AI Acceptable Use Policy Template for Australia

Your staff are already using AI. The question is not whether your organisation uses generative AI tools – it is whether you have told them what they may and may not do with them.

In most Australian organisations we work with, the honest answer is no. Someone in finance is pasting board papers into a public chatbot to summarise them. A developer is debugging production code in a tool nobody approved. Marketing is shipping AI-drafted client emails without review. None of this is malicious – employees will install anything that promises to do their job for them – but it is happening outside any approval workflow, and nobody can say where the data went.

An AI acceptable use policy is the document that closes that gap. This article gives you a complete, copy-paste template written for Australian organisations, explains what each section is doing, shows how the policy maps to ISO 42001 and ISO 27001, and covers the part most templates skip: how to actually enforce it.

What is an AI acceptable use policy?

An AI acceptable use policy (AI AUP) is a short, staff-facing document that defines which AI tools employees may use, what data they may put into them, what they may use the outputs for, and what happens when the rules are broken.

It sits one level below your AI governance framework. The framework assigns accountability and manages risk. The policy is what a new starter reads on day one, and what you point to when someone pastes a client list into an unapproved tool.

A good AI AUP is five to ten pages, written in plain English, and signed by every employee. If yours needs a lawyer to interpret it, it will not be read, and an unread policy protects nobody.

Do small businesses need an AI policy?

Yes – and arguably more urgently than large ones, because there is no IT department quietly blocking unapproved tools in the background.

Three reasons:

The risk does not scale down with headcount. A ten-person firm that pastes customer personal information into a free chatbot has the same data-leak problem as a ten-thousand-person firm. Size changes your budget, not the consequences.
Privacy obligations may apply even to very small businesses. The Privacy Act 1988 (Cth) generally exempts businesses with annual turnover of $3 million or less, but the exemption has holes: it does not apply if you handle health information, trade in personal information, are a contracted service provider to the Commonwealth, or have opted in. Many small businesses are covered without realising it – and removal of the exemption has been flagged for the next tranche of privacy reform.
Your clients are already asking. Enterprise and government buyers increasingly include AI governance questions in vendor assessments. "We have a written policy, here it is" is a much better answer than "we trust our team".

What should an AI acceptable use policy include?

Whether you use our template below or write your own, the building blocks are the same. Every AI acceptable use policy needs the same ten building blocks: purpose and scope, an approved tools register, data handling rules, prohibited uses, human review requirements, transparency and disclosure, incident reporting, a shadow AI request path, consequences for breaches, and a review cadence.

Purpose and scope – why the policy exists and who it covers (employees, contractors, anyone using your data or systems).
An approved tools register – the specific AI tools staff may use, at which tier, with which accounts. Everything not on the register is unapproved by default.
Data handling rules – what may never be entered into an AI tool (personal information, client-confidential material, credentials, unpublished financials) and what is fine.
Prohibited uses – the hard no's: decisions about people without human review, uploading client data to unapproved tools, passing off unreviewed AI output as professional work.
Human review requirements – who checks AI outputs before they are relied on, and for what (accuracy, bias, tone, IP).
Transparency and disclosure – when you must tell clients, candidates or the public that AI was involved, including your incoming Privacy Act transparency obligations.
Incident reporting – what to do when someone pastes the wrong thing into the wrong tool (report it, do not hide it).
Shadow AI handling – how new tools get assessed and added to the register, so staff have a lawful path instead of a quiet workaround.
Consequences – what a breach means, scaled from conversation to termination.
Review cadence – AI tooling moves too fast for a set-and-forget document. Review at least annually, or when you add a material new tool.

The template

Copy the text below into your own document, replace the bracketed placeholders, and adjust the rules to match how your organisation actually works. A policy that describes a fictional version of your business is worse than no policy – it documents that you knew what to do and chose not to.

AI Acceptable Use Policy

[Organisation name]
Version: [x.x] | Approved by: [name, role] | Effective: [date] | Next review: [date, no more than 12 months out]

1. Purpose

This policy sets the rules for using artificial intelligence tools at [Organisation name]. It exists to protect our clients' information, our own information, our reputation, and the people our decisions affect – while still letting you use AI to do your job better.

2. Scope

This policy applies to all employees, contractors, interns and volunteers, and to all AI tools used for work purposes, on any device, whether or not the tool or device is owned by [Organisation name].

3. Definitions

AI tool means any software that uses artificial intelligence or machine learning to generate, analyse or transform content, including chatbots (ChatGPT, Copilot, Gemini, Claude), image generators, transcription services, code assistants and AI features built into other software.
Shadow AI means any AI tool in use that has not been approved under section 4.
Personal information has the meaning given in the Privacy Act 1988 (Cth): information or an opinion about an identified individual, or an individual who is reasonably identifiable.

4. Approved AI tools

You may only use AI tools listed on the Approved AI Tools Register at [location of register], using the account type and plan specified there. Any tool not on the register is unapproved. To request a new tool, contact [role] – requests are assessed within [x] business days.

5. General rules

Use AI tools to draft, summarise, brainstorm, translate, analyse and accelerate your work.
You remain responsible for anything you produce with AI assistance. "The AI wrote it" is not a defence.
AI outputs must be reviewed by a competent person before they are relied on, sent to clients, published, or used in a decision (see section 7).

6. Data handling rules You must not enter the following into any AI tool unless the register entry for that tool explicitly permits it:

Personal information about clients, customers, employees or any other individual
Client-confidential or commercially sensitive information
Passwords, API keys, access tokens or other credentials
Unpublished financial results, legal advice, or material subject to legal privilege
Source code or system designs that reveal our security architecture
Anything subject to a non-disclosure agreement

When in doubt, treat the information as not permitted and ask [role] first.

7. Human review

Before any AI output is used in client deliverables, published content, code shipped to production, or any decision, a person with the relevant expertise must review it for accuracy, bias, currency, tone and intellectual-property risk.

8. Decisions about people

AI must not make or materially shape decisions that significantly affect individuals – including hiring, promotion, discipline, termination, credit, pricing offered to an individual, or access to services – without meaningful human review by a person with authority to change the outcome. [Organisation name] discloses its use of automated decision-making in its privacy policy, as required by Australian Privacy Principles 1.7 to 1.9 from 10 December 2026.

9. Transparency

Where AI has materially contributed to client-facing work, disclose this where a reasonable person would expect it or where a contract requires it. Do not use AI to create content that impersonates a real person, fabricates evidence, or is otherwise deceptive.

10. Incidents

If you believe you have entered information into an AI tool in breach of this policy, report it to [role] within [one business day] so we can assess and contain it. A prompt report will never be punished – a concealed one will be. Suspected eligible data breaches are handled under our data breach response plan and the Notifiable Data Breaches scheme.

11. Breaches of this policy

Breaches may result in removal of AI tool access, formal warnings, or termination for serious or repeated breaches, consistent with our [HR policy]. Contractors may have engagements terminated.

12. Review

This policy is reviewed at least annually, and whenever a material new AI capability is adopted.

Acknowledgement

I have read and understood this policy and agree to comply with it.
Name: ______________ Signature: ______________ Date: ______________

Do you need a separate AI policy for ISO 27001?

No – and you should not create one unnecessarily.

ISO/IEC 27001:2022 does not mention AI by name. It expects your information security controls to cover how information is handled regardless of the tool involved. If staff are feeding information into AI tools, that is an information-handling risk that belongs inside your existing ISMS: reference the AI AUP from your information security policy suite, include AI tools in your asset and supplier registers, and assess AI usage in your risk assessment. One coherent set of documents beats a parallel policy universe.

ISO/IEC 42001:2023 is different. It is the dedicated AI management system standard, and it explicitly expects an AI policy endorsed by top management (clause 5.2), supported by the AI-specific controls in its Annex A. If you are pursuing ISO 42001 certification, an acceptable use policy is a genuine starting point – it covers the staff-facing behaviour layer – but it is not the whole standard. You will still need an AI system inventory, impact assessments, lifecycle controls and the rest of the AIMS.

The practical summary: ISO 27001 – fold the AI AUP into your ISMS. ISO 42001 – the AUP is one artefact among several. Our ISO 42001 vs ISO 27001 comparison walks through the overlap in detail.

How do you actually enforce an AI usage policy?

This is where most organisations stop: an AUP plus an onboarding attestation, and nothing behind it. Paper rules without technical or process backing are shelfware. Enforcement is a stack, not a signature.

Layer	Control	What it catches
Identity	Single sign-on on approved AI tools; disable personal-account use for work	Staff using tools you cannot see or log
Network	Web proxy or DNS filtering that blocks known unapproved AI services	Casual shadow AI use at work
Endpoint	Browser extension or MDM policy limiting AI tool access to managed accounts	Workarounds on work devices
Data	DLP rules on email and file sharing flagging client identifiers, credentials and sensitive terms	The accidental paste before it leaves
Process	New-tool request path with a real SLA (days, not months)	The reason shadow AI exists in the first place
People	Onboarding attestation, annual re-attestation, manager accountability for their teams	"I didn't know" and quiet drift
Review	Quarterly check of the approved register against actual usage and new releases	A register frozen in 2025 while the market moved

Two rules of thumb. First, the request path must be faster than the workaround – if approval takes six weeks, staff will route around it in six minutes. Second, measure something: tools requested, tools approved, incidents reported. An AI policy with zero reported incidents is not a success signal; it is a visibility failure.

The Australian regulatory context

Your AI policy is not operating in a vacuum. The obligations that intersect with it:

Privacy Act 1988 (Cth), APP 11 – you must take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access or disclosure. Pasting personal information into an unapproved offshore AI service sits squarely in this territory.
Automated decision-making transparency (APP 1.7 to 1.9) – from 10 December 2026, your privacy policy must disclose the kinds of personal information used by, and the kinds of decisions made or materially shaped by, computer programs where a decision could reasonably be expected to significantly affect someone's rights or interests. Our guide to the ADM transparency deadline covers the detail.
Statutory tort for serious invasions of privacy – in force since 10 June 2025, covering misuse of information as well as intrusion. Direct litigation exposure, independent of the regulator.
Notifiable Data Breaches scheme – an AI tool leak can be an eligible data breach with mandatory assessment and notification obligations.
Australian Government AI guidance – the Government's Guidance for AI Adoption (October 2025, the first update to the Voluntary AI Safety Standard) sets out expected practices for Australian organisations using AI, and explicitly aligns with AS ISO/IEC 42001:2023. It is voluntary today; treat it as the shape of tomorrow's expectations.
No general AI-specific legislation yet – Australia has not enacted broad AI laws. The National AI Plan (December 2025) keeps AI regulation grounded in existing technology-neutral laws and sector regulators, backed by a new AI Safety Institute. The Privacy Act, consumer law, anti-discrimination law and sector rules are what apply to your AI use right now.

Rollout checklist

Appoint an owner for the policy and the approved tools register.
Run a shadow AI discovery exercise – ask staff anonymously what they actually use. You will be surprised.
Approve a small, sane initial register (two to five tools is plenty).
Adapt the template above; replace every placeholder.
Have leadership sign it first. Policy from the top, not from IT.
Train, then attest: a 30-minute walkthrough beats a PDF in an inbox.
Switch on the technical controls in the enforcement stack.
Diarise the annual review, and re-run discovery before it.

Want a hand with your AI governance?

CyberNinja helps Australian and New Zealand organisations build practical AI governance – from acceptable use policies and AI inventories through to ISO 42001 implementation and certification readiness. Get in touch if you would like to talk through your situation.

This article is general guidance, not legal advice, and reflects the position as at October 2026. Confirm your obligations against the current legislation and, where the stakes warrant it, with your legal advisers.

Sources