Writing your team's AI policy
One page, in your words, that answers which tools, which tier, which data and who to ask. Long policies get filed. Short ones get followed.
What it has to answer
- Which tools are approved, and on which account or tier.
- What never goes in, listed specifically for this business.
- What must be checked before anything leaves the building, and by whom.
- What has to be disclosed — to clients, funders, insurers or a court.
- Who to ask when the answer isn't obvious, by name.
Why most policies fail
Two reasons. They're written for office staff on laptops, so they mean nothing to someone on a shift with a phone. And they ban rather than direct, which produces exactly the unreported use the policy was meant to prevent.
A policy that says “no AI tools” in a business where six people are already using them has made the problem invisible rather than smaller. A rule that says which account to use, and for what, gets followed and can be improved.
Making it hold across a casual workforce
- Written at the reading level of the newest casual, not the operations manager.
- Attached to induction, not to a shared drive nobody opens.
- Framed around the tasks people actually do on shift.
- Reviewed when the tools change, with a visible date on it.
Insurers and funders will ask
Professional indemnity insurers, NDIS auditors and some funders now ask whether a written AI policy exists. Having one that matches what staff actually do is a different answer from having one that doesn't.
Getting one written
There are starting templates here for free. For a firm where the real question is current exposure rather than future rules, an audit and policy engagement is the usual first step instead of training.
What this module covers
Writing the rule, in the room, with the person who can approve it present. Not a template to take away and adapt — a draft that exists by the end of the session.
A policy people actually follow answers four things
- Which tool and which account, named rather than described
- What never goes in, in the terms of your own documents
- What gets checked before it leaves the building, and by whom
- Who to ask when something isn't covered — a name, not a process
We also cover the two failure modes: the one-line prohibition that moves all the use onto personal phones, and the six-page generic policy that doesn't name a single document the business actually produces.
What someone can do afterwards
The business has a written rule its staff can follow, and the cautious half of the team — usually the most senior — knows where the line is and stops treating the whole category as risky.
Where it sits in the order
Before the practical modules in regulated work; after them elsewhere. If the answer to "is anyone using this already" is unclear, an audit comes before the policy, because a rule built on a guess is a rule you can't enforce.
Where this module stops
We draft, you approve. We're not your lawyer and this isn't a compliance sign-off; where your professional obligations are the governing factor we'll tell you what needs a qualified review. Starting drafts are free on the templates page — mark one up with your objections and the session goes faster.
The questions we get asked about this
Can't we just use a template?
You can, and the free ones on this site are a reasonable start. What a template can't do is name your documents, your tools and your approver, which is the part that makes a policy get followed rather than filed.
How often does it need revisiting?
The structure holds. The vendor-specific answers move, which is why the policy names the tool and tier in one place rather than throughout.
Get a training plan built for your business. Nine questions about how your business actually runs. You get a plan ordered for your work, a reading on where you're exposed, and one clear place to start. No account needed. Build your plan.
Start an enquiry