Your staff are already using AI at work. Not only the tools you rolled out and trained them on, but the ones they signed up for themselves on a personal login: a chatbot open in another tab, a phone app that drafts their emails, a browser extension that tidies up meeting notes. This is bring-your-own AI, and for most Australian businesses it started well before anyone wrote a policy. The question is no longer whether to allow it. It is whether you want it happening in the open, with guardrails, or in the dark.
Why "no AI" is not a real policy
A blanket ban feels safe on paper. In practice it pushes usage underground. Staff still paste a client email into a personal chatbot to get a faster reply, they just stop telling you about it. You lose the two things a policy is meant to give you: visibility into what tools touch your data, and control over how. The Office of the Australian Information Commissioner (OAIC) does not care that a tool was unofficial when client information leaves your walls. Under the Privacy Act, a notifiable data breach is a notifiable data breach regardless of whether the app that caused it was on your approved list.
The cost of getting this wrong is not hypothetical. A single notifiable breach can run past $500,000 in response, notification and remediation work before any penalty is considered, and serious or repeated breaches now carry fines of up to $50 million for a company. A ban that everyone quietly ignores gives you all of that exposure and none of the oversight.
Picture a small Sydney accounting firm. Within a month of a new AI tool going mainstream, a third of the team is using it on personal logins to condense client documents, and the partners have no idea which client files have passed through it. Nothing has gone wrong yet, but the firm is now one careless paste away from a notifiable breach it would have to report. A one-page policy plus an approved account would have turned that quiet risk into a managed, visible workflow.
What a good employee AI policy actually covers
A useful policy is less about prohibition and more about giving people a clear, safe path to the productivity they are already chasing. Five things do most of the work:
Approved tools and accounts: name the AI tools staff may use for work, and require the business account rather than a personal login. A managed Claude plan lets you control data retention and keeps prompts out of consumer training pipelines. A personal login does neither.
Data rules: spell out what can and cannot go into a prompt. Client personal information, health records, financials and anything under a confidentiality clause stay out unless the tool sits on an approved plan with the right data terms.
Human review: define which outputs a person must check before they reach a client or a system of record. AI drafts, a human signs off. This single rule prevents most of the embarrassing failures.
Disclosure: set out when staff should tell a client or colleague that AI helped produce something, so nobody is caught out later.
Accountability: make clear who owns an AI-assisted output when it is wrong. The answer is the person who sent it, exactly as it has always been.
Australian specifics you cannot skip
Generic policies copied from an overseas template tend to miss the obligations that actually bind an Australian business. A few areas deserve their own lines:
Cross-border data: many AI tools process prompts on servers offshore. Australian Privacy Principle 8 makes you responsible for what an overseas recipient does with personal information you send, so know where an approved tool stores and processes data before you sanction it.
Regulated industries: entities overseen by APRA, such as banks, insurers and super funds, sit under CPS 234 information-security and third-party obligations that a casual AI sign-up will not satisfy.
Professional duties: law firms, accountants and financial advisers carry their own supervision, record-keeping and client-confidentiality rules that an AI policy has to respect, not override.
Workplace change: if adopting AI meaningfully changes someone's role or duties, the Fair Work Act consultation obligations in most modern awards and agreements can apply. Bring people along rather than surprising them.
Writing yours without killing the momentum
The policies people actually follow are short. Aim for one page a new starter can read in five minutes, and lead with what is allowed before the list of what is not. A wall of prohibitions reads as a wall to climb around, which is how you end up back in the dark.
Pair the policy with a sanctioned tool that is genuinely better than a personal login, so following the rules is the easy choice rather than the annoying one. Give staff a business Claude account, a couple of worked examples for their role, and a named person to ask when they are unsure. Then review the policy each quarter, because the tools and their data terms change faster than most internal documents do.
Bring-your-own AI is not a problem to stamp out. It is a signal that your team wants to work faster, and a chance to point that energy at the right tools under the right rules. If you would like help drafting an employee AI policy that fits your business and your obligations under Australian law, book a brainstorm.
