# AI use policy template

Editable operational starting point. Adapt and approve before issue. This is not a legal compliance assessment. Text in square brackets is for the organisation to complete; examples are hypothetical.

## Issue and ownership

Organisation: [name]. Version/effective date: [version/date]. Policy owner: [role/contact]. Approver: [role]. Next review: [date]. Scope: [teams/workflows].

## Staff policy

Use only the tools and tasks listed in the approved-use register below. Your ordinary access to a file does not automatically approve uploading it to AI. Use the minimum approved information needed.

Check important claims against the original source. Treat generated material as a draft until the named reviewer approves its intended use. Follow the register's external-release and disclosure instructions.

Keep passwords, API keys and other secrets out of prompts and uploads. Do not bypass access restrictions or ask the assistant to act as another person. Sending, publishing or changing records requires an explicitly approved workflow; ordinary drafting permission does not authorise it.

If an answer is wrong, use [feedback route]. If you suspect exposure, unexpected access or an unauthorised action, stop and contact [urgent security/privacy route]. Preserve the reference as instructed; avoid forwarding sensitive content into general chat.

For a new task or unlisted data source, ask [use-case owner]. Use [manual alternative] while the request is assessed. Employment, credit, health and other consequential decisions are outside scope unless separately assessed and approved.

## Approved-use register

| Tool/version and deployment | Named task/audience | Permitted data and exclusions | Required check/reviewer | Release/disclosure decision | Retention/owner | Approval/date |
| --- | --- | --- | --- | --- | --- | --- |
| [approved local assistant] | [find manual passages; support team] | [approved manual collection; exclude tickets/personnel files] | [user opens source and checks steps] | [internal draft only] | [locations/schedule/records role] | [approver/date] |
| [approved hosted assistant] | [edit public product text] | [approved public text only] | [product owner checks claims] | [release owner and disclosure rule] | [provider settings/schedule/owner] | [approver/date] |
| [hybrid workflow] | [reviewed excerpt processing] | [data-owner-approved minimised excerpt; assess reidentification] | [reviewer checks redaction and output] | [external processing decision] | [local and hosted copies/schedule] | [approver/date] |

## Controls and changes

Service owner: [role/contact]. Identity owner: [role]. Data owner: [role]. Controls to verify: authentication, retrieval permissions, tool restrictions, logging, external connections and retention. Record actual test evidence separately.

Review after changes to tasks, sources, permissions, models, integrations or applicable obligations, and after incidents or recurring errors. Record the decision, effective version and staff communication.

Offboarding: revoke identity and tool access; revoke personal tokens where applicable; transfer owned work; handle retained content under the approved records schedule. Verify removal using authorised test procedures.

## Onboarding exercises

Ask staff to classify an approved manual, a customer ticket and a synthetic credential example. Ask them to find an omitted warning in a deliberately flawed draft. Rehearse ordinary feedback and a simulated urgent incident using synthetic content. Record comprehension issues and update guidance before expanding access.

## Issue checklist

- [ ] All roles, contacts and register entries completed and approved.
- [ ] Technical restrictions checked independently of model refusals.
- [ ] Applicable privacy, workplace, contractual and sector requirements assessed by the responsible specialist.
- [ ] Reporting routes received a test report; staff can find the manual alternative.
- [ ] Retention, review and offboarding owners accept their responsibilities.

Sources: National AI Centre policy guide, https://www.ai.gov.au/staying-safe-and-responsible/essential-ai-practices/create-ai-policy ; OAIC AI guidance, https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products . Prepared 19 October 2026; recheck before issue.