AI policy templates

A one-page starting point, not a finished policy. The valuable part is the never list, and that part has to be yours.

The structure every version uses

Approved tools. Which tools, on which account, paid for by whom.
Never goes in. Five specific categories in your own words.
Check before it leaves. What gets reviewed, by whom, on what.
Disclose. To clients, funders, insurers or a court — where applicable.
Ask. A named person, not “management”.
Reviewed. A date, and a trigger for re-reading it.

Four starting variants

For	What's different about it
Professional practice (accounting, legal, conveyancing)	Heavier on verification and client confidentiality terms; explicit exclusion of advice and tax positions.
Clinic (allied health, dental, veterinary)	Privacy-first framing, de-identification method attached, reception and clinician rules separated.
NDIS or care provider	Written for a shift-based casual workforce, attached to induction, with audit evidence in mind.
Field business (trades, cleaning, maintenance)	Short, phone-first, task-framed. Sign-off and certification explicitly unchanged.

How to use one

Take the closest variant, rewrite the never list with the words your business actually uses for the things it holds, name a person, date it, and attach it to induction. That's a real policy. A generic one nobody rewrote is decoration.

Not legal advice

These are operational starting points. Where a disclosure duty, an insurer's requirement or a regulator's practice note is in play, that's a question for your adviser.

Want the written version for your business

An audit and policy engagement produces the real one, and starts by finding out what’s already happening.

What a usable policy looks like

Short. A page, occasionally two. Long policies fail in a specific way: people read the first line, infer the rest, and get the inference wrong.

Before you circulate any policy, check it names

The specific tool and the specific account type
Your own documents in the never list, by the names you use for them
What gets checked before anything leaves, and by whom
One person to ask when something isn't covered
A date, so everyone knows whether they're reading the current one

The two versions that don't work

The one-line ban. "Staff must not use AI tools." Sounds decisive, and it moves every bit of usage onto personal phones where you can't see it. You end up with the same exposure and no record.

The generic six-pager. Downloaded, lightly edited, and it doesn't name a single document your business actually produces. Staff can't tell whether their Tuesday afternoon task is covered, so they decide for themselves — which is the situation the policy was meant to fix.

If you want to go further, the policy module writes the draft in the room with the person who can approve it, and the audit establishes what's actually happening first — because a rule built on a guess is a rule you can't enforce.

Happy to review a draft you've already written. It's usually quicker than starting again.

Start an enquiry

The questions we get asked about this

Can we just adopt this as written?

You can, and it's better than nothing. It won't name your tools, your documents or your approver, which is the part that decides whether a policy gets followed or filed.

Is this legal advice?

No. It's a practical starting draft. Where your obligations turn on professional rules — a practice standard, a regulator's guidance, a court's practice note — those need a qualified review.

Tell us what the business does. If we're the wrong fit we'll say so, and usually we can point you somewhere better.