If your team uses ChatGPT, Copilot, Gemini or Claude, you already have AI in your business. Here is a one-page policy you can adapt this week, the settings that make it real, and how to introduce it.
The short answer
A small business AI policy can fit on one page. It should say which AI tools and accounts staff may use, what must never go into them, when a person has to check the output, who to ask, and what to do if something goes wrong. Start by asking your team what they already use, then adapt the one-page AI policy template below. For a fuller version, the National AI Centre publishes an official template you can download.
If people in your business use ChatGPT, Copilot, Gemini or Claude, you already have AI in your business, whether or not anyone approved it. The National AI Centre puts it plainly: “it’s likely that some of your staff are already using AI at work without you knowing.” A short policy does not need to stop that. It needs to make the safe way the easy way.
What a small business AI policy needs to cover
The National AI Centre’s guidance on creating an AI policy says: “If your organisation uses AI, have a clear policy that explains how it can be used, who’s responsible and what rules people need to follow.” For a team of five to twenty people, that comes down to six questions:
- Which tools and accounts are approved? Including whether people use a business account or a personal one.
- What must never go in? Customer details, health information, financial numbers, passwords and confidential documents.
- When must a person check the output? Anything sent to a customer, published or relied on for a decision.
- When do we tell people AI is involved? For example, a chatbot on your website.
- Who do I ask? One named person.
- What happens if something goes wrong? Who to tell, and how quickly.
The government’s own template goes further, with roles such as a governance committee, policy approvers and a compliance monitor, plus a register of every AI system. That suits larger organisations. Most small businesses can start with the one-page version below and grow into the rest.
Before you write it: ask what people already use
“Shadow AI” is the term for staff using AI tools for work outside any approved approach. The National AI Centre’s page on managing unapproved AI use describes it as “often a signal of unmet need, time pressure, or curiosity from early adopters”, and says “people need to feel safe to disclose their use of AI.”
So start with a conversation, not a ban. Ask three questions, in a team meeting or a short form, and make it clear nobody is in trouble for their answers:
1. Which AI tools have you used for work in the last month, and is that on a personal or business account?
2. What do you use them for? (For example: drafting emails, summarising documents, writing quotes, social media posts.)
3. Is there anything you’ve wondered whether you’re allowed to put into an AI tool?
The answers tell you which tools to approve, which tasks to write rules for, and where people are unsure. They also often turn up good uses worth sharing with the rest of the team.
A one-page AI policy template
Copy this into a document, replace the bracketed parts and delete anything that does not apply. Keep the language your team already uses.
[Business name] AI policy
Version date: [date]. Policy contact: [name].
Purpose
AI tools can save us time on writing, summarising and admin. This policy explains how to use them safely, so we protect our customers’ information and stand behind everything we send.
Approved tools and accounts
You may use these AI tools for work: [tool, plan and account type, for example “Microsoft 365 Copilot through your work account”].
Use your business account for work, not a personal account. If you want to try a new AI tool for work, ask [name] first.
Never put into an AI tool
• Customers’ personal details (names, addresses, phone numbers, emails) unless the tool and account are approved for it.
• Health information, or anything about someone’s medical, financial or personal situation.
• Bank details, card numbers, tax file numbers or ID documents.
• Passwords, access codes or login details.
• Confidential client documents, or anything covered by a confidentiality agreement.
If you need AI help with a message that contains these, remove or replace the details first.
Always check before it goes out
A person must read and check AI-assisted work before it is sent or published, especially anything that goes to a customer, includes prices, dates or quantities, or makes a legal, financial, health or safety statement. You are responsible for anything you send, however it was drafted.
Be open about AI
If customers talk to an AI tool, such as a website chatbot or phone assistant, it must say it is an AI. Do not present AI output as your professional opinion unless you have checked it and agree with it.
If something goes wrong
If you think something was put into an AI tool that should not have been, or an AI-assisted message was wrong, tell [name] the same day. Note what was entered or sent, which tool, and when. Nobody will be in trouble for reporting it quickly.
Review
We will review this policy every 12 months, and sooner if we start using a new AI tool, something goes wrong, or the law changes.
How it changes between businesses
The structure stays the same, but the details change with the information you handle. Two fictional examples, invented for this article:
| Corella Bay Plumbing, 8 staff | Tarrawarra Physio, 12 staff | |
|---|---|---|
| Approved tools | One business AI assistant for quote wording, job summaries and emails | One business AI assistant for admin and marketing only; nothing clinical without a separate review |
| Extra “never put in” items | Customer addresses with access instructions, such as key safe codes or gate codes | Any patient health information, treatment notes, referral letters or Medicare and health fund details |
| Always check | Prices, compliance statements and anything about warranties | Anything patient-facing, and all marketing, against the rules for health advertising |
| Policy contact | Office manager | Practice manager |
Regulated professions, such as health practitioners, lawyers, accountants and financial advisers, may have extra rules from their regulator or professional body about AI, confidentiality and advertising. Check those before you finalise your policy.
The ten-minute settings check
A policy only works if the tools are set up to match it. The Australian Cyber Security Centre’s guide to AI for small business notes that whether your data is used to train AI depends on the product’s settings and your subscription. For each approved tool:
- Confirm the account type. Business and work plans usually come with different data commitments from free or personal plans.
- Check the data and training settings. What the main providers say for their business plans, checked on 29 October 2026:
- Microsoft says, for Microsoft 365 Copilot with enterprise data protection: “Your data isn’t used to train foundation models.”
- Google says, for Gemini in Google Workspace: “Your content is not human reviewed or otherwise used for Generative AI model training outside your domain without permission.”
- OpenAI says, for ChatGPT Business, Enterprise and its API: “We do not train our models on your data by default.”
- Anthropic says, for Claude’s commercial products such as Claude for Work and its API, that by default it will not use inputs or outputs to train its models. Its consumer plans work differently.
- Check sharing. Who in the business can see shared chats, projects or uploaded files?
- Check history and retention. How long are chats kept, and who can delete them?
- Turn on multi-factor authentication for every AI account.
- Remove access for people who have left. Add AI accounts to your offboarding checklist.
How this lines up with the government’s guidance
The Australian Government’s essential AI practices are six practices for responsible AI use. The one-page policy covers a small-business version of each.
| Essential practice | Where it shows up in the one-page policy |
|---|---|
| 1. Decide who is accountable | A named policy contact; each person is responsible for what they send |
| 2. Understand impacts and plan accordingly | The staff conversation before writing; the extra rules for sensitive information |
| 3. Measure and manage risks | The “never put in” list and the settings check |
| 4. Share essential information | Telling customers when they are dealing with an AI tool |
| 5. Test and monitor | Checking output before it goes out; the review date |
| 6. Maintain human control | A person checks and owns anything sent, published or decided |
If your business grows into more serious AI use, such as tools that help decide things about customers or staff, the government’s fuller guidance and the official AI policy template are the next step.
Where privacy law fits
The OAIC’s guidance on using commercially available AI products says that, as a matter of best practice, organisations should not enter personal information, particularly sensitive information, into publicly available generative AI tools. It also says businesses should update their privacy policies and notifications about their use of AI, “including ensuring that any public facing AI tools (such as chatbots) are clearly identified as such”.
Your AI policy is the internal side of that. Your privacy policy is the public side. If AI tools help you make decisions about people, such as approving applications or prioritising customers, new privacy policy requirements start on 10 December 2026. Our guide to automated decisions and privacy policies explains what to add.
Rolling it out
- Share it in a team meeting, not just by email. Walk through two real examples from your business: one task that is fine, and one that needs details removed first.
- Show people how to remove details. Our guide to what to remove before pasting customer messages into AI has a simple keep, swap or never-paste table.
- Show people how to check output. Our two-minute check for AI-drafted replies works for most customer messages.
- Put it where people will find it, such as a shared drive or your staff handbook, and add it to new staff onboarding.
- Ask for questions after a month. The National AI Centre suggests testing the draft “with the people who will use, review or oversee it”. Their questions show you what to clarify.
If you want help choosing tools, setting them up properly or building AI into your workflows, that is part of the AI implementation work AppliedAgents does. Many businesses only need the one-page policy and the settings check above.
Sources
- National AI Centre, Create an AI policy and AI policy guide and template
- National AI Centre, Manage unapproved AI use
- Australian Government, Essential AI practices
- OAIC, Guidance on privacy and the use of commercially available AI products
- Australian Cyber Security Centre, Artificial intelligence for small business
- Microsoft, Enterprise data protection in Microsoft 365 Copilot; Google, Generative AI in Google Workspace privacy hub; OpenAI, Enterprise privacy; Anthropic, Is my data used for model training?
This article is general information, not legal advice. Using a template does not by itself make a business compliant with any law. The guidance and vendor statements above were checked on 29 October 2026 and can change. Corella Bay Plumbing and Tarrawarra Physio are fictional.
Practical thinking on AI, automation and the work behind a business.
