Free template
A one-page AI use policy you can sign this week
Three rules: what AI may draft, who approves it before it leaves the building, and what never goes in. Copy it, put your own names in the brackets, done.
The most expensive AI mistake I see in small businesses isn't a hallucination. It's this: someone in the office starts using ChatGPT for emails, it works, nobody writes down what can and can't go in — and six months later a customer's full details are sitting in a free tool's training data.
That's a privacy and confidentiality problem you created by accident — and for clinics or businesses over $3M turnover, a direct Privacy Act problem — that takes one afternoon to prevent.
Why one page
Most AI policies are written for organisations with a compliance function. Yours has an office manager, three people in the field and an apprentice. A twelve-page document drafted by someone's lawyer does not reach the apprentice, and the apprentice is the person at 9pm pasting a customer's address into a free chatbot to write a follow-up message.
One page reaches him. It fits on the wall of the office, it can be read in three minutes at a toolbox meeting, and everyone can sign the bottom of it. That's the whole design brief.
The three lines that do the work
Strip the template back and it's three statements. Everything else is detail hanging off them.
What AI may draft.
A named list of tasks. Not 'use good judgement' — an actual list, because judgement varies and lists don't.
What a person must approve, and who.
A name against each task. Not a role, a name. 'The team checks it' means nobody checks it.
What never goes in.
Customer identifiers, payment details, health information, payroll, anything under an NDA. If you're unsure whether something counts, it counts.
The template
Square brackets are the bits you fill in. It takes about twenty minutes if you already know who your approvers are, and about an hour if deciding that is the actual work — which it usually is.
HOW WE USE AI AT [BUSINESS NAME]
Version 1.0 · Effective [DATE] · Approved by [OWNER NAME]
Review date: [DATE + 6 MONTHS]
WHY THIS EXISTS
AI tools can draft work quickly and save us time. They can also send the wrong
thing to a customer, or leak information we are legally required to protect.
This page says what we do and don't do, so nobody has to guess.
This applies to everyone who works here — employees, contractors and casuals —
and to every AI tool, including free ones.
1. WHAT AI MAY DRAFT
AI may be used to produce a FIRST DRAFT of:
· [e.g. overdue-invoice reminders]
· [e.g. replies to general enquiries]
· [e.g. job notes written up from a voice memo]
· [e.g. quote documents built from our standard rates]
· [e.g. internal summaries, meeting notes, checklists]
If a task is not on this list, ask [OWNER NAME] before using AI for it.
2. WHAT A PERSON MUST APPROVE
Nothing produced by AI reaches a customer, a supplier, the ATO or any government
body until a named person has read it and approved it.
Task Approver
------------------------------------ ----------------------
[Overdue-invoice reminders] [Name, role]
[Enquiry replies] [Name, role]
[Quotes] [Name, role]
[Anything not listed] [OWNER NAME]
Approving means you have actually read it. If you would not put your own name on
it, do not send it.
3. WHAT NEVER GOES IN
Do not put any of the following into an AI tool, ever:
· Customer names, addresses, phone numbers or email addresses, unless the tool
is one of the approved business accounts listed in section 4
· Bank details, credit card numbers, or anything from a payment system
· Tax file numbers, dates of birth, licence or passport numbers
· Payroll figures, individual pay rates, or anything from an employment file
· Medical or health information about anyone
· Anything covered by a confidentiality agreement or an NDA
· Photographs of people who have not agreed to it
If you are not sure whether something counts, it counts. Ask first.
4. WHICH TOOLS WE USE
Approved:
· [Tool name] — [what it's used for] — business account, paid
· [Tool name] — [what it's used for] — business account, paid
Not approved: free or personal AI accounts for any work that involves customer
information. Free accounts can use what you type to train their models. Business
accounts on paid terms generally do not — that is the difference, and it is the
whole reason for this rule.
Nobody may sign up for a new AI tool for work use without asking [OWNER NAME].
5. WHEN SOMETHING GOES WRONG
If AI-generated content goes out with a mistake in it, or if information from
section 3 gets put into a tool by accident:
1. Tell [OWNER NAME] the same day. Not next week.
2. Write down what happened and what was in it.
3. [OWNER NAME] decides whether the customer needs to be told, and whether it
is a notifiable data breach under the Privacy Act.
Nobody gets in trouble for reporting a mistake quickly. People get in trouble
for hiding one.
6. WHAT WE TELL CUSTOMERS
If a customer asks whether we use AI, the answer is yes, and the honest version:
we use it to draft routine paperwork, and a person here checks everything before
it goes out.
We do not use AI to make decisions about people — hiring, performance, or credit.
ACKNOWLEDGEMENT
I have read this page and I understand what I may and may not put into an AI tool.
Name: ____________________ Signed: ____________________ Date: ____________
--
Template from MoreHours · morehours.com.au
Free to copy, edit and use in your own business. It is a starting point, not
legal advice — if your industry has its own rules, check with your adviser.
No email address required, no sign-up. Copy it, put your own names in the brackets, and it's yours.
How to roll it out without a meeting about the meeting
- 1.Fill in the brackets yourself first. Don't workshop it — bring a draft.
- 2.Read it out at whatever meeting you already have. Five minutes, not an agenda item of its own.
- 3.Ask one question: 'is there anything on this list you're already doing?' You want the honest answer now, not at the breach.
- 4.Everyone signs the bottom. Keep the signed copies with your employment records.
- 5.Diary a review in six months. Tools change; the list in section 4 will be wrong by then.
Three ways this goes wrong
Making the owner the approver for everything. It reads as careful and becomes a bottleneck within a fortnight. Then people route around it, and now you have a policy that describes a process nobody follows — which is worse than no policy, because it's evidence you knew.
Banning AI outright. It doesn't stop anyone; it moves it onto personal phones and personal accounts, where you can't see it and the terms of service are worse. A list of what's allowed is a stronger control than a prohibition you can't enforce.
Writing it and never mentioning it again. Section 5 is the one that matters in a bad week. If nobody remembers that mistakes get reported the same day and nobody gets punished for reporting, you'll find out about the problem from the customer instead.
Questions
Do we legally need an AI use policy in Australia?
There's no law that says 'you must have an AI policy'. But if your business is covered by the Privacy Act — including any business turning over more than $3M, or any health service provider of any size holding health records — the Act and the Notifiable Data Breaches scheme apply directly to what your staff put into a tool, and confidentiality obligations apply to everyone else. A policy doesn't create a new obligation — it's how you meet the ones you already have, and it's the first thing anyone will ask to see if something goes wrong.
Is one page really enough?
For a business of five to thirty people, yes — and it's better than twelve pages, because twelve pages don't get read. The apprentice pasting customer details into a free chatbot at 9pm is the person this has to reach. If your industry has specific obligations (health records, financial advice, government contracts), get the one page checked by your adviser rather than replacing it with something nobody opens.
What's the difference between a free AI account and a paid business one?
Terms of service. Consumer accounts commonly allow the provider to use what you type to improve their models. Business and enterprise tiers generally exclude that by contract. That single difference is why section 3 of the template exists — not because free tools are worse at writing, but because of what happens to what you put in them.
Who should be the approver?
Someone whose job already includes checking that kind of work, and who is there most days. For invoice reminders that's usually the office manager or bookkeeper. Don't make the owner the approver for everything — it becomes a bottleneck, and then people start going around it, which is exactly the failure the policy is meant to prevent.
Can we just use this template as-is?
Yes. It's free to copy and edit, no attribution needed and no email address required. It's a starting point rather than legal advice — if you're in a regulated industry, or you're not sure how it interacts with an existing contract or an NDA, have your adviser read it.
The policy is the rule. The system is how it runs.
A policy tells people who approves what. A system puts the draft in front of that person so approving takes ten seconds instead of being a job they postpone. The demo shows the second half: five overdue invoices, five drafts in different tones, and one a person should delete.
Written by Jimmy Yu, who runs MoreHours — simple AI systems for owner-run Australian businesses, where every automation ends with a named person approving the output. Free to copy and use. A starting point, not legal advice.