Most Australian small businesses already have staff using Claude and other AI tools every day. The real question is no longer whether it happens, but whether it happens under any rules at all. An AI policy is the short document that turns quiet, ad hoc use into something your team can do openly and safely. Below is a plain template you can copy today, adapt to your business this week, and put into practice without slowing anyone down.
Why your business needs one now
Without a policy, every staff member makes their own call about what is fine to paste into an AI tool. One person redacts client names; the next pastes a full customer list to draft a mail-out. That gap is where the risk lives. Under the Privacy Act, serious or repeated breaches now carry penalties of up to $50 million for a company, and even a minor slip can cost a small firm real money in remediation, lost trust, and re-work. On top of the compliance side, uneven AI use quietly drains budget. We have seen businesses spend more than $15,000 a year on overlapping tool subscriptions that nobody governs.
A written policy fixes the common failures before they happen:
Sensitive client or employee data pasted into tools that were never approved for it.
AI-written work sent to customers with no human check, errors and all.
Staff hesitant to use AI at all because nobody has told them what is allowed.
A patchwork of paid subscriptions with no owner and no review.
The template: seven sections to copy
A good AI policy for a small business fits on two pages. Longer than that and nobody reads it. Copy these seven headings and write two or three plain sentences under each one.
1. Purpose
State in one line why the policy exists: to let the team use AI tools like Claude confidently while protecting client data and the quality of your work. Set the tone as permission with guardrails, not a ban.
2. Approved tools
List the tools people are allowed to use and for what. Naming Claude as your default assistant keeps usage consistent and makes support easier. Add a simple rule: if a tool is not on the list, ask before using it for work.
3. What you can and cannot share
This is the section that matters most. Spell out clearly that customer records, employee details, financial data, passwords, and anything covered by a client contract must not be pasted into a tool unless that tool has been approved for it. Give a green list of safe inputs too, so people are not left guessing.
4. Human review
Require that a person checks AI output before it reaches a customer, a regulator, or a public channel. Claude is very good at drafting, but the accountable human is still your staff member. Make that explicit.
5. Accuracy and disclosure
Set the expectation that AI can be confidently wrong, so facts, figures, and quotes get verified. Decide where you will tell customers that AI helped produce something, and write that rule down once so it is applied the same way every time.
6. Data and privacy
Tie the policy back to your obligations under the Privacy Act and the Australian Privacy Principles. Note who owns data decisions, how long AI chat history is kept, and which tools have business terms that keep your inputs out of model training.
7. Who to ask
Name a single person or role who answers AI questions and approves new tools. A policy with no owner drifts within a month.
Adapt it to your Australian context
The seven sections are the skeleton. The detail depends on your industry and where your obligations sit. A Sydney accounting firm handling tax file numbers will write a much stricter data section than a landscaping business. If you operate under a professional code, a funding agreement, or standards set by a regulator such as ASIC or APRA, reflect those requirements in the policy rather than treating AI as separate from them.
Two practical adaptations are worth making for almost every Australian SMB. First, be specific about the Office of the Australian Information Commissioner guidance on handling personal information, so your privacy section is grounded in the rules you already follow. Second, match the strictness of your tool choices to the sensitivity of your work, using business-grade accounts with proper data terms where client information is involved.
Adopt it in a week
The best policy is the one people actually follow, so keep the rollout light:
Day one: copy the seven sections and fill them in with your own examples. Aim for two pages.
Day two: have the owner or manager read it and cut anything that is not clear in one pass.
Day three: walk the team through it in a fifteen minute session, using real tasks they do each week.
Rest of the week: pin it where people work, and review it once a quarter as tools change.
That is the whole job. A short, clear policy gives your team the confidence to use AI well and gives you the assurance that client data and quality are protected. If you would like help tailoring the template to your industry and your Privacy Act obligations, you can book a working session with us and we will build a version that fits how your business actually runs.
