How to write a staff AI policy for an Australian business or organisation

Summary

This article takes you through writing your organisation’s staff AI policy in four steps: find out what staff already use, decide five things, write those decisions into the template, and roll it out with notice and training. It is one of the Putting AI to Work series for Australian businesses and organisations, and the other articles in the series are mapped below. It is written for small, medium and large organisations alike.

Skip to the AI Policy Development Plan ↓

Background

Develop your policy with these four steps: find out what staff already use, decide five things, write those decisions into a template, then roll it out with notice and training. It takes about a month. While no Australian law requires a business or organisation to have an AI policy,¹ several existing laws do apply the moment staff use AI, and the policy is where you show you have dealt with them.

This piece is about the process. The document itself, a two-page template you can copy, is in A free staff AI policy template for Australian businesses and organisations.

The policy names the tools staff may use today. Where you go from there is three further questions. The first is which new software to bring in and which AI features to switch on in the software you already run, and the rules before any of it writes into a core system. The second is whether the next hire should be a person or AI. The third is what to do over the next six to twelve months.

Checked against the OAIC’s guidance, the Privacy Act and its 2024 amendments, the National AI Centre’s guidance, the workplace surveillance and listening devices Acts of every state and territory, and Fair Work instruments on 18 October 2026, and against the professional bodies, registration boards and courts, the Therapeutic Goods Administration, the Digital Transformation Agency’s Copilot evaluation and the other sources in notes 35 to 66 on 5 November 2026. This covers Australian businesses and organisations of any size that use AI tools bought from a vendor. It is not legal advice, and it names the law so you can check it.

Methodology

A long article made quickly with AI can be slop, and the risk is real. We would rather say how this one was made than have you guess.

1. The questions came first. The issues this article addresses are ones the author has worked through with clients facing them, in his consulting practice.
2. AI did the research and the first draft. Claude Code, running Claude Fable 5.1, read the primary sources and drafted the article to the house standard: every claim tied to a source, and every source opened by a person before the article leaves draft. Where an article says "we read" a document, or all 121 of something, the model read every one of them in full and did the counting; the author checks the method and a sample, not every page.
3. The author did the first review. The author read the draft end to end, cut what did not hold, and edited the body.
4. Other AI tools checked it. A second and third model read each article for errors and for one model's blind spots. This article has not had that check yet.
5. Specialists review it last. Reviewers across technology, law and human resources read the final draft. This article has not had its specialist review yet, and no law firm has reviewed it.

Why use AI at all, given the risk? Because at the rate AI is moving it would be remiss not to use the top frontier models to synthesise the current state of play, so that a business decides from the most up-to-date information there is. Feedback and corrections are welcome, and so are volunteers, law firms among them, who want to make this the best resource available to Australian businesses: write to the editor.

No law requires an AI policy, and the obligations the policy answers are ones you already have

We read the Australian primary sources that bear on a business or organisation using AI: the Privacy Act and its 2024 amendments, the guidance of the Office of the Australian Information Commissioner (OAIC), the federal government’s AI guidance and plan, the next privacy Bill’s consultation papers, the two state workplace surveillance laws, the listening devices law of every state and territory, a NSW safety amendment, Fair Work instruments (the awards and the Fair Work Ombudsman’s guidance) and one professional regulator’s guidance. None requires a business to have an AI policy.¹

This piece does not repeat it. Two points from it shape the policy. The Privacy Act test is turnover, not headcount. It covers a business with annual turnover above $3 million, and some kinds of business whatever their turnover, so the answer to “are we covered” is the policy’s first line.² And the one new obligation, from 10 December 2026, is a passage in the privacy policy describing significant automated decisions, not a requirement to adopt an AI policy.³

The obligations the policy itself answers are these:

Obligation	Who it binds	What it asks, for AI use	Status at 18 October 2026
Privacy Act, Australian Privacy Principle (APP) 1.24	Businesses covered by the Act	Reasonable steps to put in place practices, procedures and systems that ensure you comply with the privacy principles	In force
Privacy Act, APP 85	Businesses covered by the Act	Reasonable steps before disclosing personal information to an overseas recipient, which can include an AI vendor; the OAIC says some arrangements, such as storage the business keeps control of, may be a use rather than a disclosure	In force
Notifiable Data Breaches scheme6	Businesses covered by the Act	Assess a suspected eligible data breach within 30 days	In force
Workplace Surveillance Act 2005 (NSW)7	Employers in NSW	Written notice at least 14 days before computer surveillance starts, and a notified policy on computer surveillance	In force; the detail is in the state table below; current version 28 March 2026 to date
Workplace Privacy Act 2011 (ACT)8	Employers in the ACT	Written notice at least 14 days before surveillance starts, consultation in good faith during that period, and a policy for computer monitoring	In force
Listening devices laws, all eight jurisdictions9	Anyone recording a private conversation, including with an AI note-taker	Rules on recording a conversation you are part of; they differ by state (table below)	In force
Award consultation clauses10	Employers covered by a modern award (the Fair Work Commission’s minimum pay and conditions for an industry or occupation)	Consult staff about major changes in technology likely to significantly affect them; the clause in full	In force

Professions carry their own rules. The Tax Practitioners Board, for one, wants a client’s permission before client information goes into a third-party AI tool. The guidance is summarised in AI regulation in Australia in 2026.¹¹ If staff hold a professional registration, the section on professional sign-off below sets out what each body says.

The policy is the personal layer, and two layers sit above it

A staff AI policy covers one thing, a person using AI in their own role. It is the first of three layers, and a policy that tries to carry all three ends up as the federal template does, written for a governance committee and silent on what a person may do on Monday. This is our model, not a legal test, and the template is written to it.

1. The person. Each person uses AI on their own tasks, drafts and inbox, within the rules. How far they take it is personal, and two people in the same role may differ. That is the policy, and section 1 of the template puts it in writing.
2. The task. When a task the team shares moves onto a tool, it climbs a ladder of its own: tried by one person, then the team’s standard way, then scheduled, then running by itself with a person watching. Each rung is agreed with the team and has a named owner. From the third rung the work has left a role, and the process owner signs off the rules and the spot-checks. The oversight patterns the federal guidance matches to each rung are in the roadmap.
3. The organisation. Roles and teams reorganised around what AI can do: a hire not made, a role that now supervises an automation, a team of three that becomes two. That is a leadership decision, the award’s consultation clause reaches it,¹⁰ and staff hear about it from a manager, not from a policy. Should your next hire be a person or AI covers one role at a time, and the roadmap covers the year.

The template covers the first layer and names the other two, so that nobody reads a personal-use policy as a plan for their job. A business of a few dozen people runs the second layer from its systems map and the third from its roadmap. Neither needs a second policy.

Who to involve: one owner, one approver and the people already using it

The federal Guidance for AI Adoption starts with deciding who is accountable, and asks for one senior leader to own it. Who is accountable when AI makes the decision covers what that means.¹² In a business of a few dozen people that is usually the general manager or operations manager. The owner or a director approves the policy.

Three other groups need a part:

• Staff who already use AI. They know which tools are in use, and on which accounts, before you do. Ask them first.
• Your outside advisers. Your IT provider can tell you what each tool’s administrator can see and switch off. Your accountant or lawyer can tell you whether the Privacy Act covers you.
• The board, if you have one. The Australian Institute of Company Directors’ board summary and checklist for small and not-for-profit organisations, published in June 2026, tells boards to assign accountability for AI oversight to a senior leader.¹³ Our series AI and the board covers what directors owe, what to ask management and the board’s own governance policy.

The five decisions to make before you write anything

A policy is a record of decisions. Make these five and the writing takes an afternoon.

1. Which tools, on which accounts. Decide which tools the business will pay for and require staff to use only those, on business accounts. The vendor’s business terms are what give you the promises on training, storage and retention.

2. What information may go in. Sort your information into categories and decide, for each, which tools it may go into. The OAIC’s line is that personal information, and especially sensitive information, stays out of the free public chatbots. What counts as public, and what the OAIC asks of a business plan, is in AI regulation in Australia in 2026.¹⁴ Check your client contracts for limits on sharing information with third parties.

3. Who checks the output. Decide who reads AI output before it leaves the business, and for which kinds of work. The Guidance for AI Adoption makes maintaining human control one of its six essential practices.¹² Where the work has moved out of anyone’s role and into a system, the check belongs to the named owner of that process. Who signs off when AI makes the decision sets out how.

4. Whether you will monitor use, and whether you will record meetings. Business plans let an administrator see some or all of what staff do. If you will look, the notice rules in NSW and the ACT apply, and the policy has to say so. If you will not, say that. AI note-takers raise the second question. Find your state in the table below and write the rule into the policy.

5. What you tell customers. Decide when customers are told they are dealing with AI. If you are covered by the Privacy Act, your privacy policy should say how you use AI,¹⁴ and from 10 December 2026 it must describe significant automated decisions.³

Three more decisions, about people

The five decisions above are about tools and information. Three more are about the people who will use them, and most policies, the federal template included, skip all three.

6. Whether anyone has to use it. Some staff will not want to use AI, and a few will be against it. The evidence is that adoption is uneven, and much of it is hidden. The federal government’s own trial of Microsoft 365 Copilot across more than 60 agencies in the first half of 2024 found that “only a third of trial participants used Copilot daily”, that “Negative stigmas and ethical concerns associated with generative AI adversely impacted its adoption”, and that some staff “perceived they were being pressured to consent” to having meetings transcribed.¹⁵ Jobs and Skills Australia’s 2025 report says adoption is “accelerating but uneven”, that “A significant portion of employees are using Gen AI tools independently, often without employer oversight”, and that some workers “deliberately avoided using Gen AI due to personal views of the technology”.¹⁶ In the University of Melbourne and KPMG survey published in 2025, 63 per cent of Australian employees said they intentionally use AI at work, 44 per cent had used it in ways that contravene their organisation’s policies, and 42 per cent were concerned about being left behind if they did not use it.¹⁷ A policy that assumes everyone is keen, or that nobody is using it yet, is wrong both ways.

The policy has to say what happens then, and our answer is in section 13 of the template. Nobody is required to use AI for their own work. Help is there for anyone who wants it, on one of their own tasks. A concern goes to a named person or the team meeting and is treated as information, never as a complaint. Disagreement is welcome and goes to the people who can act on it. Two things are not negotiable, the rules in the policy and how colleagues treat each other for using or not using it.

The line between a person’s own work and a task the team has agreed to do with a tool is the boundary with the task layer. A person can decline AI for their own drafts and still work with the output of a team process.

Safe Work Australia’s model code of practice on psychosocial hazards at work lists “not consulting workers”, “providing insufficient training to support changes” and “not allowing for drops in productivity while workers learn new processes” among the marks of poor change management, and “unreasonable or excessive time pressures or role overload” among the job demands that are hazards.¹⁸ A forced roll-out with no support is the situation the code describes. Where a change will significantly affect staff, the award’s consultation clause applies whatever the policy says.¹⁰ Anything harder-edged, a performance or conduct process, belongs to your usual procedures, not to the AI policy.

7. Who pays for the reading. AI makes it cheap to produce a document that would never otherwise have been written, and the cost moves to whoever has to read it. The federal Copilot trial is the only Australian measurement we found. Staff “combed through Copilot’s outputs to verify its accuracy”, in some cases “reading the entire document Copilot produced to check for any errors which significantly reduced any efficiency gains”, and 60 per cent said they had to make “a moderate to significant number of edits” to outputs. The trial also found that “61% of managers in the pulse survey could not confidently identify Copilot outputs”.¹⁵ Treasury’s own evaluation of its part of the trial found that checking “was sometimes more time intensive than creating the output themselves, thereby removing the incentive to use the product as a time saving device”.¹⁹

The same 2025 survey found that 57 per cent of Australian employees had relied on AI output without evaluating its accuracy and 59 per cent had made mistakes in their work because of AI.¹⁷ The burden grows with volume and falls hardest on the person with a duty to review. That is the director who signs the accounts, the engineer or accountant whose name goes on the work, and the manager who approves what leaves the business. AI can help review a document, including one AI wrote, but that does not move the accountability. A named person still signs, and section 14 of the template puts it in writing.

The rule the policy sets is that every document has to justify the reading it asks for. The producer owns the review, writes the summary first, gives the sources, and reads every line. The reader may send back anything too long to review properly. That last part matters as much as the first, because a rule on the writer alone does nothing for the person with the duty.

The courts have reached the same two rules from the other side of the desk. The Federal Circuit and Family Court’s practice direction of 29 May 2026 requires AI-assisted material to be “concise” and to comply with “any rules regarding the length of documents”,²⁰ and the Administrative Review Tribunal’s practice direction of 20 August 2026 says a person “must not rely only on a Generative AI tool to verify that tool’s own output”.²¹

8. What staff get, and what you promise. The benefit to a person is a role that fits in its hours: core work done in less time, finishing on time more often, and more of the week on the work that needs judgement. It is not fewer paid hours, and the policy should not imply it. Under the Clerks award (the modern award for clerical and administrative staff in the private sector) a part-time employee’s agreed hours change only by written agreement, and altered hours are a “significant effect” the consultation clause reaches.¹⁰

Write the aim into the policy (section 16 of the template) and keep the promise out of it. A promise about jobs is a spoken one, made by the owner in person, and only if it is true. For a growing business of a few dozen people that usually means growing with the team it has, with AI taking the routine work off each person, and roles changing as it goes.

If growth stalls, a promise tied to headcount fails while a narrower one, that nobody loses their job because of AI, can still hold. Say the one you can keep. How to decide the split of freed time before anyone’s role changes, and the edges the award sets, are in Should your next hire be a person or AI.

If staff hold a professional sign-off, their regulator’s rules sit on top

Many businesses are built around a signature: the accountant’s, the engineer’s, the solicitor’s, the registered health practitioner’s. AI does not move it. We read what the Australian professional bodies, registration boards and courts had published as at 5 November 2026 on members using AI in work they sign. Nine bodies have told their members something, and every one says the same thing in its own words. The person who signs remains responsible, and checking the output is part of the work. Two of the largest registered professions, engineering and architecture, have no member-facing guidance at all. Their peak bodies have said it to parliament instead. The policy’s answer, section 15 of the template, is one sentence plus a list the policy owner keeps. The professional stays personally responsible, and their body’s and regulator’s standards apply on top.

Profession	Who has spoken, and when	What it says about the person who signs
Registered health practitioners	The Australian Health Practitioner Regulation Agency (Ahpra) and the National Boards, guidance reviewed 22 August 2024, no later revision shown22	“Regardless of what technology is used in providing healthcare the practitioner remains responsible for delivering safe and quality care”; “Practitioners must apply human judgment to any output of AI”; a practitioner using an AI scribe “is responsible for checking the accuracy and relevance of records created using generative AI”
Tax and business activity statement (BAS) agents	Tax Practitioners Board, guidance statement of 22 July 202611	Practitioners “remain accountable for the accuracy of information and advice they provide to their clients”; they “should not rely on AI output as a substitute for their own analysis”; client permission is needed before client information goes into a third-party tool, “depending on how these tools are configured and used”
Accountants	Accounting Professional and Ethical Standards Board (APESB) technical alert, 31 October 2025, on the technology provisions of APES 110 (the accountants’ code of ethics) in force from 1 January 2025;2324 CPA Australia’s AI hub, undated25	“Members remain responsible for the analysis, the underlying professional judgements, and the outcomes of the professional activity”; a member using technology output “shall exercise professional judgement to determine the appropriate steps to take”; CPA: responsibility “remains with the accountant, not the technology”
Auditors	The Auditing and Assurance Standards Board (AUASB), July 2025, a non-authoritative information page26	“AI tools are not a substitute for human judgement”; AI audit tools must be “appropriate and … appropriately implemented, maintained, and used” under the quality management standard
Solicitors and barristers	Joint statement of the Law Society of NSW, the Legal Practice Board of WA and the Victorian Legal Services Board and Commissioner, 6 December 2024;27 Law Society of NSW guide, January 2026;28 Queensland Law Society guidance statement, 31 May 2024;29 NSW Bar guidelines, 19 December 202530	Lawyers “must be able and qualified to personally verify the information” in AI-prepared documents; “Solicitors are responsible for the accuracy of any advice they give, irrespective of where they may have done their research”, and “should not rely on generative AI to verify sources produced by AI”; a barrister “always remains entirely accountable for any legal work based on AI-generated information”
Lawyers before the courts	NSW Supreme Court practice note, in force 3 February 2025;31 Federal Court practice note, 16 April 2026;32 Supreme Court of Victoria practice note, 14 May 202633	The author “must verify … that all citations … (a) exist, (b) are accurate, and (c) are relevant”, and “Such verification must not be solely carried out by using a Gen AI tool”; the responsible person confirms that “legal authorities cited in submissions exist and support the proposition stated”; “Content produced using AI must be verified with meaningful human control”
Migration agents	Office of the Migration Agents Registration Authority, page updated 5 March 202634	An agent who uses AI and gives inaccurate information “remains responsible for that information, regardless of the source”
Engineers	Engineers Australia: no member guidance; the Code of Ethics of August 2022 does not mention AI;35 its submission to the parliamentary AI inquiry, 10 September 2026;36 an AI area of practice in development, 8 October 202637	“AI is an algorithmic tool. It cannot carry legal or professional responsibility. Users and deploying organisations remain liable”; the Code asks members to “be prepared to explain your work and reasoning”
Architects	Australian Institute of Architects submission, 31 August 2026; no registration board guidance found38	“Human professional accountability is non-delegable. No AI tool should be treated as the final decision-maker on any matter requiring human professional judgement, statutory certification, client advice or regulatory sign-off”; and “there is no nationally consistent guidance on how AI use interacts with professional competence, registration, certification, conduct and disciplinary obligations”
Financial advisers	The Australian Securities and Investments Commission (ASIC), Report 798, 29 October 2024; nothing adviser-specific since39	“The regulatory framework for financial services and credit is technology neutral”; licensees “remain responsible for outsourced functions”

The consequences are no longer hypothetical for lawyers. The Victorian regulator varied a solicitor’s practising certificate on 19 August 2025 over AI-generated citations, so that he may no longer practise as a principal or handle trust money,⁴⁰ and the Victorian Court of Appeal said on 5 March 2026 that “It is not acceptable for artificial intelligence to be used by solicitors or barristers in the production of court documents, unless the product of that use is independently and thoroughly verified.”⁴¹ The pattern is the same as section 14 of the template. The signature carries the review, and the review cannot be delegated to the tool that produced the work.

Three things follow for the policy. First, section 15 names the professions in the business and makes the professional’s own standard the floor, so the policy cannot be read as lowering it. Second, the data rules in section 3 are checked against the profession’s confidentiality rule before the policy is adopted. The Tax Practitioners Board’s permission requirement and the lawyers’ rule that what goes into a public tool is in the public domain, set out in Is ChatGPT safe for business, are stricter than a general policy would be.¹¹ Third, the policy owner keeps the current guidance for each profession with the policy and reads it at each review, because most of it is dated 2024 to 2026 and says it will be revised.

Clinical AI is outside this policy, and needs its own. A staff AI policy covers the office. It does not cover software that helps diagnose or treat a patient, which is a different regime. The Therapeutic Goods Administration regulates software by its intended purpose, “not the technology they use”.⁴² A scribe that only records and transcribes a consultation is not a medical device, and one that adds a diagnosis or treatment suggestion is.⁴³ Clinical decision support software is exempt from registration only while, among other conditions, it is “not intended by its manufacturer to replace the clinical judgement of a health professional” and shows the clinician the guidelines, calculations or logic behind each recommendation.⁴⁴ The Australian Commission on Safety and Quality in Health Care’s clinician guide of August 2025 asks a clinician to “recognise your accountability for all AI outputs that inform a clinical decision, finding or documented record”,⁴⁵ and its draft guidance for health services, on the governance side, is out for consultation until 30 November 2026 with a final version due in 2027.⁴⁶ A practice that uses AI in clinical care puts it under its clinical governance framework, not under the office policy, and the template’s section 15 covers it in one bracketed line. That regime is a piece of its own, not a section of this one.

Two jurisdictions regulate monitoring staff, and all eight regulate recording them

An AI tool reaches state law in two ways. The first is monitoring. An administrator console, usage log or data loss prevention tool that records what staff type is “computer surveillance” in NSW⁷ and “data surveillance” in the ACT,⁸ and both jurisdictions require notice before it starts. No other state or territory has a workplace surveillance statute, and the federal government confirmed in April 2026 that regulating workplace surveillance “generally remains within the remit of the states and territories”.⁴⁷ In the other six jurisdictions what stands in its place is indirect. There is the surveillance devices Act, which governs recording and, in Victoria, bans devices in toilets and change rooms, but says nothing about an employer reading its own systems. There is the award’s consultation clause. And there is the Privacy Act, whose employee records exemption takes an employer’s handling of its own staff records outside the privacy principles altogether.⁴⁸ An employer in Brisbane or Perth that monitors staff computers without notice breaks no statute. The policy is the only notice staff get. The second is recording. An AI note-taker that records a meeting or a call is a listening device, and every state and territory has a law on recording a private conversation. The rules on recording a conversation you are part of are not the same from one border to the next.

Jurisdiction	Workplace surveillance law	Notice before monitoring staff computers	Recording a conversation you are part of	Verified against
NSW	Workplace Surveillance Act 2005 (camera, computer, tracking)7	Written notice at least 14 days ahead, email counts (s 10); a notified computer surveillance policy (s 12); covert surveillance is an offence, 50 penalty units (a penalty unit is the fixed sum a jurisdiction sets for fines, $110 in NSW) or $5,500 (s 19)	A participant may record only if all principal parties (the people speaking or spoken to) consent, or if one principal party consents and the recording is reasonably necessary to protect their lawful interests or is not for communicating to non-parties (Surveillance Devices Act 2007, s 7(3)); 100 penalty units or 5 years for an individual, 500 penalty units for a corporation (s 7(1))49	Workplace Surveillance Act: current version 28 March 2026 to date, accessed 19 October 2026; Surveillance Devices Act: version in force from 14 August 2026
Victoria	None. Surveillance Devices Act 1999, Part 2A, bans devices in toilets, washrooms, change rooms and lactation rooms (s 9B)50	No statutory notice requirement found; new laws promised, no Bill found (see below)	A participant may record; a non-participant needs every party’s consent (s 6(1)). Publishing a recording is a separate offence with consent and lawful-interest exceptions (s 11)50	Authorised version 048, as at 10 December 2025
Queensland	None	None found	A participant may record (Invasion of Privacy Act 1971, s 43(2)(a)); a non-participant commits an offence, 40 penalty units or 2 years (s 43(1))51	Reprint current from 1 July 2024
Western Australia	None	None found	A participant may record only if each principal party consents, or where reasonably necessary to protect their lawful interests (Surveillance Devices Act 1998, s 5(3)); penalty $5,000 or 12 months for an individual, $50,000 for a body corporate (s 5(1))52	Compilation 02-g0-00 (the consolidated text with amendments included), current from 5 April 2023
South Australia	None	None found	A participant may record only if all principal parties consent, or where reasonably necessary to protect their lawful interests (Surveillance Devices Act 2016, s 4(2)(a)); penalty $15,000 or 3 years for an individual, $75,000 for a body corporate (s 4(1))53	Version 21.9.2023, read through a text proxy
Tasmania	None	None found	A participant may record only with all principal parties’ consent, to protect lawful interests, or where the recording is not for publication (Listening Devices Act 1991, s 5(3)); 40 penalty units or 2 years, 500 penalty units for a corporation (s 12)54	Authorised version 14 February 2019, listed as current
ACT	Workplace Privacy Act 2011 (data, optical, tracking)8	Written notice at least 14 days ahead with prescribed content (s 13), consultation in good faith for the notice period (s 14), a data surveillance policy stating what is logged and who sees it (s 16); 20 penalty units for a notice breach (s 18), 50 for covert surveillance (s 35)	A participant may record only with each principal party’s consent, to protect lawful interests, or where the recording is not for publication (Listening Devices Act 1992, s 4(3)); 50 penalty units (s 4(1))55	Republications R6 (23 June 2021) and R10 (11 February 2022)
Northern Territory	None	None found	The offence is confined to recording a conversation “to which the person is not a party” without each party’s consent (Surveillance Devices Act 2007, s 11(1)); 250 penalty units or 2 years56	As in force at 1 June 2026

Three things follow for the policy.

If you monitor in NSW or the ACT, the policy is the legal document. In NSW, computer surveillance must be carried out “in accordance with a policy of the employer on computer surveillance of employees at work” that staff were “notified in advance of”, and the written notice must say what kind of surveillance, how, from when, whether it is continuous, and whether it is ongoing.⁷ In the ACT, a data surveillance policy must state how the employer’s computer resources may and must not be used, “what information about the use of the employer’s computer resources is logged and who may access the logged information”, and how compliance is monitored. The notice may itself be in the form of a policy.⁸ The template’s monitoring section is written to be that document. Outside those two jurisdictions we found no statutory notice period, but the award consultation clause still applies, and the policy still has to say what the administrator can see.

If staff record meetings, say so at the start and ask. In NSW, Western Australia, South Australia, Tasmania and the ACT a participant needs every principal party’s consent to record, with narrow exceptions for protecting your own lawful interests. In Victoria, Queensland and the Northern Territory a participant may record, though in Victoria publishing the recording is restricted. Announcing the note-taker and asking is lawful everywhere, costs nothing, and covers a meeting with people dialling in from another state.

Victoria is the one to watch. The Victorian Parliament’s inquiry into workplace surveillance reported on 13 May 2025, and its first recommendation was principles-based, technology-neutral workplace surveillance legislation.⁵⁷ The Victorian Government’s response, tabled 18 November 2025, “supports in principle” that recommendation and the ones that follow it (14 days’ notice, consultation, a written policy), saying it “will consider legislative options” and will weigh “whether amendments to existing legislation would be suitable or if a new stand-alone Act should be introduced”.⁵⁸ The government’s summary page counts 15 recommendations supported in principle and 3 under further review.⁵⁹ On 20 July 2026 the Premier’s office released an election commitment to introduce “the toughest workplace surveillance protection laws in the country”, under which “Employers will have to tell workers if they’re being monitored” and consult before bringing in new surveillance.⁶⁰ No Bill had been introduced as at 19 October 2026.⁶⁰ A Victorian employer that writes its monitoring section to the NSW standard now will not have to rewrite it.

Rolling it out in a business of a few dozen people: a four-week plan

The plan below is for a composite business of a few dozen staff with one office in Sydney, covered by a modern award and using one paid AI assistant. Adjust the timing to your award and your state.

Week	What happens	Who
1	A one-question message to all staff: which AI tools do you use for work, and on which account?	Policy owner
2	The five decisions, made in one meeting; the template filled in; the IT provider confirms what the administrator can see	Owner and approver
3	The draft goes to staff for comment, which also covers the award’s consultation clause; written notice of any monitoring goes to staff by email, at least 14 days before it starts	Policy owner
4	A one-hour session on the policy; everyone signs; personal accounts are closed for work use; the review date goes in the diary	Everyone

Week 1 comes first because the approved list should start from what is already in use. A policy that bans a tool half the team relies on is one they will not follow. Week 3’s notice is the NSW Act’s 14 days. In the ACT the same fortnight is also the consultation period.⁸

The AI Policy Development Plan

Copy the plan below into a document and fill it in as you go. It holds the eight decisions, who made each and when, who was consulted, and the four weeks of the roll-out. The policy itself is in the Staff AI Policy Template, and the plan is what you keep beside it.

What changed

This is version 1.0, first published 16 October 2026 and last updated 5 November 2026. The version moves at a major change, such as a law or a piece of guidance the guide rests on changing; a smaller fix moves the updated date only. Earlier versions are kept from the first major change on.

No changes since first publication.

What we could not confirm

• Whether any of the professional bodies’ guidance has moved since we read it. Ahpra’s page says it “will be updated regularly” and shows no revision since 22 August 2024. The NSW Supreme Court’s practice note was under review from November 2025 with no reissue listed. The APESB says it is reviewing its pronouncements. The Commission on Safety and Quality’s health-service guidance is a draft until 2027. Each is dated in the table so the reader can check.
• Chartered Accountants ANZ. Its site refused every automated reader on 5 November 2026, so the table carries the APESB and CPA Australia and not CA ANZ. We do not claim what it says.
• Any Australian decision on an employee refusing to use an AI tool. We found none in the Fair Work Commission to 5 November 2026. The Commission’s own decisions on AI concern claims prepared with it, not refusal to use it. The no-forced-adoption line in the template is our recommendation, built on the Safe Work code and the consultation clause, not on a ruling.
• An Australian measurement of the review burden in a business. The only Australian measurement of time spent checking AI output is the federal Copilot trial, in the public service. The survey figures are national, not by business size.
• The day of publication of the Melbourne and KPMG study. The PDFs carry only the year. The university’s repository refused automated reading.
• What the Federal Court and the Court of Appeal pages say today. Both sites refuse automated readers. The practice note and the judgment were read in a headless browser (a browser driven by a script, with no screen) and against Internet Archive copies of 14 August 2026 and 5 March 2026, and the quoted words match in both.
• Engineering and architecture registration boards. We found no AI guidance from any state board for either profession, and the Queensland engineers’ board refuses automated reading, so a 2026 change there would not show.

We will re-check this piece on 10 December 2026, when the Privacy Act’s new rules on automated decisions commence, and whenever the next Privacy Act Bill is introduced, a Victorian workplace surveillance Bill is introduced, or a state duty commences. When the law changes, the date at the top of this page changes with it.

Notes

1. The 33 sources are listed under “Sources” below and cited in these notes. The count is of distinct documents opened for this piece; the statement is what we did not find in them, read on 16 and 18 October 2026. The sources added on 5 November 2026 for the people and professions sections (notes 35 to 66) were read for different questions and are not in the count; none of them requires an AI policy either. ↩ ↩

2. OAIC, Small business: “A small business is one with an annual turnover of $3 million or less”, and the list of businesses covered regardless of turnover. Read 18 October 2026. ↩

3. Privacy Act 1988 (Cth), Schedule 1, APP 1.7 to 1.9, as inserted by the 2024 Act, and OAIC, APP Guidelines, Chapter 1, version of 30 September 2026. Read 16 October 2026. ↩ ↩

4. Privacy Act 1988 (Cth), Schedule 1, APP 1.2, compilation 104, read 16 October 2026. ↩

5. Privacy Act 1988 (Cth), Schedule 1, APP 8, and OAIC, APP Guidelines, Chapter 8, version of 3 October 2025, on use versus disclosure. Read 16 October 2026. ↩

6. OAIC, Part 4: Notifiable Data Breach (NDB) Scheme, read 16 October 2026. ↩

7. Workplace Surveillance Act 2005 (NSW), s 3 (definitions of “computer surveillance” and “covert surveillance”), s 10 (notice: 14 days, five stated matters, email counts), s 12 (notified policy) and s 19 (covert surveillance, 50 penalty units). Read 18 October 2026 in the AustLII consolidation as at 28 March 2026, supplied as text because legislation.nsw.gov.au and AustLII refused automated reading. The in-force page, opened in a browser on 19 October 2026, reads “Current version for 28 March 2026 to date”. A NSW penalty unit is $110: Crimes (Sentencing Procedure) Act 1999 (NSW), s 17, read 19 October 2026. ↩ ↩ ↩ ↩

8. Workplace Privacy Act 2011 (ACT), republication R6, effective 23 June 2021: s 11 (meaning of “data surveillance device”: “a device or program capable of being used to record or monitor the input of information into or the output of information from a computer”), s 13 (written notice at least 14 days before surveillance starts, with stated content; a notice “may be in the form of a policy of the employer or otherwise”), s 14 (consultation in good faith for the notice period), s 16 (data surveillance only under a policy that states what is logged and who may access it), s 18 (notice breach, 20 penalty units) and s 35 (covert surveillance, 50 penalty units). Read 18 October 2026. ↩ ↩ ↩ ↩ ↩

9. The eight Acts in the state table, notes 21 to 27 and 34, read 18 and 19 October 2026. ↩

10. Fair Work Ombudsman, Consultation and cooperation in the workplace, and Fair Work Commission, Clerks—Private Sector Award 2020, clause 38 (consultation about major workplace change). Read 16 October 2026. ↩ ↩ ↩ ↩

11. Tax Practitioners Board, TPB(GS) 55/2026 Use of artificial intelligence and the Code of Professional Conduct, 22 July 2026, read 16 October 2026. ↩ ↩ ↩

12. National AI Centre, Guidance for AI Adoption: Foundations, ai.gov.au, read 16 October 2026: “decide who is accountable” and “maintain human control” are among the six essential practices. ↩ ↩

13. Australian Institute of Company Directors, A Director’s Guide to AI Governance, version 2, 29 June 2026, board summary and checklist for small and not-for-profit organisations, read 16 October 2026. ↩

14. OAIC, Guidance on privacy and the use of commercially available AI products, published 21 October 2024, updated 17 January 2025, read 18 October 2026: “the OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools”, and “Businesses should update their privacy policies and notifications with clear and transparent information about their use of AI”. ↩ ↩

15. Digital Transformation Agency, Evaluation of the whole-of-government trial of Microsoft 365 Copilot, published 23 October 2024: executive summary (“Overarching findings”), the productivity chapter (“Copilot’s unpredictability and inaccuracy limited the scale of productivity benefits”), and the summary of evaluation findings, pp 5, 12 and 13. The 60 per cent figure is the Department of Industry’s mid-trial survey as cited by the evaluation. The trial ran from 1 January to 30 June 2024; the evaluation notes its sample was not randomised. Read 5 November 2026. ↩ ↩

16. Jobs and Skills Australia, Our Gen AI Transition: implications for work and skills, 14 August 2025, executive summary (p 9) and section 2.1 (pp 35 to 36). Read 5 November 2026. ↩

17. Gillespie, N., Lockey, S., Ward, T., Macdade, A. and Hassed, G., Trust, attitudes and use of artificial intelligence: a global study 2025, Australia snapshot, The University of Melbourne and KPMG, 2025, p 2; the global report gives the worldwide figures at p 75. The snapshot is an infographic and carries no day of publication; the global report’s appendix (p 111) gives 59 per cent for Australian employees’ use of AI at work in 2024 against the snapshot’s 63 per cent, and the two documents do not say how the measures differ. Read 5 November 2026. ↩ ↩

18. Safe Work Australia, Model Code of Practice: Managing psychosocial hazards at work, July 2022, section 3.1 (p 16, job demands) and Appendix A (p 40, poor organisational change management). The Commonwealth adopted the same wording as the Work Health and Safety (Managing Psychosocial Hazards at Work) Code of Practice 2024, registered 1 November 2024. Read 5 November 2026. ↩

19. Australian Centre for Evaluation, the Treasury, Evaluation of generative artificial intelligence, February 2025, executive summary (p 1) and “Implementation”, point 4 (p 15). Read 5 November 2026. ↩

20. Federal Circuit and Family Court of Australia, Practice Direction PD-AI: Use of generative artificial intelligence, Alstergren CJ, 29 May 2026, paragraphs 4.6 and 4.7. Read 5 November 2026. ↩

21. Administrative Review Tribunal, Practice Direction: Generative AI, 20 August 2026, paragraph 2.4(d) and (f). Read 5 November 2026. ↩

22. Ahpra and the National Boards, Meeting your professional obligations when using Artificial Intelligence in healthcare, page reviewed 22 August 2024, “Accountability”. Read 5 November 2026; the live text matched an Internet Archive copy of 26 August 2024 line for line, and Ahpra’s news list to 29 October 2026 carries no later AI item. ↩

23. Accounting Professional and Ethical Standards Board, Technical Alert: The ethical use of artificial intelligence by professional accountants, 31 October 2025. Read 5 November 2026. ↩

24. Accounting Professional and Ethical Standards Board, Technical Update 2024/1: Technology-related revisions to APES 110, 20 June 2024, paragraphs R220.8 and R320.11 and the transitional provision (Parts 1 to 3 effective 1 January 2025). Read 5 November 2026. ↩

25. CPA Australia, AI hub, “APES 110 and generative AI”, undated page; the latest item it links is dated 1 July 2026. Read 5 November 2026. ↩

26. Auditing and Assurance Standards Board, Impact of AI on Auditors, issued July 2025, “Use of AI tools in audits” and “Important note” (the page says it “is not an authoritative publication of the AUASB”). Read 5 November 2026. ↩

27. Victorian Legal Services Board and Commissioner, with the Law Society of New South Wales and the Legal Practice Board of Western Australia, Statement on the use of artificial intelligence in Australian legal practice, 6 December 2024. Read 5 November 2026. ↩

28. Law Society of New South Wales, A Solicitor’s Guide to Responsible Use of Artificial Intelligence, updated January 2026, “Rule 4: Competence, integrity and honesty”, p 5. Read 5 November 2026. ↩

29. Queensland Law Society, Guidance Statement No. 37: Artificial intelligence in legal practice, published 31 May 2024, sections 2 and 4.4. The PDF version is headed “No. 38”; we use the live page’s number. Read 5 November 2026. ↩

30. New South Wales Bar Association, Guidelines for barristers on the use of generative AI, current as at 19 December 2025, pp 2 to 3. Read 5 November 2026. ↩

31. Supreme Court of New South Wales, Practice Note SC Gen 23: Use of generative artificial intelligence, issued 28 January 2025, commencing 3 February 2025, paragraphs 16 to 18. The Chief Justice invited submissions on a review by 18 December 2025; no reissue was listed as at 5 November 2026. Read 5 November 2026. ↩

32. Federal Court of Australia, Practice Note GPN-AI: Use of generative artificial intelligence, Mortimer CJ, 16 April 2026, paragraphs 4.4, 4.5 and 5.1. The court’s site refused automated readers on 5 November 2026; read in a headless browser and against an Internet Archive copy of 14 August 2026. ↩

33. Supreme Court of Victoria, Practice Note SC Gen 25: Use of artificial intelligence by court users, issued 14 May 2026, paragraphs 6.5, 6.7 and 7.1, replacing the Guidelines for Litigants of May 2024. Read 5 November 2026. ↩

34. Office of the Migration Agents Registration Authority, Use of artificial intelligence, last updated 5 March 2026, “RMAs and the use of AI tools”. Read 5 November 2026. ↩

35. Engineers Australia, Code of Ethics and Guidelines on Professional Conduct, August 2022, clauses 1.2(b), 2.1(b) and 2.3(a); the text contains no reference to artificial intelligence. Read 5 November 2026. ↩

36. Engineers Australia, Submission to the Joint Select Committee on Artificial Intelligence, 10 September 2026, p 3. Read 5 November 2026. ↩

37. Engineers Australia, AI and engineering: what Engineers Australia is doing and what comes next, last updated 8 October 2026. Read 5 November 2026. ↩

38. Australian Institute of Architects, Submission to the Senate inquiry on AI and data centres, 31 August 2026, section 4 and recommendation 2. A search of the NSW Architects Registration Board, the Architects Registration Board of Victoria, the Board of Architects of Queensland and the Architects Accreditation Council of Australia on 5 November 2026 found no AI guidance for practitioners. Read 5 November 2026. ↩

39. ASIC, Report 798: Beware the gap: Governance arrangements in the face of AI innovation, 29 October 2024, pp 33 to 34, “Licensees must consider their existing regulatory obligations”. ASIC’s media releases, speeches and supervisory letters to 30 September 2026 carry nothing specific to financial advisers’ use of AI. Read 5 November 2026. ↩

40. Victorian Legal Services Board and Commissioner, Statement: Mr Dayal matter, 2 September 2025, and Commissioner update, October 2025, 2 October 2025. Read 5 November 2026. ↩

41. Supreme Court of Victoria, Court of Appeal, Oberoi v Douglas [2026] VSCA 31, Walker JA, 5 March 2026, at [50], [52] and [61]. AustLII refused automated readers on 5 November 2026; read in a headless browser and against an Internet Archive copy of 5 March 2026. ↩

42. Therapeutic Goods Administration, Artificial intelligence (AI) and medical device software regulation, last updated 5 February 2026, “When we regulate AI as a medical device”. Read 5 November 2026. ↩

43. Therapeutic Goods Administration, Digital scribes, last updated 16 October 2026, “When digital scribes are not medical devices”. Read 5 November 2026. ↩

44. Therapeutic Goods (Medical Devices) Regulations 2002 (Cth), compilation 73, compilation date 1 November 2026, Schedule 4, Part 2, item 2.15 (clinical decision support system software), as amended from 1 November 2026 by the Therapeutic Goods Legislation Amendment (2026 Measures No. 1) Regulations 2026. Read 5 November 2026. ↩

45. Australian Commission on Safety and Quality in Health Care, AI clinical use guide, version 1.0, August 2025, pp 1 and 4. Read 5 November 2026. ↩

46. Australian Commission on Safety and Quality in Health Care, Consultation: draft Artificial Intelligence Guidance for Health Services, page updated 4 November 2026: consultation open 5 to 30 November 2026, final guidance due in 2027. Read 5 November 2026. ↩

47. Department of Employment and Workplace Relations, Australian Government response to the House of Representatives Standing Committee on Employment, Education and Training report, The Future of Work, March 2026, page last modified 1 April 2026, p 15: “Under the Fair Work Act, workplace surveillance is a non-excluded matter. This means that the power to regulate workplace surveillance matters generally remains within the remit of the states and territories.” Read 18 October 2026. ↩

48. Privacy Act 1988 (Cth), s 7B(3), compilation 104 of 4 June 2026, read in full on 19 October 2026: an employer’s act or practice is exempt “if the act or practice is directly related to: (a) a current or former employment relationship between the employer and the individual; and (b) an employee record held by the organisation and relating to the individual”. ↩

49. Surveillance Devices Act 2007 (NSW), s 7, version in force from 14 August 2026, downloaded from legislation.nsw.gov.au and read in full on 19 October 2026: s 7(1)(b) prohibits using a listening device “to record a private conversation to which the person is a party”; s 7(3) lifts that where “all of the principal parties to the conversation consent, expressly or impliedly”, or where one principal party consents and the recording “is reasonably necessary for the protection of the lawful interests of that principal party” or “is not made for the purpose of communicating or publishing the conversation” to non-parties. The Surveillance Devices Amendment (Public Interest Exceptions) Act 2026 (No 7) inserted ss 14A to 14C and substituted s 63; s 7’s amendment history ends at 2024 No 89, so the 2026 Act does not touch it. ↩

50. Surveillance Devices Act 1999 (Vic), authorised version 048, incorporating amendments as at 10 December 2025: s 6(1) (listening device, “to which the person is not a party, without the express or implied consent of each party”), s 9B(1) (Part 2A, workplace privacy: toilets, washrooms, change rooms and lactation rooms), s 11 (communication or publication of a record), and s 9 (data surveillance devices, law enforcement officers only). Read 18 October 2026. ↩ ↩

51. Invasion of Privacy Act 1971 (Qld), reprint current from 1 July 2024, s 43(1) and (2)(a): the offence “does not apply where the person using the listening device is a party to the private conversation”. Read 18 October 2026. A Google search restricted to legislation.qld.gov.au for “Surveillance Devices”, run in a browser on 19 October 2026, returned no Bill or Act of that name; the Queensland Parliament’s bills pages refuse automated reading. ↩

52. Surveillance Devices Act 1998 (WA), compilation 02-g0-00, current from 5 April 2023, s 5(1) and (3)(c) and (d), and s 6 (optical surveillance devices). Read 18 October 2026. ↩

53. Surveillance Devices Act 2016 (SA), version 21.9.2023, s 4(1) and (2)(a), and s 8(1) (data surveillance devices, consent of the computer’s owner or controller). legislation.sa.gov.au refused direct requests on 18 October 2026; the authorised PDF was read through a text proxy and its version page lists it as current. ↩

54. Listening Devices Act 1991 (Tas), authorised version of 14 February 2019, s 5(1) and (3), and s 12 (penalty). Read 18 October 2026. ↩

55. Listening Devices Act 1992 (ACT), republication R10, effective 11 February 2022, s 4(1) and (3). Read 18 October 2026. ↩

56. Surveillance Devices Act 2007 (NT), as in force at 1 June 2026, s 11(1) (listening devices) and s 12(1) (optical surveillance devices). Read 18 October 2026. ↩

57. Parliament of Victoria, Legislative Assembly Economy and Infrastructure Committee, Inquiry into workplace surveillance: reports: “Committee Final Report, 13 May 2025” and “Response to Final Report, 18 November 2025”. Read 18 October 2026. ↩

58. Victorian Government response, Inquiry into workplace surveillance report, November 2025, recommendations 1 to 4. Read 18 October 2026. ↩

59. Victorian Government, Workplace surveillance, updated 18 November 2025. Read 18 October 2026. ↩

60. Premier of Victoria, Big Tech Must Stop Spying On Workers At Work, media release, 20 July 2026. Read 18 October 2026. A search of Victorian Legislation’s Bills of 2026 for “surveillance”, run in a browser on 19 October 2026, returned four Bills, on outdoor recreation, education, dangerous goods and dangerous goods transport, and none on workplace surveillance. ↩ ↩