AI Acceptable Use Policy Template For Workplaces

Should you let your team use AI tools like ChatGPT, Microsoft Copilot or Gemini at work? Yes, you usually can - as long as you set clear rules around what staff can use, what they can enter, and who checks the output before it leaves your business.

AI can genuinely save time. It can help draft emails, summarise meeting notes, brainstorm social posts and speed up admin that used to chew up hours each week.

The part that makes many employers nervous is also very real: staff might paste in customer data, rely on a made-up answer, or accidentally create IP and confidentiality problems. A practical AI acceptable use policy helps you get the benefits without leaving the rules to guesswork.

Do You Need An AI Acceptable Use Policy At Work?

Yes, if your staff are using or are likely to use AI tools for work, you should have a written employee AI use policy.

You don't need a huge AI governance manual for everyday use. Most small businesses need a clear, readable policy that tells staff:

• which AI tools are approved for work use
• what information must never be entered into an AI tool
• which tasks AI can and can't be used for
• who is responsible for checking AI outputs
• what happens if something goes wrong

From an employment law perspective, a workplace policy can help you give clear and reasonable directions to your team. The policy should sit alongside your employment contracts, confidentiality obligations, an information security policy and any award or enterprise agreement obligations that apply under the Fair Work Act 2009.

The policy also protects your business culture. Without clear rules, one employee may be using a free AI tool for customer emails, another may be uploading spreadsheets with personal information, and another may be avoiding AI completely because they aren't sure what's allowed.

A good policy gives your team permission to use AI safely. It shouldn't just say no to everything. It should explain the everyday use cases that are fine, the higher-risk uses that need approval, and the activities that are banned.

What Should An AI Policy For Employees In Australia Cover?

An AI policy for employees in Australia should cover confidentiality, privacy, IP, accuracy, approved tools, prohibited uses, record keeping and escalation.

Here's a workplace-ready outline you can use as a starting point. This isn't a finished legal document, and a lawyer should tailor it before you use it, especially if you handle sensitive information, customer data, health information, financial information or valuable IP.

AI Acceptable Use Policy Template Outline

1. Purpose: Explain that the policy allows safe, productive AI use while protecting the business, customers and staff.
2. Who It Applies To: List employees, contractors, interns, directors and anyone else using your systems or information.
3. Approved AI Tools: Name the tools staff may use, such as a paid business account, and ban unapproved personal accounts for work tasks.
4. Permitted Uses: Give examples such as drafting internal emails, summarising non-confidential notes, brainstorming ideas or formatting documents.
5. Restricted Uses: Require manager approval for higher-risk tasks, such as customer-facing advice, HR decisions, legal or compliance content, pricing analysis or code generation.
6. Prohibited Uses: Ban staff from entering confidential information, personal information, passwords, trade secrets, source code or unreleased product plans unless specifically approved.
7. Privacy And Data Handling: Align with your privacy policy by setting rules for de-identifying information, checking AI provider terms, and avoiding unnecessary collection or disclosure of personal information.
8. Human Review: Require a person to check accuracy, tone, legal risk, bias, customer impact and brand fit before AI outputs are used.
9. IP And Copyright: Explain who owns work created at work, how AI outputs can be used, and when staff need permission before using third-party material.
10. Records And Prompts: Say when staff should keep prompts, outputs and review notes, especially for customer-facing or high-risk work.
11. Security Rules: Prohibit passwords, access tokens and confidential system information from being entered into AI tools.
12. Reporting Problems: Tell staff who to contact if they enter the wrong information, spot a false output or think AI has caused a privacy or IP issue.
13. Consequences: Link breaches to your disciplinary process and make sure the consequences are consistent with your employment contracts and workplace policies.

The best policies are specific. Instead of saying staff must use AI responsibly, say what that means in your business.

What Can Staff Put Into ChatGPT And Other AI Tools?

Staff should only put information into AI tools if your policy allows it, the information isn't confidential or sensitive, and you're comfortable with how the AI provider may store or use it.

This is where many businesses need the clearest rules. Once information is pasted into a third-party AI tool, you may lose control over where it goes, who can access it, whether it's stored overseas, and whether it's used to improve the provider's model.

Your policy should ban staff from entering:

• customer names, contact details, order histories or complaints unless properly approved and de-identified
• employee information, including performance issues, medical information or payroll details
• supplier pricing, margins, tender material or negotiation strategy
• passwords, API keys, access tokens or system credentials
• unreleased product ideas, designs, code, recipes, manuals or trade secrets
• legal documents, contracts or commercial disputes without approval

If your business is covered by the Privacy Act 1988, including where your annual turnover is more than $3 million or an exception applies, you need to think carefully about the Australian Privacy Principles. Uploading personal information into an AI tool may count as a use or disclosure of that information. If the provider stores or processes information overseas, cross-border disclosure issues can also arise.

Even if the Privacy Act doesn't apply to your business yet, your customer contracts, confidentiality promises and reputation still matter. A customer may not care whether you fall under a legal threshold if their private information ends up in the wrong place.

A practical rule is this: if you wouldn't email the information to an unknown third party, don't paste it into an AI tool.

Who Owns Work Created With AI?

Ownership depends on who created the work, what your contracts say, how much human input was involved, and the terms of the AI tool.

For employee-created work, Australian copyright law often gives the employer ownership where the work is created in the course of employment. But AI can make things less clear because copyright generally protects human authorship, and purely machine-generated material may be harder to protect.

For contractors, the position is different. Unless your contractor agreement assigns IP to your business, the contractor may own the work they create - even if you're paying for it. If a contractor is using AI to create logos, website copy, software code or marketing assets for you, your agreement should deal with:

• who owns the final deliverables
• whether AI tools can be used at all
• whether any third-party material can be included
• who is responsible if the output copies someone else's work
• whether prompts, drafts and source files must be handed over

You should also check the AI provider's terms of use. Some tools say users own outputs, some impose usage limits, and some reserve rights to use inputs and outputs to improve services depending on your settings or account type.

For trade marks and branding, be extra careful. If your team uses AI to create a business name, logo or tagline, you still need to check whether it's available and whether it might infringe someone else's rights. IP Australia won't ignore existing trade marks just because an AI tool suggested the name.

A sensible policy should say AI output isn't ready to use until a person has checked originality, accuracy, ownership and brand fit.

How Do You Control Accuracy, Bias And Customer Risk?

You control AI risk by setting approval levels based on the type of task and requiring human review before anything high-impact is used.

AI tools can produce confident answers that are wrong. They can also reflect bias in training data, misunderstand Australian law, invent sources or use wording that doesn't match your brand. For a business, that can create misleading marketing, poor customer service, unfair HR decisions or contract mistakes.

Your policy should split AI use into risk levels.

Low-Risk Uses

Low-risk uses are usually fine without approval if staff follow your confidentiality rules. Examples include:

• turning rough internal notes into a meeting agenda
• suggesting blog topic ideas for later review
• checking grammar in non-confidential text
• creating a first draft of an internal announcement

Medium-Risk Uses

Medium-risk uses should need manager review before being published or sent. Examples include:

• customer emails about refunds, complaints or service issues
• marketing claims about product features or results
• website copy, social posts or advertising content
• training materials for staff

The Australian Consumer Law matters here. If AI helps create advertising or customer communications, your business is still responsible for misleading or deceptive conduct and false claims. Blaming the tool won't usually help if a customer relied on the statement.

High-Risk Uses

High-risk uses should usually be banned or require senior approval and specialist review. Examples include:

• making hiring, promotion, rostering or disciplinary decisions
• assessing employee performance without human oversight
• giving legal, financial, medical or safety advice to customers
• analysing sensitive personal information
• generating code for production systems without security review

Say you run a cafe in Brisbane with 12 staff. Your manager uses AI to draft a response to a customer complaint about allergens. That's medium to high risk because the response affects customer safety and your obligations under food and consumer laws. Your policy might allow AI to help draft the tone, but require the manager to check the facts against your allergen procedures before sending it.

How Do You Roll Out A Workplace AI Policy?

You roll out a workplace AI policy by introducing it clearly, training your team, applying it consistently and reviewing it as your tools change.

A policy that sits in a folder won't do much. Your staff need to know what it means in everyday tasks. Keep the rollout practical and focused on examples they recognise.

Step 1: Audit Current AI Use

Ask your team which tools they already use, what they use them for, and whether they use personal or business accounts. You may find AI is already part of your workflow.

Step 2: Choose Approved Tools

Decide which tools are allowed. For higher-risk businesses, a paid business version with stronger admin controls may be safer than free personal accounts. Check the provider's data use, retention, security and opt-out settings.

Step 3: Train Your Team With Examples

Give staff simple examples of allowed and banned use. For example:

• Allowed: summarising a public article for internal learning
• Allowed with review: drafting a customer email using de-identified facts
• Not allowed: uploading a customer database to ask for sales insights
• Not allowed: pasting an employee's medical certificate into an AI tool

Step 4: Update Related Documents

Your AI policy should work with your employment contracts, contractor agreements, confidentiality deeds, privacy policy, acceptable use policy and information security procedures. If those documents say different things, staff won't know which rule to follow.

If you use AI to monitor staff activity, analyse productivity or track computer use, workplace surveillance laws may also apply. For example, in New South Wales and the ACT, certain workplace surveillance generally requires written notice at least 14 days before it starts, with specific details about the surveillance. Get tailored advice before using AI-powered monitoring tools.

What Should You Do If AI Has Already Been Used The Wrong Way?

If AI has already been used the wrong way, act quickly to contain the issue, keep records and work out whether anyone needs to be notified.

Start with the practical steps in order:

1. Pause The Use: Stop using the relevant AI output or tool until you understand the issue.
2. Preserve Evidence: Keep the prompt, output, date, tool name, account used, screenshots and any communications that relied on the output.
3. Remove Or Correct Content: Take down inaccurate website content, correct customer emails or withdraw documents where you can.
4. Assess The Information: Check whether personal information, confidential information, IP, passwords or commercial data were entered.
5. Check Your Contracts: See whether customer, supplier or employee documents require you to notify anyone.
6. Consider Privacy Obligations: If the Notifiable Data Breaches scheme applies, you generally have up to 30 days to assess whether a suspected eligible data breach has occurred, and you may need to notify the OAIC and affected individuals.
7. Fix The Process: Update the policy, restrict tool access, retrain staff or change approval steps so the same issue doesn't happen again.

For example, Mike runs an online retailer with annual turnover of $4.5 million. A staff member pastes 600 customer names, email addresses and recent orders into a free AI tool to create marketing segments. Mike should stop the campaign, record exactly what was entered, check the tool's data settings and terms, assess whether there's a likely risk of serious harm, and start the Privacy Act data breach assessment process. If the risk is serious enough, he may need to notify the OAIC and affected customers.

Not every mistake is a reportable breach. But treating it carefully from the start helps you make a defensible decision.

Key Takeaways

• An AI acceptable use policy lets your team use AI tools while setting clear limits around confidentiality, privacy, IP and accuracy.
• Your policy should name approved tools, banned inputs, permitted uses, approval steps and what to do if something goes wrong.
• Staff shouldn't paste customer data, employee records, passwords, trade secrets or commercially sensitive information into AI tools unless your policy specifically allows it.
• AI output should be reviewed by a person before it's sent to customers, published, relied on for decisions or added to business systems.
• Privacy Act, Australian Consumer Law, IP and workplace surveillance rules can all be relevant depending on how your business uses AI.
• Templates are a useful starting point, but your policy should be tailored to your tools, team, industry and risk profile.

If you'd like help with your workplace AI policy, employment documents, privacy and confidentiality rules, or contractor IP protections, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.