A free staff AI policy template for Australian businesses and organisations

Summary

This article gives you a template for your organisation’s staff AI policy. It is three pages that keep the federal government’s structure and add the sections it leaves out. It is one of the Putting AI to Work series for Australian businesses and organisations, and the other articles in the series are mapped below. It is written for small, medium and large organisations alike.

Skip to the Staff AI Policy Template ↓

Background

The federal government publishes a free AI policy template, and it is a sound place to start.¹ It sets up who owns AI in the business, how new uses are approved and when the policy is reviewed. It does not say which tools staff may use, what information may go into them, or what the Privacy Act asks of you.² The template below keeps the federal structure, adds those sections, and fits on about three pages.

This piece is about the staff AI policy document that we recommend you implement. The companion piece, How to write a staff AI policy for an Australian business or organisation, covers how to decide what goes in it, who to involve and what Australian law asks of you.

The template is the personal layer. It covers how each person uses AI in their own role. Two layers sit above it. The first is a shared task moved onto a tool, and the second is roles or teams reorganised around what AI can do. The template names both so staff know they exist, and the companion piece, How to write an AI policy, explains the three layers.

Three pieces pick up where the policy stops. The first is choosing AI software and connecting it to your systems, including who signs off when work moves out of a role and into a system. The second asks whether the next hire should be a person or AI, and the third sets out a six-to-twelve-month AI roadmap. This template is the staff use policy. If you have a board, its own governance policy sits above this one, and A board AI governance policy template explains how the two fit together.

Checked against the National AI Centre’s template, the OAIC’s guidance, the NSW and ACT workplace surveillance Acts and the other primary sources in the notes on 18 October 2026, and against the federal template’s text, the Safe Work code, the Copilot trial evaluation and the professional bodies in notes 20 to 26 on 5 November 2026. This covers Australian businesses and organisations of any size that use AI tools bought from a vendor, not businesses that build or train their own models. It is not legal advice.

Methodology

A long article made quickly with AI can be slop, and the risk is real. We would rather say how this one was made than have you guess.

1. The questions came first. The issues this article addresses are ones the author has worked through with clients facing them, in his consulting practice.
2. AI did the research and the first draft. Claude Code, running Claude Fable 5.1, read the primary sources and drafted the article to the house standard: every claim tied to a source, and every source opened by a person before the article leaves draft. Where an article says "we read" a document, or all 121 of something, the model read every one of them in full and did the counting; the author checks the method and a sample, not every page.
3. The author did the first review. The author read the draft end to end, cut what did not hold, and edited the body.
4. Other AI tools checked it. ChatGPT 6.0 and Gemini read the draft for errors and for one model's blind spots, and their suggestions were taken up where they held against the sources.
5. Specialists review it last. Reviewers across technology, law and human resources read the final draft. This article has not had its specialist review yet, and no law firm has reviewed it.

Why use AI at all, given the risk? Because at the rate AI is moving it would be remiss not to use the top frontier models to synthesise the current state of play, so that a business decides from the most up-to-date information there is. Feedback and corrections are welcome, and so are volunteers, law firms among them, who want to make this the best resource available to Australian businesses: write to the editor.

The federal template covers governance and leaves out the data rules

The National AI Centre (the federal government’s AI adoption body) publishes the AI policy guide and template as an editable Word file, linked from the “Create an AI policy” page on ai.gov.au.¹ The download is marked as published on 22 April 2026, and the file now linked was last modified on 19 June 2026.² It says it “aligns with the government’s Guidance for AI Adoption”, and it tells you to adapt it to your “legal obligations”.² It does not say what those obligations are.

We read the template against sixteen things an Australian business’s or organisation’s AI policy has to decide, drawn from the guidance of the Office of the Australian Information Commissioner (OAIC), the Privacy Act, the federal government’s own AI guidance, state workplace law, the work health and safety code on psychosocial hazards (aspects of how work is organised that can cause psychological harm), and the guidance of the professional bodies whose members sign work off.

What the policy has to decide	In the federal template?2
1. Scope, and who owns the policy	Yes: scope, and an “AI policy owner”
2. Which tools and accounts are approved	In part: an “AI register” of approved systems, but no rule against personal or free accounts
3. What information may go into which tool	No
4. Personal information and the Privacy Act	In part: “privacy” appears twice, the Privacy Act never
5. Client confidentiality and contracts	No
6. Who checks output before it is used	Yes: “human oversight and control”
7. What you tell customers and others	Yes: “transparency and contestability”
8. Monitoring of staff use	No
9. Who owns what the tool produces	No
10. Security of accounts	In part: systems must be “secure and dependable”
11. Training before access	Yes
12. Incidents, breaches and review	Yes, though without the Notifiable Data Breaches scheme
13. Staff who do not want to use AI	No
14. Length, and the reviewer’s time	No: users must oversee “the quality of their outputs”; nothing on the reader
15. Professional sign-off duties, and clinical AI	No
16. What staff get from it	In part: an aim to “engage and empower our staff”, nothing on what that means for a person

That is five in full, four in part and seven not at all. Four of the seven are the ones a business is most likely to get wrong on its first day: staff putting customer details into a free chatbot, client material going into a tool the client’s contract forbids, monitoring staff without telling them, and publishing AI output as its own without knowing who owns it. The other three are about people, and they are the ones a business is most likely to regret leaving out in its first year: staff who would rather not use AI, the time reviewers spend on documents AI made cheap to write, and the professional duties that AI does not move. The federal template does not touch them.

It is written for an organisation with a governance committee

The federal template names six roles: an AI policy owner, policy approvers, a compliance monitor, an AI governance committee, an owner for each AI system, and all employees.² It relies on a set of screening questions and an AI register, which the National AI Centre publishes separately on ai.gov.au.³ That suits a council or a company of several hundred people.

In a business of a few dozen people, those six roles are usually two people. The owner or general manager approves the policy. One named person, often the operations or office manager, owns it, keeps the list of approved tools and fields the questions. The template below is written that way. If your business is approaching 200 staff and has a board, keep the federal roles.

The Staff AI Policy Template

Copy everything in this section into a document and replace each item in square brackets. For [policy owner], write the person’s name and role once, at the top, and use the role title everywhere else. The name is who is accountable today, and the role is what keeps the policy true after they move on. Each numbered section answers the same-numbered row of the table above. Sections 13 to 16 are the people sections. A business of under 20 staff can put them on a single page.

Filling in the sections the federal template leaves out or only touches

Section 3, what information may go in. The OAIC’s guidance recommends keeping personal information, and above all sensitive information, out of free and public AI tools. The quote, and what “publicly available” means, are in AI regulation in Australia in 2026: what applies to your business now.⁴ The table puts that rule where staff will read it.

Section 4, the Privacy Act. Whether the Act covers you is a turnover test, not a headcount, and some kinds of business are covered whatever they earn. AI regulation in Australia in 2026 sets out the test and the list.⁵ Write the answer into the first line of the section. The OAIC’s AI guidance says covered businesses “should update their privacy policies and notifications with clear and transparent information about their use of AI”.⁴ If your tool stores data overseas, write down why you chose it. The Privacy Act’s rules on overseas disclosure are the reason, and choosing AI software treats them as a vendor question.⁶

Section 5, client confidentiality. This depends on your contracts, not on a law. Professions add their own rules, such as the Tax Practitioners Board’s guidance for tax agents, which AI regulation in Australia in 2026 covers.⁷

Section 6, tools that act. The federal Guidance for AI Adoption makes maintaining human control one of its six essential practices.⁸ AI tools on a business plan now connect to email, files and other systems and can send, post or change a record. The line in section 6 is the practical form of that practice. A person approves anything that leaves the business or changes a system, and nobody’s job, pay or health is decided by a tool.

Section 7, recording meetings. AI note-takers record and transcribe, and every state and territory has a law on recording a private conversation. The rules differ by state and are set out in the state-by-state table in How to write a staff AI policy for an Australian business or organisation. The policy’s line is to say so and ask at the start, and that is what satisfies the stricter states.

Section 8, monitoring. How the NSW Act reaches an AI tool’s administrator console is in the next section. The notice rules for NSW and the ACT, both 14 days in writing, are in How to write a staff AI policy for an Australian business or organisation.⁹ If your tool’s administrator can see what staff type, decide whether you will look before you switch it on, and write section 8 before the notice goes out.

Section 12, when something goes wrong. The 30 days in the template is the Notifiable Data Breaches scheme’s period for assessing a suspected eligible data breach (one likely to cause serious harm to the people affected), and the scheme applies to businesses the Privacy Act covers.¹⁰ The federal template asks for incident handling and review without naming the scheme. Run AI incidents through the incident response plan you already have, and if you have none, the handbook’s chapter on incident response plans says what one holds: step-by-step procedures, roles, when to escalate and report, and drills to test it.¹¹ Whoever decides on notification for the AI policy should be the same person who decides it for the cyber policy.

Sections 10 and 11, security and training. The Australian Signals Directorate’s guide for small businesses asks you to review AI vendors’ data handling and privacy policies, and to train staff on secure and responsible AI use.¹² The federal template asks for training. The account security rules are ours, and they are the minimum. An AI tool is a cloud service like any other, and the ASD’s guidance on agentic AI asks organisations to manage AI security inside the cyber security framework they already have, not beside it.¹³ If staff use cloud software on their own devices and nobody’s job is IT, the framework to point section 10 at is the ASD’s Small business cyber security handbook, which covers accounts, access, logging and incident plans and has a chapter on using AI securely.¹¹ If there is an IT function or a managed fleet of devices, it is the Essential Eight, at the maturity level you have chosen, with the handbook’s AI chapter on top, because the Essential Eight names no AI tool.¹⁴ The handbook’s section on AI agents (least access, check what an agent can reach before switching it on, a person over significant changes, permissions reviewed regularly) is the cyber side of section 6.¹¹

Section 1, the layer the policy sits at. The template covers one person using AI in their own role, and states that in its first section, because the two layers above it are decided differently. A shared task moved onto a tool is a team decision with a named owner, and a change to roles or teams is a leadership decision that the consultation clause in your modern award (the Fair Work Commission’s instrument setting minimum pay and conditions for an industry or occupation) reaches. The federal template is written for all three at once. Its scope covers everyone “involved in the development, adoption, management, or use of AI systems”.² The three layers, and why the policy is the first, are set out in How to write a staff AI policy for an Australian business or organisation.

Section 13, staff who are not sure. Some staff will not want to use AI, and a few will say so loudly. The section makes personal use voluntary, gives both groups somewhere to go, and keeps the rules in force for everyone. Safe Work Australia’s model code on psychosocial hazards lists “not consulting workers” and “providing insufficient training to support changes” among the marks of poor change management.¹⁵ The award’s consultation clause applies once a decision will significantly affect staff, as Should your next hire be a person or AI sets out.¹⁶ The federal government’s own trial of Microsoft 365 Copilot found that only a third of participants used it daily and that “Negative stigmas and ethical concerns associated with generative AI adversely impacted its adoption”.¹⁷ The federal template asks every employee to “Complete any required AI training” and says nothing about staff who would rather not use the tools.² The first bracketed choice is a promise about performance assessment. Make it only if the business can keep it. The second is honest for a business that has made a tool standard for some tasks.

Section 14, as short as the decision it supports. The federal template puts the check on the writer: “Users of AI systems are responsible for overseeing the quality of their outputs.”² It says nothing about the reader, and the reader is where the time now goes. In the same trial, staff “combed through Copilot’s outputs to verify its accuracy”, in some cases reading the whole document, “which significantly reduced any efficiency gains”.¹⁷ The section adds the reader’s right to send a document back, which is what protects the person with a duty to review what arrives on their desk.

Section 15, professional duties. Nine Australian professional bodies, boards and courts have told their members how AI bears on work they sign, and each says the person who signs remains responsible and must check the output. The Australian Health Practitioner Regulation Agency (Ahpra) and the National Boards: “Regardless of what technology is used in providing healthcare the practitioner remains responsible for delivering safe and quality care”.¹⁸ The Tax Practitioners Board: practitioners “remain accountable for the accuracy of information and advice they provide to their clients”.⁷ The accounting standards board: “Members remain responsible for the analysis, the underlying professional judgements, and the outcomes of the professional activity”.¹⁹ The legal regulators of NSW, Victoria and WA: lawyers “must be able and qualified to personally verify the information” in AI-prepared documents.²⁰ Engineers Australia and the architects’ institute have said the same to parliament but publish no member guidance. The full table, with the courts’ practice notes and the first sanctions, is in How to write a staff AI policy for an Australian business or organisation. The clinical line is there because the Therapeutic Goods Administration regulates software by its intended purpose, and a scribe (an AI note-taker that writes up a consultation) that adds a diagnosis or treatment suggestion becomes a medical device.²¹ That regime, and the clinical governance that goes with it, is outside a staff policy.

Section 16, the aim. No Australian law tells a business how to share the time AI saves. The edges of the choice (hours changed only by written agreement, award classifications, consultation) are in Should your next hire be a person or AI.¹⁶ The section writes down the aim and what a person gets, and nothing more. A promise that nobody will lose their job to AI is for the owner to say in person, and only if it is true. How to write a staff AI policy for an Australian business or organisation says why it does not belong in the document.

In NSW, an AI tool’s admin console can be “computer surveillance”, and the Act says what to do

The Workplace Surveillance Act 2005 (NSW) regulates three kinds of surveillance of employees at work: camera, computer and tracking.²² “Computer surveillance” is “surveillance by means of software or other equipment that monitors or records the information input or output, or other use, of a computer (including, but not limited to, the sending and receipt of emails and the accessing of Internet websites)”.²² An employee is “at work” at the employer’s workplace, or anywhere else while performing work for the employer, so the Act reaches staff working from home.²³

The Act does not mention AI, and we found no court decision applying it to an AI tool. On its words, these common features fall within the definition:

• An administrator console or audit log that records what staff typed into a tool or what it returned. That is software that “records the information input or output” of a computer.
• A usage dashboard showing who used a tool, when and how much. That records “other use” of a computer.
• Data loss prevention software that scans what staff paste into a browser or a tool and blocks or reports it. That monitors input, and if it blocks a site or tool it also engages the Act’s rule on blocking.
• Browser or endpoint monitoring (software on the laptop or phone itself) that records the AI websites staff visit. That is the “accessing of Internet websites” the definition names.

A tool whose administrator can see only billing and seat counts (how many licences are in use) is a harder case, and we do not claim it either way.

For surveillance within the Act, Part 2 sets four requirements, and surveillance that does not meet them is “covert surveillance”:

• Notice, in writing, 14 days ahead, stating the kind of surveillance, how, from when, whether it is continuous and whether it is ongoing. Email counts, an employee may agree to less, and a new starter is told before day one. The notice rule in full is in How to write a staff AI policy for an Australian business or organisation.²⁴
• A policy staff have been shown. Computer surveillance must follow a policy of the employer on computer surveillance that staff were told about in advance, in a way that makes it reasonable to assume they are aware of it and understand it.²⁵
• Blocking needs a notified policy too. An employer must not block an employee’s email or access to a website except “in accordance with a policy on email and Internet access that has been notified in advance”, and a blocked email needs a “prevented delivery notice” as soon as practicable, with exceptions for spam, malware and offensive content. The maximum penalty is 50 penalty units (a penalty unit is a dollar amount fixed by the state, $110 in NSW, so 50 units is $5,500).²⁶
• The records may only be used for limited purposes. A surveillance record from notified surveillance may be used or disclosed only for “a legitimate purpose related to the employment of employees of the employer or the legitimate business activities or functions of the employer”, for law enforcement, for legal proceedings, or to avert an imminent threat of serious violence or substantial damage to property. The maximum penalty is 20 penalty units.²⁷

Covert surveillance of an employee at work is an offence, 50 penalty units, unless a court has issued a covert surveillance authority.²⁸ “Covert surveillance” is defined as surveillance “not carried out in compliance with the requirements of Part 2”, so switching on an audit log without the notice and the policy is the thing the offence describes, whatever the employer intended.²² Monitoring staff on their own time is also prohibited, with one exception that matters for AI tools. The exception is computer surveillance of an employee’s use of “equipment or resources provided by or at the expense of the employer”, which is the business’s own AI account.²⁹

The Act does not cover listening devices, so an AI note-taker recording a meeting is governed by the NSW Surveillance Devices Act 2007 instead. The state table in How to write a staff AI policy for an Australian business or organisation covers that.²²

So, for a NSW employer, section 8 of the template is the computer surveillance policy that section 12 of the Act requires. Write what the administrator can see, how, from when, whether it is continuous, and whether it is ongoing. Send it by email at least 14 days before anyone looks, keep the acknowledgement, give it to new starters before day one, and use what it shows only for the purposes section 18 of the Act allows. If a data loss prevention tool blocks AI sites, say so in the same policy.

What changed

This is version 1.0, first published 16 October 2026 and last updated 5 November 2026. The version moves at a major change, such as a law or a piece of guidance the guide rests on changing; a smaller fix moves the updated date only. Earlier versions are kept from the first major change on.

No changes since first publication.

What we could not confirm

• When the federal template was last changed, and what changed. The download says it was published on 22 April 2026. The file ai.gov.au links to was last modified on 19 June 2026, and an earlier copy from May 2026 still loads with the same wording. The October 2025 version on industry.gov.au no longer loads. We did not find a change log, and the ai.gov.au page shows no date of its own.
• Whether a court has applied the NSW Act to an AI tool’s audit logs. We read the Act’s definition against the features above ourselves. We found no decision of a NSW court or tribunal applying “computer surveillance” to an AI tool, and the Act does not mention AI.
• Who owns AI-generated output in Australia. We did not research Australian copyright law on AI-generated material for this piece, so it makes no claim about it. Section 9 of the template asks you to check the vendor’s terms instead.
• Whether a business can lawfully require staff to use AI. We did not research the law on directions to employees for this piece, and the template does not require it. Section 13 is our recommendation, built on the Safe Work code and the award’s consultation clause.
• Whether the professional bodies’ guidance has moved since we read it. Each item is dated in the companion piece’s table. Ahpra’s page shows no revision since August 2024 and says it will be updated.

We will re-check this piece every quarter, and on 10 December 2026 when the Privacy Act’s new rules on automated decisions commence. When the federal template or the OAIC’s guidance changes, the date at the top of this page changes with it.

Notes

1. National AI Centre, Create an AI policy, ai.gov.au, read 18 October 2026. The page links the Word file and shows no date of its own; the download is marked “Published 22 April 2026”. ↩ ↩

2. National AI Centre, AI policy guide and template (Word), ai.gov.au, read 18 October 2026. The file’s properties show it created 4 May 2026 and last modified 19 June 2026. Counts in the table are of the file’s text: “privacy” appears twice, “Privacy Act”, “personal information”, “confidential”, “surveillance”, “overseas” and “notifiable” not at all. ↩ ↩ ↩ ↩ ↩ ↩ ↩ ↩

3. National AI Centre, AI systems register and AI screening questions, ai.gov.au, read 16 October 2026. ↩

4. OAIC, Guidance on privacy and the use of commercially available AI products, published 21 October 2024, updated 17 January 2025, read 18 October 2026. ↩ ↩

5. OAIC, Small business, read 18 October 2026. ↩

6. OAIC, APP Guidelines, Chapter 8: APP 8 cross-border disclosure of personal information, version of 3 October 2025, read 16 October 2026. ↩

7. Tax Practitioners Board, TPB(GS) 55/2026 Use of artificial intelligence and the Code of Professional Conduct, 22 July 2026, read 16 October 2026. ↩ ↩

8. National AI Centre, Guidance for AI Adoption: Foundations, ai.gov.au, read 16 October 2026. “Maintain human control” is one of the six essential practices. ↩

9. Workplace Privacy Act 2011 (ACT), republication R6, s 13(1) and (3)(a): an employer may only conduct surveillance of a worker after written notice given at least 14 days before it starts, and s 14: consultation in good faith for the notice period, read 18 October 2026. ↩

10. OAIC, Part 4: Notifiable Data Breach (NDB) Scheme, read 16 October 2026. ↩

11. Australian Signals Directorate, Small business cyber security handbook, cyber.gov.au, 7 October 2026, chapters “Securing accounts and identities”, “Using AI securely in your business” (section “Using AI agents securely in your business”) and “Implement and test cyber security incident response plans”, read 7 November 2026. ↩ ↩ ↩

12. Australian Signals Directorate, Artificial intelligence for small business: managing cyber security risks, cyber.gov.au, 14 January 2026, read 16 October 2026. ↩

13. Australian Signals Directorate, with CISA, NSA, the Canadian Centre for Cyber Security, NCSC-NZ and NCSC-UK, Careful adoption of agentic AI services, cyber.gov.au, 1 May 2026, “AI security as part of cyber security”, read 7 November 2026. ↩

14. Australian Signals Directorate, Essential Eight explained and Essential Eight maturity model, cyber.gov.au, last reviewed 27 November 2023, read 7 November 2026. The pages state no organisation size, and name no AI tool. ↩

15. Safe Work Australia, Model Code of Practice: Managing psychosocial hazards at work, July 2022, Appendix A, p 40 (poor organisational change management). Read 5 November 2026. ↩

16. Fair Work Commission, Clerks—Private Sector Award 2020, consolidated to 1 July 2026, clause 10.3 (part-time hours changed by written agreement) and clause 38 (consultation about major workplace change). Read 5 November 2026. ↩ ↩

17. Digital Transformation Agency, Evaluation of the whole-of-government trial of Microsoft 365 Copilot, 23 October 2024, executive summary and the productivity chapter. Read 5 November 2026. ↩ ↩

18. Ahpra and the National Boards, Meeting your professional obligations when using Artificial Intelligence in healthcare, page reviewed 22 August 2024, “Accountability”. Read 5 November 2026. ↩

19. Accounting Professional and Ethical Standards Board, Technical Alert: The ethical use of artificial intelligence by professional accountants, 31 October 2025. Read 5 November 2026. ↩

20. Victorian Legal Services Board and Commissioner, with the Law Society of New South Wales and the Legal Practice Board of Western Australia, Statement on the use of artificial intelligence in Australian legal practice, 6 December 2024. Read 5 November 2026. ↩

21. Therapeutic Goods Administration, Artificial intelligence (AI) and medical device software regulation, last updated 5 February 2026, “When we regulate AI as a medical device” and the digital scribe example; and Digital scribes, last updated 16 October 2026. Read 5 November 2026. ↩

22. Workplace Surveillance Act 2005 (NSW), s 3, definitions: “surveillance”, “computer surveillance” and “covert surveillance”, and the note that the Act does not apply to surveillance by a listening device (Surveillance Devices Act 2007 (NSW), s 4(3)). Read 18 October 2026 in the AustLII consolidation as at 28 March 2026; legislation.nsw.gov.au and AustLII refused automated reading, so the text was supplied and read by a person. A NSW penalty unit is $110: Crimes (Sentencing Procedure) Act 1999 (NSW), s 17, in-force version downloaded from legislation.nsw.gov.au on 19 October 2026, so 50 penalty units is $5,500. ↩ ↩ ↩ ↩

23. Workplace Surveillance Act 2005 (NSW), s 5, meaning of “at work”, and s 9, application of Part 2. Read 18 October 2026, consolidation as at 28 March 2026. ↩

24. Workplace Surveillance Act 2005 (NSW), s 10, notice of surveillance required: subsections (1) to (5). Read 18 October 2026, consolidation as at 28 March 2026. ↩

25. Workplace Surveillance Act 2005 (NSW), s 12, additional requirements for computer surveillance. Read 18 October 2026, consolidation as at 28 March 2026. ↩

26. Workplace Surveillance Act 2005 (NSW), s 17, restrictions on blocking emails or Internet access. Read 18 October 2026, consolidation as at 28 March 2026. ↩

27. Workplace Surveillance Act 2005 (NSW), s 18, restrictions on use and disclosure of surveillance records. Read 18 October 2026, consolidation as at 28 March 2026. ↩

28. Workplace Surveillance Act 2005 (NSW), s 19, covert surveillance prohibited without covert surveillance authority. Read 18 October 2026, consolidation as at 28 March 2026. ↩

29. Workplace Surveillance Act 2005 (NSW), s 16, prohibition on surveillance using work surveillance device while employee not at work. Read 18 October 2026, consolidation as at 28 March 2026. ↩