AI is already in the room
Someone may be using AI to draft a customer reply, tidy up a spreadsheet or summarise a long document. The awkward questions are simple: Can I paste this customer information in? Who checks the answer? Who is responsible if it is wrong?
A small business does not need a thick rulebook to answer those questions. It needs a few clear house rules that let people try useful tools while protecting customers, staff and the business.
The Australian Government’s AI policy guide is a practical starting point. I have turned that guidance—along with privacy advice from the OAIC and small-business security advice from the ACSC—into a plain-English starter you can adapt to your own workplace. [1] [3] [5]
Get the policy starter
Use the PDF to read through the 9-page guide, or download the editable Word copy to fill in your business details and make it your own.
Free to adapt for your business. This is a starting point, not legal advice or a guarantee of compliance.
Keep the rules simple: need, tool, check, learn
A useful policy does not try to predict every new AI feature. It gives people a sensible way to pause, choose and check.
- 1 · StartA real business task
- 2 · ChooseAn approved tool and the right information
- 3 · CheckA person reviews the answer before it matters
- 4 · LearnKeep a note, improve or stop
That is enough structure to make ordinary, low-risk work easier without treating every experiment as a major project. For more consequential uses, the policy asks for stronger checks.
Start with the information, not the software
Before someone types or uploads anything, ask: would we be comfortable if this information went somewhere we do not fully understand? A simple traffic-light rule gives the team a quick first answer.
| Colour | What it means | Simple rule |
|---|---|---|
| Green · public | Information anyone can already see, such as published web pages or approved product details. | Use an approved tool. Check the answer before you share it. |
| Amber · internal | Routine business information that is not public but would cause limited harm if exposed. | Use only an approved business account. Check who can see what you enter, and share as little as the task needs. |
| Red · restricted | Personal or sensitive details, customer and staff records, passwords, security keys, confidential contracts or unreleased plans. | Keep it out of public or unapproved tools. Use it only for a specific approved purpose with suitable safeguards. Never paste passwords or access keys. |
The OAIC’s best-practice advice is not to put personal information—especially sensitive information—into publicly available generative-AI tools. A paid plan does not automatically make prompts private, so check the settings and terms first. [3] [4]
If a task needs personal information, stop and check why it is needed, whether the business is allowed to use it that way, who else can see it and how long it is kept. Get privacy advice if the use could have a significant effect on someone.
Let the risk set the check
A first draft for internal discussion is not the same as AI helping decide who gets a job, a loan or an important service. The policy uses four practical in-house levels. They are a guide for deciding who should review a use—not legal categories. [2]
Low impact
For example, a first draft based on public information. Use an approved tool, and have someone check the result before using it.
Needs a closer look
If AI sees internal information or helps with customer-facing work, check the supplier and settings, limit access, test examples and decide who reviews the answer.
High impact
If it could affect people’s work, money, rights, health or safety—or act in an important system—write down the risks, get the right advice and a senior sign-off, test it and keep a person responsible for the final decision.
Stop by default
Do not use AI to break the law, mislead people or share restricted information with an unapproved service. Do not let an AI agent make important changes without specific safeguards and a human check.
One simple test: if you would struggle to explain who is responsible, what the tool can see or how to put things right, it is not ready to use.
AI does not take responsibility
AI can sound confident and still be wrong. Before you send, publish or act on an answer, check the important facts against a reliable source. Check that it is fair, fits the Australian context and does not expose private information or make up evidence.
If an AI answer could have a real effect on someone, a person with the right authority needs to look at the facts, understand what the tool did and make—or clearly approve—the final call. People should also know how to reach a human if they have a concern. [1] [3]
For tools that can send messages, change records, buy things or connect to other systems, keep the permissions narrow. Test the tool safely and require a person to confirm actions that are hard to undo. [5]
Start with one useful job this month
You do not need a big transformation plan to get going. The policy includes a simple first-month path:
- Week 1: Ask the team which AI tools and built-in features they already use. Name an owner for each.
- Week 2: Agree which tools are okay and what information can go into them.
- Week 3: Pick one or two low-risk jobs to trial. Try realistic examples and decide who checks the answers.
- Week 4: Brief the team, write down what is approved, confirm who to call if something goes wrong and set a review date.
A spreadsheet can be enough to record the tool, what it is used for, who owns it and when you will review it. Keep the record useful, not complicated.
The aim is not to use AI everywhere. It is to make it easier for your team to try one worthwhile thing, protect what matters and know who is accountable for the result.
References
- [1] National AI Centre — Create an AI policy and AI Policy Guide and Template
- [2] National AI Centre — Guidance for AI adoption: foundations
- [3] Office of the Australian Information Commissioner — Guidance on privacy and the use of commercially available AI products
- [4] Office of the Australian Information Commissioner — GenAI tools in the workplace: balancing protection of personal information and business efficiency
- [5] Australian Cyber Security Centre — Artificial intelligence for small business
- [6] U.S. National Institute of Standards and Technology — AI Risk Management Framework (voluntary framework)
- [7] U.S. National Institute of Standards and Technology — Generative Artificial Intelligence Profile, NIST AI 600-1