What to put in an AI acceptable use policy

An AI acceptable use policy tells staff which AI tools they may use, for what, and with what information. It works best when it is short, specific and backed by a named owner. Australia’s Guidance for AI Adoption is voluntary, but its practices of accountability, risk management and human control are a sound basis.

The nine sections

1. Purpose and scope. Who the policy applies to, including contractors, and which tools it covers.
2. Approved tools. A list of approved AI tools and accounts, and how to request a new one.
3. Information rules. What must never go into an AI tool: for example personal, health, client-confidential or commercially sensitive information, unless the tool is approved for it.
4. Permitted uses. Examples of acceptable use, such as drafting, summarising public material or brainstorming.
5. Prohibited uses. Examples of unacceptable use, such as making final decisions about people without review.
6. Human review. When a person must check AI output before it is relied on or sent.
7. Disclosure. When staff must tell colleagues, clients or the public that AI was used.
8. Accountability. Who owns the policy, who approves new uses, and how to report a problem.
9. Training and review. How staff will be trained, and when the policy will be reviewed.

Before you publish it

• Check it against your privacy policy and your automated decision-making disclosures.
• Tell staff what changed, and why, in plain language.

General information only, not legal advice.