> ## Content Index > Fetch the complete content index at: https://www.theaidirectory.com.au/llms.txt > Use this file to discover other available public pages before exploring further. # Setting AI ground rules for your team: a one-page starter policy for Australian small business - URL: https://www.theaidirectory.com.au/ai-ground-rules-team-australian-small-business-2026/ - Published: 2026-06-13T23:00:00.000Z - Updated: 2026-10-08T05:23:36.000Z - Description: Your team is already using AI — on their phones, in their browsers, on work you can't see. You don't need a 20-page policy to get a handle on it. You need one page covering five things. Here it is, ready to copy. - Author: Adam - Tags: Guides, Small Business, Policy, Compliance, Australia By **Adam**, Editor **Last reviewed:** 14 June 2026 > **Verdict (TL;DR):** Your staff are already using AI — on their phones, in their browsers, on work tasks you never see. The risk isn't that they use it; it's that nobody's said what's OK. You don't need a 20-page policy or a lawyer on retainer to fix that. You need one page that covers five things: what's safe to put into AI and what's never, which tools are approved, the rule that a human checks the output, when to disclose AI use, and who to ask when in doubt. Below is exactly that — an explanation of each point and a copy-paste starter policy you can adapt in fifteen minutes. It won't make you compliance-proof, and regulated industries need proper advice. But it turns "nobody knows the rules" into "everybody knows the basics," which is most of the battle. --- ## Why even a tiny business needs this now Two things make this worth fifteen minutes today rather than after something goes wrong. The first is that it's already happening. The term for it is "shadow AI" — staff quietly using free tools on work tasks, often with the best intentions, often pasting in things they shouldn't. A customer list to draft an email campaign. A contract to "summarise the key points." A spreadsheet of figures to "find the trend." None of it malicious. All of it outside any rule, because there isn't one. The second is regulatory direction. Australia's Privacy Act has long exempted most small businesses (broadly, those under $3 million turnover), but [that exemption is on the reform agenda and the direction of travel is its removal](https://www.theaidirectory.com.au/news-privacy-act-small-business-ai-australia-2026/). The businesses most likely to be using free AI tools loosely are the same ones most likely to be pulled under the Act. Getting basic habits in place now is cheaper than retrofitting them later. A one-page policy doesn't make you bulletproof. It does mean that when a staff member wonders "can I put this into ChatGPT?", there's an answer — and it's not "I dunno, probably." ## The five things your policy must cover ### 1\. What's safe to put in — and what's never This is the most important line in the whole document. Be concrete, because "use good judgement" isn't a rule. **Never paste into a general AI tool:** customer or client personal information (names, contact details, anything identifying), financial records, health information, anything legally privileged or under an NDA, passwords or credentials, or unreleased commercial information. On a free consumer plan, assume anything you paste may be used to train the model and may be processed overseas — our guide to [where your AI data actually goes](https://www.theaidirectory.com.au/guide-ai-data-residency-australia-2026/) explains why that matters. **Generally fine:** public information, your own already-published material, generic drafting and brainstorming, and anonymised or made-up examples. When in doubt, strip the identifying details before you paste. ### 2\. Which tools are approved Don't leave tool choice to whoever found something free online. Name the handful of tools your business has actually looked at — ideally ones with a paid plan, a data-processing agreement, and a setting to turn off training on your inputs. A general assistant for everyday work, a notetaker for meetings, whatever fits your business. (Our [best AI assistants](https://www.theaidirectory.com.au/best-ai-assistants-australia-2026/) roundup is a starting point.) The rule is simple: **for work involving any business data, use an approved tool on a business plan — not a random free app.** Staff can experiment with anything they like on their own non-work material; the line is about what touches the business. ### 3\. A human checks the output — always AI is confident even when it's wrong. It invents facts, figures, and citations that look completely real. So the rule that protects you most is the dullest one: **a person checks AI output before it's sent, published, or acted on.** The AI does the typing; a human does the checking and carries the responsibility. Spell out that for anything legal, financial, medical, or regulatory, AI is a drafting aid only — a qualified professional stays accountable. This is the same principle the Tax Practitioners Board has put in writing for tax work: the human stays on the hook, not the software. ### 4\. Disclose AI use when it matters You don't need to label every AI-touched email. But agree where disclosure matters for your business: client deliverables where the client would reasonably expect human work, anything published under someone's name, and any context where passing off AI output as something it isn't could damage trust. When unsure, lean toward being open about it. ### 5\. Who to ask, and how to flag a problem End with a name. Someone in the business owns AI questions — not as the AI police, but as the person you check with before doing something you're unsure about, and the person you tell if something goes wrong (you pasted the wrong thing, an output went out with an error in it). The goal is that mistakes get surfaced early, not hidden. ## The copy-paste starter policy Adapt the bracketed parts and you're done. Keep it to one page — a policy nobody reads protects nobody. --- **\[Business name\] — AI Use: Our Ground Rules** *Last updated: \[date\]. Owner: \[name/role\].* We use AI tools to work faster and better. These are the ground rules so we do it safely. They apply to everyone, on any device, for any work task. **1\. Protect our data.** Never put the following into a general AI tool: customer or client personal details, financial records, health information, anything confidential or under an NDA, passwords, or unreleased business information. If you're not sure, remove the identifying details first, or ask \[owner\]. **2\. Use approved tools for work.** For any task involving business information, use one of our approved tools: \[list them\]. Don't use random free AI apps for work data. Experiment freely on your own non-work material. **3\. Always check the output.** AI gets things wrong confidently. A person reviews anything AI helped produce before it's sent, published, or acted on. For legal, financial, medical, or regulatory matters, AI is a drafting aid only — a qualified professional makes the call. **4\. Be honest about AI use.** Disclose AI involvement where a client or reader would reasonably expect otherwise — in client deliverables, published work, and anything attributed to a person. When unsure, be open. **5\. Ask, and speak up.** Not sure if something's OK? Ask \[owner\] first. Made a mistake — pasted the wrong thing, sent an output with an error? Tell \[owner\] straight away. We fix problems faster when they're surfaced early. *This is our internal guidance, not legal advice. \[Owner\] reviews it every \[quarter/six months\].* --- ## How to actually roll it out A policy filed in a folder changes nothing. Three things make it stick: - **Keep it to one page and plain.** The version above is the whole thing. Resist the urge to gold-plate it. - **Walk through it once, together.** Five minutes in a team meeting beats an email nobody opens. Invite questions — the questions tell you where the real confusion is. - **Lead by example.** If the owner pastes a client list into a free tool, the policy is dead. The rules apply to everyone, starting at the top. - **Revisit it.** Tools and obligations change fast. Put a recurring reminder to re-read it every quarter and update the approved-tools list. ## What this is — and isn't This is a sensible starting floor for a small business with no AI rules today. It is general guidance, not legal advice. If you're in a regulated industry — law, finance, health, or anything with specific data-handling obligations — or you handle large volumes of sensitive personal information, get advice tailored to your obligations, and treat the above as a conversation-starter with your adviser, not a substitute for one. ## FAQ **Does my small business really need an AI policy?** If anyone in your business uses AI for work — and they almost certainly do — a one-page set of ground rules is worth fifteen minutes. It's not about bureaucracy; it's so staff have an answer to "is this OK?" before they do something risky with business data. **What's the most important rule?** The data rule: never put customer, client, financial, health, or confidential information into a general AI tool, especially a free consumer one where your inputs may train the model and be processed overseas. That single habit prevents most of the real damage. **Can I just use the template above as-is?** It's a starting point, not legal advice. Fill in the bracketed parts, name your approved tools and your owner, and adapt it to your business. If you're in a regulated industry or handle sensitive data at scale, have a qualified adviser review it. **What is "shadow AI"?** Staff using AI tools for work without approval or oversight — usually free apps, usually well-intentioned. The risk is sensitive data going into tools nobody vetted. A clear policy and a short list of approved tools is the fix. **How often should I update it?** Every quarter is a sensible rhythm. AI tools, their data settings, and Australian privacy obligations are all moving quickly — a policy written once and never revisited drifts out of date fast. ## Sources and methodology This guide is general information for Australian small businesses, not legal advice. It draws on our reporting on Australian privacy reform and AI data handling — see [the Privacy Act and small business](https://www.theaidirectory.com.au/news-privacy-act-small-business-ai-australia-2026/) and [where your AI data actually goes](https://www.theaidirectory.com.au/guide-ai-data-residency-australia-2026/). New to AI altogether? Start with [where to start with AI](https://www.theaidirectory.com.au/getting-started-ai-australian-small-business-2026/). For the tools we'd consider approving, see our [best AI assistants](https://www.theaidirectory.com.au/best-ai-assistants-australia-2026/) roundup, and our [Methodology](https://www.theaidirectory.com.au/methodology/) for how we test. *This is general information, not legal advice. For obligations specific to your business — particularly under the Privacy Act or in a regulated industry — talk to a qualified professional.* --- *The AI Directory Australia is independent. We review and score AI tools for Australian users — AUD pricing, AU availability, data residency, GST. We don't write ads; affiliate links are disclosed and sponsored content is labelled. Edited by Adam.*