AI Policy Template: How to Write One Your Team Will Read in Five Minutes

A good AI policy fits on one page and answers six questions: which AI tools are approved, what data may go into them, what needs a person's approval before it goes out, which accounts to use, who owns AI decisions, and when the policy is reviewed. Short rules that people follow beat long ones nobody reads.

This is general information, not legal advice.

What should an AI policy include?

An AI policy should cover six things: approved tools, data rules, approval rules, accounts, ownership and review. Each needs only a few lines. Together they tell every employee what they may do with AI, what they must never do, and who to ask when they are unsure.

1. Approved tools. Which AI assistants and features staff may use for work.
2. Data rules. What may go into those tools, and what never may.
3. Approval. What a named person must check before it is published, sent or spent.
4. Accounts. Company work happens in company accounts, not personal ones.
5. Ownership. Who decides on new tools, exceptions and incidents.
6. Review. When the policy is updated, because the tools change fast.

Most templates online add sections on bias, procurement, monitoring and enforcement. Those matter for large organisations. For a business of 10 to 200 people, the six above cover the risks that actually occur.

What does Australian guidance expect from an AI policy?

Australian guidance points the same way. According to the privacy regulator, the Privacy Act applies to all uses of AI involving personal information, and recommends not entering personal information into public AI tools. The National AI Centre's guidance sets six essential practices, beginning with accountability and ending with human control.

The OAIC published its guidance in October 2024 and updated it in January 2025. Its central recommendation is direct: "As a matter of best practice, the OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools."

The National AI Centre's Guidance for AI Adoption, published in October 2025, condenses the earlier Voluntary AI Safety Standard into six essential practices:

A one-page policy that covers the six sections in this article maps closely onto those practices.

How long should an AI policy be?

One page for the policy staff must follow, with more detail available for those who need it. Long policies go unread, and an unread policy protects nobody. The test is whether a new employee could read it in five minutes and know exactly what to do on their first day.

Short does not mean vague. "Use AI responsibly" tells nobody anything. "Never paste customer names, contact details or financial records into any AI tool that is not on the approved list" tells everyone exactly where the line is.

The need is real. According to IBM's 2025 Cost of a Data Breach report, 63% of breached organisations had no AI governance policy or were still developing one. According to Microsoft and LinkedIn's 2024 Work Trend Index, 78% of AI users bring their own tools to work. A policy is how a business catches up with what its staff are already doing.

What is a simple AI policy template?

Here is a one-page template a growing Australian business can adapt. It covers the six sections in plain language, short enough for a noticeboard. Replace the bracketed parts with your own tools, owners and dates, and have it checked against your obligations before you rely on it.

HOW WE USE AI AT [COMPANY]                              Updated: [date]

1. APPROVED TOOLS
   You may use [approved assistant, on our business plan] and the AI
   features in [named tools]. Ask [owner] before using anything else.

2. DATA RULES
   Never put these into any AI tool not on the approved list:
   customer or employee personal details, financial records,
   passwords, or anything marked confidential.
   On approved tools, use only the data the task needs.

3. APPROVAL
   AI may draft, research and summarise. A named person must approve
   anything published, sent to a customer, or that spends money
   before it goes out.

4. ACCOUNTS
   Use company accounts for company work. Do not use personal AI
   accounts for anything involving our customers or our business.

5. OWNERSHIP
   [Name] owns AI decisions: new tools, exceptions and incidents.
   If something goes wrong, tell them the same day.

6. REVIEW
   We review this policy every [three] months, or sooner if our
   tools change.

Two details matter most. The data rules name specific categories rather than abstract principles. In addition, the approval rule separates what AI may do freely from what needs a person, which the guide to human in the loop explains in depth.

How do you roll out an AI policy?

Introduce it in a short session, not an email. Explain why each rule exists, show the approved tools, and give people a place to ask questions. Move everyone onto business accounts at the same time, and name a champion in each team who can help colleagues apply the rules to real work.

A rollout that sticks usually includes:

• A 30-minute kickoff for the whole company, covering what changes and what does not.
• Business accounts set up before the policy takes effect, so following it is easy.
• Team examples: what the rules mean for sales, for marketing, for finance.
• A named owner people can ask, without fear of getting in trouble.

The last point matters. If staff fear punishment for past use of personal accounts, they will hide it. A no-blame start brings existing use into the open, as the guide to shadow AI explains.

How often should you update an AI policy?

Review it every three to six months, and whenever you adopt a new tool or a new kind of AI use. AI tools change quickly, and a policy that names last year's tools or ignores agents that can act on systems soon stops matching reality. Date every version so people know it is current.

Triggers for an early review include a new assistant or plan, AI agents gaining write access to a system, a data incident, or new regulatory guidance.

Skein helps leadership teams set these rules, roll them out and make them stick; the AI leadership page covers the decisions involved. That suits a business where staff already use AI without clear rules. A business in a heavily regulated sector should have its compliance or legal team shape the data rules first.

Frequently asked questions

What should be included in an AI policy?

Cover six things: approved tools, data rules about what may and may not go into AI, approval rules for anything published, sent or spent, the use of company rather than personal accounts, a named owner for AI decisions, and a review date. Keep it to one page so people actually read it.

Does a small business need an AI policy?

Yes. Staff are likely using AI already, often on personal accounts with company data. A one-page policy sets clear limits, protects customer and employee information, and makes safe use easy. IBM found 63% of breached organisations in 2025 lacked an AI governance policy or were still developing one.

Is there an AI policy template for Australian businesses?

This article includes a one-page template aligned with the OAIC's guidance on commercially available AI products and the National AI Centre's six essential practices. Adapt the approved tools, data rules and owners to your business, and check it against your legal obligations before relying on it.

Can employees use ChatGPT at work under an AI policy?

That depends on your policy. Many businesses approve one assistant on a business plan with data controls and ban personal accounts for company work. The OAIC recommends, as best practice, not entering personal information into publicly available generative AI tools, whichever assistant is used.

How often should an AI policy be reviewed?

Every three to six months, and whenever the business adopts a new AI tool, gives AI agents access to systems, has a data incident or sees new regulatory guidance. Date each version so staff know which rules are current, and tell people what changed.

Related reading