AI Policy Template Australia: A Section-by-Section Guide

An AI policy template for Australian organisations: section-by-section wording, data rules, roles, approvals and review, based on NAIC and OAIC guidance.

An AI policy template is only useful if your team can follow the finished policy on a normal Tuesday. It should tell staff which AI tools they can use, what information must never go into them, who signs off riskier uses, when a person has to check the output, and how to report a problem. Most templates online are a one-page list of dos and don'ts. Others are long ethics statements nobody reads. Neither holds up once AI is built into your CRM, your accounting software and your customer chat.

This guide gives you a practical structure you can copy, section by section. For each section we say what to write, show example wording, and point to the Australian source behind it. It follows the National AI Centre's own AI policy guide and template, the Guidance for AI Adoption, the OAIC's privacy guidance, and ISO/IEC 42001. We also cover something most templates skip: who owns the policy once it's written, how to roll it out, and when to review it.

This is general information, not legal or privacy advice. Nothing here is advice for your organisation. Obligations depend on your size, sector, contracts and how you use AI, and they are changing. Everything we state about Australian guidance comes from official pages we read on 3 November 2026, listed under Sources. Check with your own legal or privacy adviser before you adopt a policy.

We work from Burleigh Heads on Queensland's Gold Coast, remotely, with no city offices. We have been building software and AI systems for Australian businesses since 2016.

The short version

• Write two layers, not one. A governance-level AI policy (principles, roles, approvals, review) and a short acceptable-use section for staff (approved tools, data rules, checking output). The second is what people actually read.
• Start from the official template. The National AI Centre (NAIC) published an AI policy guide and template on 22 April 2026, as an editable Word document aligned to its essential AI practices.
• Data rules are the sharp edge. The OAIC says the Privacy Act applies to all uses of AI involving personal information. As a matter of best practice, it recommends not entering personal information, especially sensitive information, into publicly available generative AI tools.
• Name an owner. The Voluntary AI Safety Standard's first guardrail is an accountability process with an overall owner for AI use. It also says leaders cannot delegate or outsource accountability.
• Keep a register. An AI policy without a list of the AI you actually use is guesswork.
• One date for the diary. From 10 December 2026, APP entities must include certain information in their privacy policy where a computer program makes or informs decisions that significantly affect individuals (APP 1.7).
• Review on a schedule and on triggers. Review at least annually, and sooner after an incident, a new tool or a change in the law.

AI policy vs AI acceptable use policy: what you actually need

The search term covers two different documents, and mixing them up is the most common reason a policy fails.

An AI policy (sometimes called an AI governance policy or responsible AI policy) sets the organisation's position. It covers principles, scope, who is accountable, how new uses are approved, how risk is assessed, and how the policy is monitored and reviewed. The audience is leadership, risk and the people who buy or build AI.

An AI acceptable use policy is the staff-facing part. It covers which tools are approved, what data can and cannot go in, when output must be checked, when to tell customers, and how to report a problem. The audience is everyone, and it needs to fit on a page or two.

Small teams can combine both into one document with a short staff section near the front. Larger organisations usually keep the governance policy separate and publish the acceptable-use rules as a standalone page or intranet guide. Whichever you choose, the acceptable-use rules should come from the governance policy, not compete with it.

One more point from the Voluntary AI Safety Standard is worth applying here. It says organisations should only adopt AI policies to fill gaps in existing related policies, such as information security, data management and data privacy, or to add enhancements for the specific characteristics of AI. In practice, that means your AI policy should point to your privacy, security and records policies rather than rewrite them.

What Australian guidance expects a policy to cover

There is no general AI Act in Australia that prescribes a policy format for businesses. The building blocks come from three government sources, plus privacy law (covered below).

The NAIC AI policy guide and template. The NAIC says an AI policy helps you set expectations for staff, support consistent decision-making, show your approach to governance and accountability, make reviews and audits easier, and align AI use with legal and industry obligations. Its template includes core principles, expected behaviours and internal rules, roles and responsibilities, governance and approval points, and guidance for monitoring and review.

The Guidance for AI Adoption. Published on 21 October 2025, it sets out 6 essential practices: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. The Department of Industry says it evolves the Voluntary AI Safety Standard (VAISS) and its 10 guardrails, which remain a useful, more detailed reference.

Australia's AI Ethics Principles. The 8 principles are human, societal and environmental wellbeing; human-centred values; fairness; privacy protection and security; reliability and safety; transparency and explainability; contestability; and accountability. The NAIC template asks organisations to reflect them in how AI is used.

The AI policy template, section by section

Below is the structure we recommend. It follows the NAIC template's order (purpose, scope, policy statements, governance and compliance), with a staff acceptable-use section added because that is where most of the day-to-day questions land. Replace the bracketed text with your own details.

1. Purpose

What to write: two or three sentences on why the policy exists and what it applies to.

Example wording: "This policy sets out how [Organisation] uses artificial intelligence safely, responsibly and in line with our values and legal obligations. It explains what AI may and may not be used for, who is accountable, and how AI use is approved, monitored and reviewed."

Source: NAIC template, Purpose.

2. Scope and definitions

What to write: who the policy covers and what counts as AI. The NAIC template's scope covers employees, volunteers, contractors and board members, and AI developed in-house, supplied by vendors or embedded in other software. That last part matters: AI features inside tools you already pay for are in scope, not just chatbots.

The template also suggests saying what is out of scope so staff are not confused. Its examples include spreadsheet formulas, rule-based "if this, then that" automations and business intelligence dashboards.

Example wording: "This policy applies to all employees, contractors, volunteers and board members of [Organisation]. It covers any AI system we develop, buy, or use through another product, including AI features in existing software. It does not cover [standard spreadsheet formulas, rule-based automations and reporting dashboards]."

Source: NAIC template, Scope.

3. Principles (policy statements)

What to write: a short statement for each principle you commit to. The NAIC template sets out seven policy statements: ethical and human-centred use, clear accountability, risk and impact assessment, quality, reliability and security, fairness and inclusion, transparency and contestability, and human oversight and control.

Keep each one to a sentence or two and make it testable. "We value transparency" is not testable. "We tell customers when they are interacting with an AI system rather than a person" is.

Example wording: "Every AI system we use has a named accountable person before it is adopted. Before a new AI use goes live, we assess its risks and impacts in proportion to how it is used. People can pause, override or switch off AI systems, and we keep a manual alternative for important processes."

Sources: NAIC template, policy statements; Australia's AI Ethics Principles.

4. Acceptable use: approved tools

What to write: where staff find the list of approved AI tools, the rule for unapproved tools, and how to request a new one. Keep the list itself in a register or intranet page so you can update it without re-approving the policy.

Example wording: "Use only AI tools listed in the AI register, through accounts provided by [Organisation]. Do not use personal AI accounts for work information. To request a new tool or feature, submit [the AI use request form] to [AI policy owner]."

Many organisations back this up with technical controls such as single sign-on for approved tools. That is an IT decision. The policy just needs to say that unapproved tools are not to be used for work information.

Source: Guidance for AI Adoption, decide who is accountable; NAIC "before you publish" checklist (what AI can and can't be used for).

5. Acceptable use: data rules

What to write: what information can go into which kind of tool. This is the section staff will look at most, so make it a simple table.

The "not allowed" column for public tools reflects the OAIC's best-practice recommendation not to enter personal information, particularly sensitive information, into publicly available generative AI tools. Adjust the other cells to your tools, contracts and risk appetite.

Source: OAIC guidance on commercially available AI products; NAIC "before you publish" checklist (what data staff can put into tools).

6. Acceptable use: checking output and disclosure

What to write: that people stay responsible for AI-assisted work, and when to tell others AI was involved.

Example wording: "You are responsible for anything you produce with AI. Check AI output for accuracy, bias and suitability before you use or send it. Do not present AI output as verified fact without checking the source. Tell customers when they are interacting with an AI system, such as a chatbot, and follow [the disclosure guide] for AI-generated content."

The OAIC notes that generative AI can produce inaccurate output and links this to the accuracy obligations in APP 10. VAISS guardrail 6 asks organisations to inform end-users about AI-enabled decisions, interactions with AI and AI-generated content, and leaves the right mechanism to the organisation.

Sources: OAIC guidance; VAISS guardrails 5 and 6.

7. Roles and responsibilities

What to write: who does what. The NAIC template lists roles such as an AI policy owner, policy approvers, a compliance monitor, an AI governance committee or authority, AI system owners and all employees. In a small business, one person may hold several of these. What matters is that each role has a name.

The VAISS adds two useful requirements here. Leaders should communicate their commitment to responsible AI across the organisation, and the consequences for acting outside the policy should be documented and communicated.

Sources: NAIC template, governance roles; VAISS guardrail 1.

8. Approving new AI uses

What to write: the steps a new tool or use case goes through before it is used. The NAIC template describes screening each new use case into an outcome, such as normal, elevated or prohibited, which sets the level of risk assessment, oversight and approval it needs.

Example wording: "Before any new AI tool or use is adopted, the requester completes [the AI use request form], covering purpose, data used, who is affected and the proposed owner. [AI policy owner] screens it as normal, elevated or prohibited. Elevated uses need a risk and impact assessment, and a privacy impact assessment where personal information is involved, before approval. Approved uses are added to the AI register."

Treat a use as elevated if it involves personal or sensitive information, makes or informs decisions about people, or produces customer-facing content without review. The OAIC suggests privacy by design, including a privacy impact assessment, before adopting AI products.

Sources: NAIC template, new use case procedures; OAIC guidance.

9. AI register

What to write: that the organisation keeps a register of AI systems, who maintains it, and what it records. VAISS guardrail 9 describes an AI inventory that includes the accountable people, purpose, capabilities and limitations, identified risks and controls, and review dates. A spreadsheet is fine to start.

Source: VAISS guardrail 9; NAIC template, transparency.

10. Incidents and reporting

What to write: what counts as an AI incident, how staff report one, and what happens next. Examples include personal information entered into an unapproved tool, an AI output sent to a customer with a serious error, or a chatbot giving harmful advice. The NAIC template's incident management section includes being able to take a system offline and fall back to a manual process.

Example wording: "Report any AI incident or misuse to [AI policy owner] as soon as you become aware of it, using [channel]. Where personal information may be involved, the incident is also handled under our data breach response plan."

That last sentence links to the Notifiable Data Breaches scheme for organisations covered by the Privacy Act.

Sources: NAIC template, incident management; NAIC "before you publish" checklist (how staff report issues or misuse).

11. Training and acknowledgement

What to write: what training staff get and when. Also include how they confirm they have read the policy. Guardrail 1 of the VAISS includes the training your organisation needs, and the DTA's policy for Commonwealth agencies makes staff training on AI a mandatory requirement. That policy doesn't bind private businesses, but it's a useful benchmark.

Example wording: "All staff complete AI awareness training at induction and when the policy changes, and confirm they have read this policy. AI system owners complete training for the systems they own."

12. Monitoring and review

What to write: how often the policy is reviewed and what triggers an early review. The NAIC template suggests a set review period, with annual as the example, plus ad hoc reviews after an incident, new technology or changes in law. AI tools change faster than most policies, so the register should be reviewed more often than the policy itself.

Example wording: "[AI policy owner] reviews this policy at least every 12 months, and sooner after a significant incident, the adoption of a materially new AI technology, or a relevant change in law or guidance. The AI register is reviewed every [quarter]."

Source: NAIC template, policy review; NAIC "before you publish" checklist (when the policy will be reviewed).

Check it before you publish

The NAIC suggests checking that your policy clearly sets out six things before you finalise it:

1. What AI can and can't be used for.
2. Who approves higher-risk use cases.
3. What data staff can put into tools.
4. When staff need to oversee AI use.
5. How staff should report issues or misuse.
6. When the policy will be reviewed.

If you cannot point to the paragraph that answers each one, the policy is not ready. The NAIC also recommends adapting the template to your values, goals and legal obligations. Match its roles to your existing governance structures, use terms your team already knows, and test the draft with the people who will use and oversee it.

Privacy: the part you cannot skip

The OAIC is direct: the Privacy Act applies to all uses of AI involving personal information. For organisations covered by the Act, three points belong in your policy.

• Data going in. Personal information you put into an AI tool must be used and disclosed in line with APP 6. The OAIC recommends, as best practice, not entering personal information, particularly sensitive information, into publicly available generative AI tools.
• Data coming out. AI output that contains personal information must be reasonably accurate (APP 10) and kept secure (APP 11).
• Not set and forget. The OAIC describes privacy by design, a privacy impact assessment, training and regular review.

The date for the diary. The OAIC announced on 30 September 2026 that from 10 December 2026, APP entities must include information in their privacy policy where they have arranged for a computer program to make, or do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests, using that individual's personal information. APP 1.8 lists what must be included, such as the kinds of personal information used and the kinds of decisions involved. Your AI register is how you find out whether this applies to you.

Many small businesses with annual turnover of $3 million or less are not covered by the Privacy Act, but there are exceptions. Check with the OAIC or your adviser rather than assuming. Even where the Act does not apply, the data rules above are still good practice.

Where ISO/IEC 42001 fits

ISO/IEC 42001:2023, published in December 2023, is the international standard for an AI management system. ISO describes it as the world's first AI management system standard. It sets requirements for establishing, implementing, maintaining and continually improving an AI management system, including the policies and objectives for AI, and uses the Plan-Do-Check-Act cycle.

An AI policy is one input into that system, not the whole thing. If you write the policy using the structure above, you will already have several of the building blocks: an owner, a register, an approval process, an incident process and a review cycle. The VAISS notes that its guardrails align with ISO/IEC 42001:2023 and the US NIST AI Risk Management Framework 1.0.

Whether you need certification depends on your customers, sector and risk. Many organisations start with a policy and register, and only move to a formal management system when a customer or tender asks for it. Our ISO 42001 implementation guide walks through the full process.

Rolling the policy out in 30 days

A policy that sits in a shared drive does nothing. This is a simple rollout sequence for a small or mid-sized organisation.

1. Week 1: inventory. List every AI tool and AI feature in use, including informal ones and personal accounts used for work. Note who uses it, what data it touches and who could own it.
2. Week 1: name the owner. Decide who is the AI policy owner and who approves the policy.
3. Week 2: draft. Adapt the NAIC template using the sections above. Fill in the data rules table and approved tools list from your inventory.
4. Week 2: test. Walk two or three real tasks through the draft with the people who do them. Fix anything that is unclear or unworkable.
5. Week 3: approve and publish. Get sign-off, publish the staff rules where people will find them, and set up the register and request form.
6. Week 3–4: train. Run a short session, collect acknowledgements and nominate a go-to person for questions.
7. Week 4: first check. Review requests, exceptions and incidents from the first weeks, and adjust. Book the first formal review.

Common mistakes

• Copying a template without changing it. A policy that names roles you don't have or tools you don't use tells staff it isn't meant to be followed.
• Banning AI outright. Staff often keep using personal accounts anyway, which is harder to see and manage. Approving safe tools usually reduces risk more than a ban.
• Ignoring embedded AI. AI features inside existing software are in scope. They often touch the most data.
• No owner. If everyone is responsible, nobody updates the register.
• Rewriting other policies. Point to your privacy, security and records policies instead of duplicating them.
• No review date. Tools, contracts and law change. Put the review in the calendar.

Where Adaptive Media helps

We are not lawyers or privacy advisers, and we don't replace them. What we do is help organisations make AI work and keep it governed. In practice, that means:

• Inventory and register. Finding the AI already in use, including features in existing software, and setting up a register people will keep current.
• Policy design. Adapting the NAIC template into a governance policy and a one-page staff guide that fits how you work, for your advisers to review and adopt.
• Ownership. Acting as your fractional Chief AI Officer so the policy has an owner who approves new uses, runs reviews and reports to leadership.
• Readiness and implementation. An AI readiness assessment before you scale, then building and securing the AI systems the policy approves through AI consulting and AI agents.

Frequently asked questions

Is there a free AI policy template in Australia?

Yes. The National AI Centre published an AI policy guide and template on 22 April 2026 as a downloadable Word document. It includes example wording for purpose, scope, policy statements, roles, new use case approval, incident management and review, aligned to the Guidance for AI Adoption.

Is an AI policy a legal requirement for Australian businesses?

There is no general law requiring private businesses to have an AI policy. The Voluntary AI Safety Standard and the Guidance for AI Adoption are voluntary. However, existing laws such as the Privacy Act still apply to how you use AI, and a written policy is one of the most practical ways to show you have thought about them. Commonwealth agencies are a different case and must follow the DTA's policy for the responsible use of AI in government.

What is the difference between an AI policy and an AI acceptable use policy?

An AI policy sets the organisation's principles, roles, approval process, risk assessment and review. An AI acceptable use policy is the staff-facing part: approved tools, data rules, checking output, disclosure and reporting. Small teams can combine both. Larger organisations usually separate them.

Who should own the AI policy?

A named senior person with the authority to approve or stop AI uses. In small and mid-sized businesses this is often the operations lead, COO or a fractional Chief AI Officer. The Voluntary AI Safety Standard says leaders cannot delegate or outsource accountability for the safe and responsible use of AI, even when someone else does the day-to-day work.

How often should an AI policy be reviewed?

The NAIC template suggests a set review period, with annual as its example, plus earlier reviews after an incident, a new technology or a change in law. Many organisations review the AI register more often, such as quarterly, because tools change faster than principles.

What changes on 10 December 2026?

APP entities must include information in their privacy policy where a computer program makes, or does something substantially and directly related to making, a decision that could significantly affect an individual's rights or interests using their personal information (APP 1.7 and 1.8). Your AI register helps you work out whether this applies to you.

Sources

Official pages read on 3 November 2026:

• Create an AI policy and download the AI policy guide and template (National AI Centre)
• Guidance for AI Adoption: implementation guidance (National AI Centre)
• Voluntary AI Safety Standard: the 10 guardrails (Department of Industry, Science and Resources)
• Australia's AI Ethics Principles (Department of Industry, Science and Resources)
• Guidance on privacy and the use of commercially available AI products (OAIC)
• New resources on transparency for use of AI and automated decision-making (OAIC, 30 September 2026)
• Small business (OAIC)
• ISO/IEC 42001:2023 AI management systems (ISO)
• Policy for the responsible use of AI in government, version 2.0 (Digital Transformation Agency)

Related reading

• AI Governance Australia: How Boards and Leaders Set Guardrails in 2026 — the board-level guardrails view
• ISO 42001 in Australia: A Practical Implementation Guide — a formal AI management system, step by step
• AI for Small Business: An Owner's Guide for Australian Teams of 5 to 50 — the general owner's view
• AI for Accountants Australia: Privacy, TPB, Governance — a sector example for accounting practices
• AI for Law Firms Australia: Privacy, Privilege, Governance — a sector example where confidentiality comes first
• What Is a Fractional CAIO? Chief AI Officer Explained — part-time AI leadership
• What Is a Chief AI Officer? The Role Australia Just Made Official — what the role covers
• AI Readiness Assessment Australia — the diagnostic before you build

Next step

Start with the inventory: list every AI tool and AI feature your organisation uses today, including the informal ones, and mark which touch personal or confidential information. That list drives your data rules, your approved tools and your register. If you would like help turning it into a policy your team will follow, with an owner to keep it current, book an AI governance consult and we will talk it through.