A small business AI use policy can fit on one or two pages. It should say who is accountable, what AI may and may not be used for, what data must never be entered, when a person must review the output, and when you will tell customers that AI was involved. Keep the language plain so staff actually read it, and review it as your tools change.
Why have a policy at all
Staff are probably already using AI tools, whether or not the business has chosen them. A policy replaces guesswork with shared rules. The Australian Government’s Guidance for AI adoption: foundations lists creating an AI policy as an early action. It says the policy should set out how the organisation will use AI responsibly and advise staff on AI risks and how to manage them. It also points to a policy template on the Department’s site, which is worth using as a starting point.
This article is general information, not legal advice.
The elements of a simple policy
1. Purpose and scope
Two or three sentences: why the policy exists and who it covers (employees, contractors, anyone using business accounts). State that it applies to any AI tool, including AI features built into other software.
2. Accountability
Name one person who owns the policy and AI decisions. The foundations guidance recommends assigning a senior leader as the overall governance owner with enough authority and understanding to oversee AI use. In a very small business that may be the owner. For each tool or major use, name who is responsible for it.
3. Permitted and prohibited uses
Use a short table that staff can scan.
| Category | Examples to adapt |
|---|---|
| Permitted | Drafting first versions of internal or marketing text, summarising public documents, brainstorming ideas, generating image or video concepts |
| Permitted with approval | Using AI on customer-facing content, using new tools, connecting AI to business systems |
| Not permitted | Entering confidential or personal customer information into unapproved tools, using AI to make decisions about people without review, presenting AI output as verified fact |
The guidance notes that the same tool can carry different risks depending on use. Drafting marketing emails differs from assessing job applications. Your table should reflect that difference.
4. Data rules
State plainly what must not be entered into AI tools: customer personal information, passwords, contracts, unpublished financials or anything covered by a confidentiality agreement. List approved tools and say who can approve a new one. Personal information may carry legal obligations under Australian privacy law, so check with a qualified adviser if you handle it. For a first-step plan, see AI for small business: where to start.
5. Human review
Define what must be checked and by whom before anything goes out. The guidance recommends oversight that matches how autonomous the system is and how high the stakes are, with clear points where a person can pause or override. A simple rule works well: nothing AI-assisted is published, sent to a customer or used in a decision until a named person has read it. The detail is in human-in-the-loop workflows.
6. Accuracy and fact-checking
Say that AI output can be wrong, and that the person who uses it is responsible for checking facts, figures, names and claims before use. Require sources for any statistic.
7. Disclosure
Decide when you will tell customers and partners that AI was involved. The guidance advises making disclosure standard practice, especially where AI influences decisions, generates content that can meaningfully affect people, or could be mistaken for a human, for example a chatbot. Write your own rule, such as “customers are told when they are talking to an automated assistant”. For the trust angle, see AI ethics and brand trust.
8. Records and an AI register
The guidance recommends an AI register documenting each system, how it is used and key details, including AI embedded in other tools. A spreadsheet with columns for tool, purpose, owner, data involved, review rule and date approved is enough.
9. Problems and complaints
Give staff and customers a way to raise a concern, and say who deals with it. The guidance advises channels for people to report problems or challenge AI decisions, proportionate to the seriousness of the impact.
10. Review
Set a review date, for example every six months or when you add a new tool. Update the register at the same time.
A short template outline
- Purpose and scope
- Policy owner and tool owners
- Permitted, approval-needed and prohibited uses
- Data rules and approved tools
- Review and sign-off rules
- Accuracy responsibilities
- Disclosure rules
- Register location
- How to raise concerns
- Review date
Making it stick
- Introduce the policy in a short team conversation, not just an email.
- Give two worked examples of acceptable and unacceptable use.
- Keep it short enough that people remember it.
- Revisit it after the first incident or near miss, because those are the best teachers.
NIST’s AI Risk Management Framework offers a voluntary, more formal reference if your use grows and you want a structure beyond a basic policy.
Where Radiance Impact fits
Radiance Impact’s Technology division builds websites and workflow automation, and can help you decide where AI belongs in a process and what review steps to build around it. See Digital Technology and AI Solutions or contact us.
Sources
- Guidance for AI adoption: foundations, National AI Centre, Australian Government Department of Industry, Science and Resources
- AI Risk Management Framework, NIST
