Skip to content

AI Use Policy Template

Purpose: Establish clear guidelines for safe and responsible AI use in your organisation Audience: All staff, contractors and third parties | Format: Policy document template

How to Use This Template

  1. Copy the policy text below into your document system
  2. Find and replace [Organisation Name] throughout
  3. Customise Section 9 (Roles & Responsibilities) for your structure
  4. Workshop key sections with stakeholders (especially Section 6: Prohibited Use)
  5. Review with legal/compliance team
  6. Obtain executive and legal sign-off
  7. Plan training and communication rollout
  8. Publish and integrate with existing governance documentation

This template provides an AI Use Policy starting point for Australian businesses. It supports selected practices in the Australian Government’s Guidance for AI Adoption (AI6) and VAISS (2024), and references ISO/IEC 42001:2023. Adapt and approve it for your organisation; adoption alone does not establish legal compliance or certification.

AI Use Policy (Template)

Customisation Required

Replace [Organisation Name] and [Insert Date] throughout this template.

Effective date: [Insert Date] Review cycle: [e.g. Annually] Applies to: All employees, contractors and third parties who design, procure, operate, or interact with AI systems on behalf of [Organisation Name].

1. Purpose

This policy governs AI use at [Organisation Name]. It sets expectations for how AI should support organisational goals, protect people and align with applicable laws.

This policy aims to:

  • Support organisational objectives
  • Comply with applicable Australian laws and meet the standards commitments adopted by the organisation
  • Protect privacy, data and intellectual property (IP)
  • Align with the Australian Government's Voluntary AI Safety Standard (VAISS) - 10 Guardrails
  • Use ISO/IEC 42001:2023 to inform the organisation’s AI management arrangements

2. Scope

This policy applies across the organisation wherever AI technologies are developed, purchased, or used. It covers both internal and external use cases, ensuring that all applications of AI are appropriately governed.

In scope:

  • All AI projects, pilots and procurements
  • All AI-generated outputs used for decision-making or external publication
  • Any third-party AI services or APIs integrated into organisational workflows

3. Terms & Definitions

To ensure consistency and clarity, the following definitions apply within this policy:

  • Artificial intelligence (AI): Computer systems that perform tasks normally requiring human intelligence (e.g., text generation, decision support)
  • AI System: Any software, service, or model that uses AI to produce outputs or assist in decisions
  • Human oversight: A designated person must have the authority and ability to review, intervene in and remain accountable for consequential decisions informed by AI
  • Personal Information: Information or opinions about someone who is identified or reasonably identifiable. They can be inaccurate and need not be recorded. Apply the definition in the Privacy Act 1988 (Cth), s 6(1); see the OAIC’s key concepts guidance
  • Intellectual Property (IP): Creations of the mind (trade secrets, code, designs, works) owned or licensed by the organisation
  • High-risk AI Use: Applications that may significantly affect people's rights, safety, or financial position (e.g. HR, medical, or safety-critical systems)

4. Principles

The organisation is committed to using AI in a way that is safe, transparent and aligned with community expectations. All AI systems and services must reflect the following principles:

  • ✓ Have a clear purpose and benefit
  • ✓ Be governed responsibly and accountably
  • ✓ Apply risk controls proportionate to impact
  • ✓ Embed privacy, security, and IP protection by design
  • ✓ Operate safely, reliably and securely
  • ✓ Be tested and evaluated before deployment
  • ✓ Support social and environmental sustainability
  • ✓ Maintain human oversight and contestability
  • ✓ Be transparent and explainable
  • ✓ Be subject to ongoing monitoring and improvement

5. Acceptable Use

AI technologies may be used where they support the organisation's objectives, comply with relevant laws and can be applied responsibly. Acceptable use requires staff to follow the conditions below:

  • ✅ Align AI use with organisational goals and policies
  • ✅ Comply with applicable laws and the organisation’s adopted standards and ethics commitments
  • ✅ Ensure humans remain accountable for significant decisions
  • ✅ Protect personal data and organisational IP
  • ✅ Document purpose, data sources and limitations
  • ✅ Use only approved AI tools and use cases; sensitive workloads require approved data handling and security controls

6. Prohibited Use

To manage risks and maintain compliance, certain uses of AI are not permitted under any circumstances. These restrictions help safeguard the organisation and its stakeholders.

The following are strictly prohibited:

  • ❌ Any illegal activity or violation of Australian law
  • ❌ Automated decision-making without required human oversight
  • ❌ Using unapproved or unvetted AI vendors
  • ❌ Uploading confidential or IP-protected data into public AI tools
  • ❌ Training AI models on datasets without appropriate rights or licences
  • ❌ Providing medical or legal advice via AI under this policy

7. Privacy, Intellectual Property & Data Rights

Respecting privacy and protecting intellectual property is central to responsible AI adoption. AI use must safeguard both personal information and organisational assets, while also respecting the rights of third parties.

The organisation requires that:

  • All AI use follows the organisation’s privacy safeguards and applicable privacy laws, including the Privacy Act 1988 (Cth) where it applies
  • Both personal information and organisational IP are protected at all times
  • Third-party IP rights are respected when using datasets, models, or outputs
  • Copyright or licence status is confirmed before publishing AI-generated content

8. Environmental & Sustainability Considerations

The organisation commits to considering the environmental impact of AI systems:

  • 🌱 Energy consumption of AI models will be monitored
  • 🌱 Preference for energy-efficient AI solutions where feasible
  • 🌱 Regular review of computational resource usage
  • 🌱 Documentation of sustainability measures in AI projects

9. Roles & Responsibilities

Effective governance requires clear accountabilities. Different roles within the organisation carry specific responsibilities for AI oversight and use.

Role Responsibility
Board or executive Provide oversight of AI risk and ensure alignment to strategy
AI Governance Lead Maintain the AI register, policies and guardrail compliance
Project Owners Conduct risk assessments, testing and monitoring
All Staff Complete AI literacy and security awareness training; follow this policy
Procurement Team Ensure AI vendor evaluation follows approved processes
Training Coordinator Schedule and track mandatory AI training completion
Insurance/Legal Review liability and insurance coverage for AI deployments

10. Compliance & Review

Compliance with this policy is mandatory. Breaches will be addressed in line with organisational disciplinary procedures or contractual terms.

This policy will be reviewed at least annually, or sooner if required by law, organisational change, or updates to standards (e.g. ISO/IEC 42001:2023).

This policy is guided by relevant standards and legislation that inform responsible AI practice. These include:

Use the Australian Government’s AI legal-landscape overview as a starting point for identifying relevant laws. Confirm the current law and its application to each use case.

12. Quick Guide – Do's & Don'ts

Quick Reference for Staff

Do:

  • ✅ Use only approved AI systems
  • ✅ Keep sensitive data secure
  • ✅ Double-check AI outputs before sharing externally
  • ✅ Disclose AI use when interacting with customers if relevant
  • ✅ Complete mandatory AI awareness training before using AI tools
  • ✅ Follow approved procurement processes for new AI tools
  • ✅ Consider cross-border data transfer requirements when using cloud-based AI

Don't:

  • ❌ Paste confidential or client data into public AI tools
  • ❌ Rely on AI for consequential decisions without the required human review and accountability
  • ❌ Use unapproved AI vendors or unlicensed data
  • ❌ Assume AI-generated content is automatically free of copyright

Common Scenarios

Every scenario is subject to the approved-tool, approved-use and data-handling conditions in Sections 5–7. A “Yes” does not approve a particular product or account configuration.

Scenario Allowed? Requirements
Using ChatGPT for draft emails ✅ Yes Only if the tool and use are approved; review before sending, no confidential data
Customer data in public AI tools ❌ No Privacy breach risk
AI for research summaries ✅ Yes Fact-check all outputs
Automated hiring decisions ⚠️ With controls Use AI as decision support; an accountable person makes the decision after review, with bias testing and approved controls
AI for code suggestions ✅ Yes Security testing required
Medical/legal advice via AI ❌ No Prohibited under this policy; professional oversight alone does not create an exception

Alignment with Australian Standards

This policy supports selected framework practices when it is adopted, implemented and supported by evidence. Policy wording alone does not establish conformity.

Framework Support

✓ Decide who is accountable — Section 9 assigns responsibilities to the Board, AI Governance Lead and Project Owners

✓ Maintain human control — Sections 3, 5 and 6 require review and accountability for consequential decisions

✓ Share essential information — Sections 4 and 12 set transparency expectations; define who needs which information, when and through which channel during implementation

✓ Guardrail 1 – Accountability and governance — Section 9 assigns governance responsibilities

✓ Guardrail 5 – Human control — Sections 3 and 6 require meaningful oversight and prohibit decisions made without it where required

✓ Guardrail 6 – End-user information — Sections 4 and 12 set expectations for transparency about AI use

✓ Guardrail 3 – System protection and data governance — Section 7 sets privacy and IP requirements; data-quality, provenance and security controls also need implementation

The guardrail labels are shortened summaries. Use the linked references in Section 11 to assess the complete practices and controls.

Next Steps

Where to go from here:

Related templates:

Disclaimer & Licence

Disclaimer: This template provides best practice guidance for Australian organisations. SafeAI-Aus has exercised care in preparation but does not guarantee accuracy, reliability, or completeness. Organisations should adapt to their specific context and may wish to seek advice from legal, governance, or compliance professionals before formal adoption.

Licence: Licensed under Creative Commons Attribution 4.0 (CC BY 4.0). You are free to copy, adapt and redistribute with attribution: "Source: SafeAI-Aus (safeaiaus.org)"