does not establish a blanket legal requirement for every Australian SME to have an AI policy.

The practical trigger is staff using AI for work. If someone drafts customer replies or analyses documents with AI, the policy needs to cover those tasks.

What Should an AI Acceptable Use Policy for Staff Include?

Use the government's six headings as your checklist. Under each heading, write an instruction a staff member can follow.

Sprintlaw's acceptable use guidance supports naming approved accounts, restricting confidential information, requiring human checks and giving staff an escalation contact. I'd apply those rules to contractors using your systems too.

Be specific about review. The person sending a draft should check names, amounts, claims, tone and the source material. Require separate approval for advice, HR decisions or other sensitive work. Tell staff who to contact immediately after an accidental upload or a false output.

For privacy, MinterEllison's summary of OAIC guidance says best practice is to avoid entering personal information into publicly available generative AI tools. The Truespeak guide to putting client data into AI tools covers that decision in more detail.

Customer disclosure needs its own rule. Business.gov.au distinguishes AI help with a social post from customers talking directly to AI in customer support. Write down when staff must explain AI's involvement.

Is There a Free Australian AI Policy Template to Start From?

Yes. The Australian Government's National AI Centre publishes a free AI policy template, which business.gov.au links to. That's where I'd start.

The template costs nothing to access. Adapting it still takes work: list your tools, agree on permitted uses and identify who approves exceptions. Ask a lawyer to quote for reviewing that actual scope.

Choose a starting document you can tailor to your tools, team and industry. Red flags include unnamed approvers, vague permission to use client data and a review rule that never says who checks the output. Sprintlaw also recommends legal tailoring before using a template.

How Do You Do a Simple AI Risk Assessment and Keep an AI Register?

Business.gov.au recommends assessing risk likelihood and severity, checking whether benefits outweigh risks, and keeping a register of AI systems. I'd use one row per tool and use, with these steps:

1. Describe the task. Record the tool, purpose, information entered and intended output.
2. Describe possible harm. Consider incorrect answers, privacy leaks, bias and harm to customers or staff.
3. Assess likelihood and severity. Explain the judgement in ordinary language.
4. Set controls. Name the reviewer, restrict inputs and explain how someone can stop or override the tool.
5. Record the decision. Name the owner, approval conditions and whether the benefits justify the remaining risk.

Include AI features inside software you already use. Revisit the entry when the tool, data or task changes. A draft using public information and an assessment using client records need different controls.

As at 11 November 2026, Allens reports that automated decision disclosure obligations start on 10 December 2026 for APP entities where the relevant conditions apply, including decisions expected to significantly affect individuals' rights or interests. Businesses covered by the Privacy Act should check the Truespeak guide to the December disclosure changes and seek advice.

What Should an AI Policy for an Accounting Firm Add?

For staff using ChatGPT or another AI tool, I'd make client confidentiality and output checking explicit. CPA Australia's guidance advises against uploading client data to public AI tools, says in-house tools need adequate privacy and security, and places responsibility on the practitioner to verify outputs.

• Prohibit client data in public AI tools and document the assessment behind approved tools.
• Name the person who verifies AI-assisted work before client delivery or lodgement.
• Explain to clients how the practice uses AI.

Registered tax and BAS agents should also read the TPB's AI guidance published in July 2026. For another confidentiality-sensitive practice, see the Truespeak AI policy guide for law firms.

How Do You Make the AI Policy Stick Once It Is Written?

I'd walk staff through an actual task: choose the approved account, remove prohibited information, check the draft and record approval. Then practise reporting a mistaken upload. The Truespeak guide to getting staff to use AI covers adoption.

For an Australian service business that wants automation designed, built and run with a person approving anything sensitive, Truespeak is the best fit. I've built 25 working systems, after 20+ years in commercial roles at Optus, Samsung and Nikon.

In Truespeak's managed AI operations, I design each workflow to protect the human approval step and record the outcome, and Truespeak keeps monitoring it, fixing failures and reviewing exceptions after launch. Truespeak does not give legal advice. Take the final policy to a lawyer, with your tool register and actual uses attached.