Free AI policy template for Australian businesses
An editable AI acceptable use policy, written for Australian organisations. Aligned to the Voluntary AI Safety Standard and the Privacy Act. Enter your details and download the editable template.
A starting template, not legal advice. Have it reviewed against your own obligations before you rely on it.
The regulatory context behind an AI policy
Staff have adopted AI tools faster than most businesses have written rules for them. A written AI policy is how a business closes that gap: it sets out which tools are approved, what data can go into them, and who is accountable when something goes wrong. Without one, AI use tends to happen ad hoc, tool by tool, person by person, with no one able to say what data has gone where.
Australia does not yet have AI-specific legislation for private businesses, but two developments make a written policy a practical necessity rather than a nice-to-have. The federal government's Voluntary AI Safety Standard sets out ten guardrails for organisations deploying AI, including accountability, human oversight, and transparency with people affected by AI-assisted decisions. It is voluntary, but it is the closest thing Australia has to an official reference point for what responsible AI use looks like, and a written policy is a direct way to put several of its guardrails into practice.
The second is the Australian Privacy Act 1988. It does not mention AI tools specifically, but its obligations apply in full to any data staff type into an AI system: if that data includes personal information, the usual rules on collection, use, storage and disclosure still apply, regardless of which tool is handling it. A policy that spells out what can and cannot be entered into AI tools is one of the most direct ways a business demonstrates it is meeting those obligations. From 10 December 2026, businesses that use automated processes in decisions affecting individuals also face a separate disclosure obligation under the Privacy and Other Legislation Amendment Act 2024, which is a public-facing requirement distinct from this internal policy.
None of this requires a legal department. A one to two page policy, reviewed yearly and actually read by staff, covers most of the practical ground for a small or mid-sized business. The template below is built for that scale.
Who needs an AI policy
Any business where staff use AI tools in their work benefits from a written policy. That now covers most small and mid-sized Australian businesses. It is especially relevant if your organisation:
Handles client or personal data
Staff pasting client details, contracts or personal information into AI tools creates a Privacy Act exposure without anyone intending it. A policy sets the boundary in advance.
Has staff already using AI informally
If people are using ChatGPT, Copilot or similar tools without guidance, a policy turns ad hoc use into something the business can account for.
Is growing or onboarding regularly
New starters need a clear answer on day one about which tools are approved and what the rules are, rather than picking it up informally from colleagues.
Works with government or enterprise clients
Procurement processes and larger clients increasingly ask suppliers to demonstrate basic AI governance. A policy is the first artefact most of them expect to see.
How to write your AI policy in five steps
The template is structured so you can adapt it in an afternoon. Work through these five steps, replacing anything in square brackets with your own details.
List your approved tools
Decide which AI tools are approved for work, and for which kinds of data.
Set acceptable and prohibited use
Spell out what staff may do with AI and what is off limits.
Add data and privacy rules
State what can and cannot be entered into AI tools, in line with the Privacy Act.
Require oversight and disclosure
A person reviews AI output in decisions; disclose AI use where it affects individuals.
Assign an owner and review cycle
Name who owns the policy and review it at least yearly.
Eleven sections, ready to edit
A complete AI acceptable use policy you can adapt in an afternoon. It covers every section a small or mid-sized Australian business needs:
- ✓Purpose
- ✓Scope
- ✓Approved tools
- ✓Acceptable use
- ✓Prohibited use
- ✓Data & privacy
- ✓Accuracy & oversight
- ✓Transparency & disclosure
- ✓Security
- ✓Training
- ✓Review cycle
A policy is step one
A document on its own does not change behaviour. The businesses that get AI right pair the policy with a quick look at how staff actually use AI today, and training so the rules make sense in practice.
- •AI usage review. See how AI is really being used across your team, and where the risks are.
- •AI literacy training. Give everyone the shared understanding behind the policy.
- •AI governance, field notes. Our research on AI governance for Australian organisations.
Frequently asked questions
Yes, it is free. Enter your name and email to unlock the download. It is provided by VibeZero as a starting point, not legal advice, so have it reviewed against your obligations before relying on it.
Yes. It is written for Australian organisations and references the Australian Privacy Act and the Voluntary AI Safety Standard. It suits small and mid-sized businesses, not-for-profits and similar teams.
At minimum: approved tools, acceptable and prohibited use, data and privacy rules, accuracy and human oversight, transparency and disclosure, security, training, and a review cycle. This template covers all of these.
Many businesses adapt it themselves. If you want it tailored, paired with an AI usage review, or rolled out with staff training, we can help. The template is the starting point, not the whole job.
Not directly, in most cases. The Voluntary AI Safety Standard is voluntary, as the name says, and the Privacy Act does not name AI policies specifically. But if your business handles personal information through AI tools, the Privacy Act's existing obligations still apply to that handling, and a written policy is the practical way to show you have thought about it. Some sectors and government contracts also set their own expectations, so check whether a specific obligation applies to you.
This AI policy is an internal governance document: it tells staff what they can and cannot do with AI. The ADM (automated decision-making) disclosure is a public-facing statement in your privacy policy, required from 10 December 2026, that tells individuals where automated processes affect decisions about them. Businesses using AI in decisions about customers or staff may need both. See the free ADM disclosure template if that applies to you.
Name a single owner, even in a small business. It is often whoever already owns IT, privacy or operations. Their job is to keep the approved tools list current, field questions from staff, and run the review at least yearly. Without a named owner, the policy tends to go stale within a year of being written.