AI policy for small business: what to put in it and how to roll it out

The short answer

An AI policy for a small business is a one or two page document that says which AI tools your team may use, what information must never go into them, who checks the output, and who is accountable. In Australia it should reflect the Privacy Act and the OAIC's AI guidance. Write it around how your staff already use AI, train them on it, then review it every quarter.

Why a small business needs an AI policy now

Your team is almost certainly using AI already. Someone drafts quotes in ChatGPT, someone else summarises emails in Copilot, and a few people use whatever free app is on their phone. None of that is a problem on its own. The problem is that nobody has decided what is allowed, so each person makes up their own rules.

Three things make a written policy worth the hour it takes:

1. Free and personal accounts handle your data differently. On OpenAI's individual plans, chats may be used to train models unless the user switches that off. Anthropic now asks consumer users to choose. Google says some personal Gemini chats are read by human reviewers. The business versions of the same tools (ChatGPT Business, Claude Team, Copilot signed in with a work account, Gemini in Google Workspace) are not used for training by default. Same tool, very different risk.
2. The regulators expect one. The OAIC recommends that businesses set policies for AI use and, as best practice, keep personal information, especially sensitive information, out of publicly available AI tools. The Australian Cyber Security Centre's guide for small business lists establishing policies for how AI tools can be used as its first action.
3. AI gets things wrong. It can invent a clause, a figure or a reference with total confidence. A policy that says "a person checks anything that leaves the building" prevents most of the embarrassing mistakes.

What an AI policy for small business should cover

Keep it short enough that people read it. These seven sections are enough for most businesses with up to about fifty staff:

The National AI Centre's Guidance for AI Adoption is built on six essential practices, starting with "decide who is accountable" and ending with "maintain human control". The government's own AI policy template follows those practices. Our seven sections map onto them, cut down to the size of a business where the owner is also the IT department.

Sample sections and wording

Here is sample wording you can adapt. Replace the bracketed parts. This is a starting point, not legal advice; if you handle health, financial or legal information, have your adviser read the final version.

Approved tools

We use [ChatGPT Business / Microsoft 365 Copilot / Gemini in Google Workspace] signed in with your work account. Do not use personal or free AI accounts for any work that involves client, staff or company information. To use another AI tool, ask [name] first. We keep a list of approved tools and what each is used for.

Information rules

A traffic light makes this easy to remember:

Never enter red information into any AI tool. Amber information may go into an approved tool only after you remove names, addresses and contact details, unless [name] has approved that use.

Checking output

You are responsible for anything you send, whether or not AI helped write it. Check facts, figures, names and dates before anything goes to a client, supplier or regulator. AI must not make final decisions about hiring, pay, pricing for an individual customer or a client's eligibility for a service.

Telling people

If a customer is talking to an AI tool, such as a chatbot or AI receptionist, we tell them. Our privacy policy explains how we use AI with personal information.

Accountability and incidents

[Name] owns this policy and approves new AI tools. If you think information has gone into the wrong tool, tell [name] the same day. You will not be in trouble for reporting it; we need to know quickly so we can fix it.

That last line matters more than any other. People only report mistakes they will not be punished for.

The Australian privacy context in plain English

The Privacy Act does not cover every small business. The OAIC says most businesses under the small business annual turnover threshold are exempt, but the exemption has important exceptions. Health service providers are covered whatever their size, and the OAIC includes allied health practitioners, gyms and child care centres in that group. So are businesses that buy or sell personal information and contractors to the Australian Government, among others. Check the OAIC small business page for your situation.

If you are covered, the OAIC's guidance on commercial AI products is clear on four points:

• Privacy obligations apply to personal information you put into an AI tool, and to personal information that comes out of one.
• As best practice, do not enter personal information, particularly sensitive information, into publicly available generative AI tools.
• Be open about your AI use in your privacy policy and notices, and label public facing AI such as chatbots.
• Choosing an AI product is not "set and forget". Check it suits the job, then keep reviewing, training and monitoring.

There is also a date to note. From 10 December 2026, businesses covered by the Privacy Act must explain in their privacy policy when they use computer programs to make, or substantially help make, decisions that could significantly affect people, and what personal information those programs use. Our Privacy Act 10 December 2026 guide walks through what that means for a small business.

Even if you are exempt, your clients may not be. A client contract that requires you to keep their information confidential applies whether or not the Privacy Act does. Write the policy as if you are covered. It costs nothing extra and it is what your clients will expect.

Rolling it out to staff

A policy in a shared drive changes nothing. Here is a four week rollout that works for a small team:

1. Week 1: find out what people use. Ask every person, with no blame attached, which AI tools they use, on which account, and for what. You will learn more from this than from any template.
2. Week 2: pick the approved tools and write the draft. Choose one business grade tool for the common tasks, ideally one that fits the software you already pay for. Turn on the business settings and remove the need for personal accounts. Our public AI tool selection checklist helps you compare options.
3. Week 3: a thirty minute team session. Walk through the traffic light table with real examples from your business. Show people how to remove names from a client email before using AI on it. Everyone confirms in writing that they have read the policy.
4. Week 4: start the register. Keep a simple list of each AI tool, who uses it, what for, which account type and who approved it. The National AI Centre has a free AI register template if you want a format.

Then put a fifteen minute review in the calendar every quarter, and a proper review once a year or whenever a tool, a vendor's terms or the law changes.

A worked example: a Gold Coast logistics company

Here is an illustrative example, not a real client. A fifteen person freight and warehousing business on the Gold Coast found, during its week one survey, that dispatch staff were pasting customer delivery addresses and phone numbers into a free chatbot to tidy up run sheets. The office manager was using a personal AI account to draft debt collection emails that named customers.

Nobody was doing anything malicious. They were saving time. But client details were sitting in personal accounts with training settings nobody had checked.

The owner already paid for Microsoft 365, so the business approved Copilot Chat signed in with work accounts, which Microsoft covers with enterprise data protection. The traffic light table went on the wall in dispatch. Delivery addresses became amber, so run sheet clean ups moved into the approved tool. Debt collection drafts were rewritten with placeholders, and names went in only at the final step in Outlook. The operations manager owns the policy and reviews it each quarter, alongside the register of tools.

The whole exercise took a few hours across a month. The biggest change was not the document. It was that people now ask before trying a new tool.

What to watch out for

• Settings change. Vendors change defaults, plan names and features often. Recheck the data settings for each approved tool at every quarterly review.
• Personal accounts on work devices. A policy that allows only work accounts needs sign in rules and, ideally, device management to back it up.
• AI inside other software. Your accounting, CRM and practice software may add AI features with their own data terms. Treat them as new tools and add them to the register.
• Who maintains it. If the person who wrote the policy leaves, someone else must own it. Name a role, not just a person.

When to get help

A business with one approved tool and a team that handles no sensitive information can write and run this policy itself in an afternoon, using the sample sections above. It is worth bringing in help when you hold health, financial or legal information, when clients ask about your AI use in tenders or contracts, or when staff need hands on training to use AI safely and well. Our private AI training sessions build the policy and the habits together, using your own tools and your own examples.