Using AI safely
How to write a simple AI use policy for your team
Your staff are probably already using AI tools, whether or not you’ve said anything about it. A short policy doesn’t slow them down. It tells them which tools are fine, what must never go in, and who’s responsible for checking what comes out. One page is enough for most small businesses.
The short version
Your policy should cover
- Which AI tools are approved, and through which accounts.
- What information can and can’t go in.
- That a person checks and owns every output.
- When to tell clients AI was used.
Why bother
Without guidance, people make their own rules. Some avoid useful tools out of caution. Others paste client documents into a personal chatbot account. A short policy gets the benefits while avoiding the two biggest risks: leaking information and relying on wrong answers.
A one-page structure
1. Purpose
One or two sentences. For example: We encourage using AI tools to save time on drafting, summarising and research, within the rules below.
2. Approved tools
List the tools staff may use for work, and how to access them. For example, Microsoft 365 Copilot through work accounts, or a business plan of another AI tool. Say that personal AI accounts aren’t to be used for work information.
3. What can go in
A simple traffic-light rule works well:
| Colour | Examples |
|---|---|
| Green: fine in any approved tool | Public information, general questions, drafting from scratch |
| Amber: approved business tools only | Internal documents, anonymised data, draft proposals |
| Red: never | Customer or patient personal information, client confidential material, passwords and keys, HR matters, unreleased financials |
4. Checking outputs
A person is responsible for every piece of work AI helps produce. Check facts, figures, quotes and references. Don’t rely on AI for legal, financial, medical or safety advice without qualified review.
5. Disclosure
When to tell clients or customers AI was used, such as for reports, advice or customer-facing chat. Being open is usually the safer default.
6. Recording meetings
Rules for AI note-takers. See AI meeting notes.
7. Who to ask
Name the person to contact with questions or to suggest a new tool.
Rolling it out
- Share it in a team meeting, with examples of good and bad use.
- Make the approved tools easy to access, so people don’t use workarounds.
- Review it every six months. AI tools change quickly.
Make the safe option the easy option
If the approved tool is harder to use than a free chatbot, people will use the free one. Paying for business accounts with proper data protection is often the most effective part of an AI policy.
Useful references
- The OAIC’s guidance on privacy and commercially available AI products
- The ASD’s advice on using AI securely in your business
- The Australian Government’s voluntary AI safety guidance
Common questions
Should we just ban AI tools?
Bans are hard to enforce and usually push use underground. Clear rules and approved tools work better.
Do we need a lawyer to write this?
Not for a basic internal policy. If you use AI in decisions about people, in regulated work or in products you sell, get advice.
What about AI built into tools we already use?
Include it. Features like AI in your CRM, email or design tools are covered by the same rules about data and checking.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.