AI governance
AI governance basics for small organisations
AI use policy template outline for small organisations: approved tools, data rules, OAIC privacy obligations and ASD security points. Not legal advice.
Where to start: an AI use policy for a small team
These are the building blocks the OAIC, ASD and the National AI Centre describe, in a practical order for a small organisation. It's general information, not legal advice.
- Check whether the Privacy Act applies to youThe OAIC says most small businesses with turnover of $3 million or less aren't covered, but some are regardless of turnover, such as health service providers.Does the Privacy Act apply?
- List the approved AI tools and what each is forRecord the tool and plan, what it's approved for, what data it may receive, who owns it and key settings such as training on inputs.Building an approved tools list
- Set simple rules for what information can go inThe OAIC recommends organisations don't enter personal, and particularly sensitive, information into publicly available generative AI tools. A few data categories make the rule easy to follow.Simple data rules
- Decide who checks AI output before it's usedASD says AI outputs may not always be accurate or factually correct.How to check AI-generated content
- Set security basics and train staffASD's questions cover multi-factor authentication and privileged access, and it says staff should be trained on what data can and cannot be input.What ASD describes
- Write it up from the National AI Centre's free templateThe National AI Centre's AI policy guide and template (October 2025) is designed to be adapted to each organisation.Template outline
Based on the OAIC's AI products guidance and small business page, ASD's 'Engaging with artificial intelligence' and the National AI Centre's AI policy guide and template, checked October 2026.
Key points
- The OAIC says privacy obligations apply to any personal information input into an AI system, and to AI output that contains personal information.
- The OAIC says that if AI is used to create or infer personal information, that is a collection of personal information and must comply with APP 3.
- The National AI Centre's template sets out seven policy statements, including clear accountability and human oversight and control, plus roles, incident management and review.
An AI use policy template gives a small organisation a simple, written answer to questions staff are already asking: which AI tools can we use, what information can go into them, and who checks the results? This guide explains the basic building blocks of AI governance for small organisations, what the Office of the Australian Information Commissioner (OAIC) and the Australian Signals Directorate (ASD) say about privacy and security, and ends with a plain template outline based on the National AI Centre’s published template.
It is general information, not legal advice.
What AI governance means for a small organisation
“AI governance” can sound like a large-company project. For a small team it usually comes down to a few decisions, written down and shared:
- Which tools are approved, and for what kinds of work.
- What information may go into them, and what never should.
- Who is responsible for checking AI output before it’s used.
- What happens when something goes wrong.
The National AI Centre’s AI policy guide describes an AI policy as “your organisation’s essential guiding resource for all AI-related activities.” Its template sets out “core principles, expectations and rules for the development, deployment and use of AI systems.”
Why it matters
Without a policy, staff tend to use whatever tool is handy, with whatever information they have. That can put customer details, contracts or internal plans into services the organisation hasn’t checked.
ASD’s guidance Engaging with artificial intelligence says “Organisations should be cautious with what information they, and their personnel, provide to generative AI systems.” It also says AI outputs “may not always be accurate or factually correct”, so decisions based on unchecked output carry their own risk. Our guide to checking AI-generated content explains why.
Privacy obligations: what the OAIC says
The OAIC’s Guidance on privacy and the use of commercially available AI products is the main Australian reference for organisations covered by the Privacy Act. Its top takeaways include:
- Inputs and outputs are both covered. “Privacy obligations will apply to any personal information input into an AI system”, and to AI-generated output that contains personal information.
- Update privacy documents. Organisations should “update their privacy policies and notifications with clear and transparent information about their use of AI”.
- Generated information is a collection. If AI is used to create or infer personal information, the OAIC says “this is a collection of personal information and must comply with APP 3”.
- Use for the original purpose. “APP 6 requires entities to only use or disclose the information for the primary purpose for which it was collected”, unless an exception applies.
- Public tools. The OAIC recommends that organisations “do not enter personal information, and particularly sensitive information, into publicly available generative AI tools”.
The OAIC also describes doing “due diligence to ensure the product is suitable to its intended uses”, taking a “privacy by design” approach (including a privacy impact assessment), and taking reasonable steps under APP 10 to ensure personal information is accurate.
Does the Privacy Act apply to small businesses?
It depends. The OAIC says “A small business is one with an annual turnover of $3 million or less”, and that most small businesses under that threshold aren’t covered. But some are covered regardless of turnover, including health service providers and businesses that trade in personal information. The OAIC also says that, as a matter of best practice, it recommends small businesses protect any personal information they hold. The OAIC’s small business page explains the exceptions; whether a particular organisation is covered is a question for the OAIC or a qualified adviser.
Security settings and training ASD describes
ASD’s Engaging with artificial intelligence frames its guidance as questions for organisations. Several translate directly into policy decisions:
- “How will the system affect your organisation’s privacy and data protection obligations?”
- “Does your organisation enforce multi-factor authentication?”
- “How will your organisation manage privileged access to the AI system?”
- “Can your organisation implement a trial of the AI system?”
- “Does your organisation understand the limits and constraints of the AI system?”
- “What will your organisation do if something goes wrong with the AI system?”
ASD also says “Staff that use the system should be trained on what data can and cannot be input to the system”, and on how far outputs can be relied upon. It describes checking whether inputs will be used to retrain a vendor’s models, and seeking “vendors that are transparent about how they have developed and tested their AI systems.”
For AI tools that can take actions on their own, ASD’s joint guidance Careful adoption of agentic AI services recommends using them “only for low-risk and non-sensitive tasks” at first. Our guide to AI agents and permissions covers this.
How to build an approved tools list
An approved tools list is usually the most practical part of a small organisation’s AI policy. For each tool, organisations commonly record:
- The tool and the plan or version. ASD’s guidance describes considering private versions of AI systems where available, and checking whether inputs are used for retraining.
- What it’s approved for, such as drafting, summarising public material or coding help.
- What data it may receive, linked to the data categories below.
- Who owns it and reviews it.
- Key settings, such as whether chat history or model training on inputs is turned off, where the vendor offers that.
The OAIC’s due diligence point and ASD’s questions about vendors and training on inputs are a useful basis for deciding what goes on the list. For the data side, see AI assistants at work and confidential data.
How to set data rules: a simple classification
Data classification means sorting information into a few categories so people know how to handle it. It doesn’t need to be complicated. A small organisation might use something like this (an illustration, not a standard):
| Category | Examples | AI use (example rule) |
|---|---|---|
| Public | Published website text, brochures | Any approved tool |
| Internal | Meeting notes, draft procedures | Approved business tools only |
| Confidential | Contracts, financials, pricing | Only tools approved for confidential data, or not at all |
| Personal or sensitive | Customer, staff or health information | Per privacy obligations; the OAIC recommends not entering it into publicly available AI tools |
The point is to make the rule easy to follow in the moment, so staff don’t have to make a judgement call every time.
Template outline
The National AI Centre publishes an AI policy guide and template (version 1.0, October 2025) that organisations can download and adapt. Its template includes a purpose and scope, seven policy statements (ethical and human-centred use; clear accountability; risk and impact assessment; quality, reliability and security; fairness and inclusion; transparency and contestability; human oversight and control), governance and compliance (roles and responsibilities, new AI use case procedures, incident management), and policy review.
The NAIC template itself says to “adapt the template so your AI policy reflects your organisation’s values, industry standards and legal obligations.”
A shorter outline for a very small team, drawing on that structure and the OAIC and ASD points above:
- Purpose and scope. Why the policy exists; who and which tools it covers. (NAIC template)
- Principles. For example: people stay accountable for AI-assisted work; human oversight for important decisions. (NAIC policy statements)
- Approved tools. The list, with what each is approved for and who owns it. (OAIC due diligence; ASD vendor questions)
- Data rules. What may and may not be entered, by data category; no personal or sensitive information in publicly available tools. (OAIC; ASD)
- Checking output. Who reviews AI output, and what must be verified before use. (ASD on accuracy)
- Privacy and transparency. Whether privacy policies and notices mention AI use. (OAIC)
- Security settings. Multi-factor authentication, admin access and logging for AI tools. (ASD)
- AI agents and automation. Which tasks, if any, AI may perform without human approval. (ASD agentic AI guidance)
- Training. What staff are taught about inputs and relying on outputs. (ASD)
- Incidents. How to report a mistake, data leak or misuse, linked to the incident plan. (NAIC; ASD)
- New uses and review. How new tools or uses are approved, and when the policy is reviewed. (NAIC)
Our one-page incident response plan template can sit alongside section 10, and security policies for small teams covers the other policies a small organisation often keeps.
Things to watch for
- Free consumer accounts used for work, outside any approved list.
- A policy nobody has read. A short, plain policy is easier to follow than a long one.
- No owner for each tool, so settings and terms are never reviewed.
- Privacy policies that don’t mention AI, where the OAIC says transparency is expected.
- AI output used without checking, especially in advice, quotes or anything sent to customers.
- New AI features switched on by default in existing software, which may change what data a tool can reach.
- Treating a template as legal advice. The NAIC template is designed to be adapted to each organisation’s obligations.
Common questions
Is there a free AI use policy template for Australian businesses?
Yes. The National AI Centre publishes a free AI policy guide and template (version 1.0, October 2025) on industry.gov.au that organisations can download and adapt. The template itself says to adapt it so the policy reflects the organisation’s values, industry standards and legal obligations. This guide’s template outline gives a shorter version for a very small team, drawing on that structure and on OAIC and ASD guidance.
What should an AI use policy include?
The National AI Centre’s template covers a purpose and scope, seven policy statements such as clear accountability and human oversight, governance and compliance (roles, new AI use case procedures and incident management), and policy review. Small organisations often add an approved tools list and simple data rules, drawing on OAIC and ASD guidance. See how to build an approved tools list and the template outline.
Can staff put customer information into ChatGPT or other public AI tools?
The OAIC recommends that organisations “do not enter personal information, and particularly sensitive information, into publicly available generative AI tools”. It also says privacy obligations apply to any personal information input into an AI system, and to AI output that contains personal information. Many small organisations make this easy to follow with a few data categories. See how to set data rules for an illustrative classification table.
Does the Privacy Act apply to AI use in a small business?
It depends on the business. The OAIC says “The Privacy Act applies to all uses of AI involving personal information” for organisations it covers. Most small businesses with an annual turnover of $3 million or less aren’t covered, but some are regardless of turnover, including health service providers and businesses that trade in personal information. Whether a particular organisation is covered is a question for the OAIC or a qualified adviser. See does the Privacy Act apply.
Do I need an AI policy if my team is very small?
That is each organisation’s decision, but even a small team’s AI governance usually comes down to a few written decisions: which tools are approved, what information may go into them, who checks AI output, and what happens when something goes wrong. ASD says organisations should be cautious with what information they and their personnel provide to generative AI systems. See what AI governance means for a small organisation.
What do I do if staff have put personal information into an AI tool?
The OAIC’s guidance on commercially available AI products is the main Australian reference on the privacy obligations that apply. If personal information may have been exposed through an AI tool, our guide to data breaches explains how official sources describe responding. The NAIC template includes incident management, and our one-page incident response plan template can sit alongside the incidents section of an AI policy.
Where to get official help
- The OAIC’s guidance on privacy and commercially available AI products explains privacy obligations.
- The National AI Centre’s AI policy guide and template is free to download and adapt.
- ASD’s Engaging with artificial intelligence covers security considerations.
- If personal information may have been exposed through an AI tool, our guide to data breaches explains how official sources describe responding.