How to Write a One-Page AI Policy (With a Checklist)
Quick answer
A small business AI policy is one page that says which AI tools staff may use, what they may paste in, and who checks the output.
- It brings hidden "shadow AI" use into the open
- Customer details stay out of personal accounts
- A named person approves new tools
- Review it every six months
If your staff use AI and nobody has written down the rules, you already have an AI policy. It's just the one each person made up on their own.
A written AI policy stops that. Government templates are thorough, and long for a five-person business. One page that staff actually read does more.
What Is an AI Policy for a Small Business?
An AI policy is a short written rule for how your team uses AI tools at work. For a small business, it should fit on one page and answer three questions: which tools, what data, and who checks.
The National AI Centre's guide to creating an AI policy says the same in longer form. It wants the policy to cover what AI can be used for and what data goes in. It also asks who approves riskier uses, how misuse gets reported, and when the policy is reviewed. Its Guidance for AI Adoption, released on 23 October 2025, adds a free policy template.
Here's what doing nothing costs, as a worked example. Say four staff each paste five customer emails a day into personal accounts.
Customer records in personal accounts
- Customer records pasted a day (four staff, five each), 20
- × Working days a week, 5
- × Working weeks a year, 48
- = Customer records a year, about 4,800
You can't list them, delete them or explain them to a customer who asks.
Why Is Shadow AI the Real Reason You Need an AI Policy?
Shadow AI is staff using AI tools for work outside any approved rule. It's likely already happening in your business, and small business owners see the least of it.
Jobs and Skills Australia's August 2025 report cites studies finding 21% to 27% of workers use generative AI secretly at work. The same report found 83% of white-collar staff at large firms were open with their employer about AI use. At small businesses, only 57% were.
The National AI Centre's page on managing unapproved AI use explains why people hide it. Some feel it's cheating, and others don't want to look lazy. It calls shadow AI "a signal of unmet need, time pressure, or curiosity." The fix is a safe, approved way to do the same job, written down where staff can see it.
What Goes in a One-Page AI Policy?
The one-page AI policy UnderCurrent Automations gives clients has six short sections. Each one is a rule a staff member can follow without asking.
The one-page AI policy, section by section
- Approved tools. The exact tools and plans staff may use, on business accounts only.
- What can go in. Public information and drafts, yes. Customer, health or money details and passwords, never.
- Who checks the output. A person, named by role, reads anything a customer will see.
- New tools. Staff ask one named person, who answers within a week.
- Mistakes. Staff report anything sensitive that went in the same day, with no blame.
- Review date. Six months out, at the bottom of the page.
Business plans matter because of training. Anthropic says it won't train on inputs from its commercial plans by default. At UnderCurrent we use Claude, and we don't switch every month, because switching wastes time. The tool list also shows the jobs worth turning into a custom workflow.
Should You Ban AI, Ignore It or Write a Rule?
Writing a rule beats banning or ignoring AI, because it's the only option that tells you what staff actually do. A ban pushes use onto personal phones, and ignoring it leaves you guessing.
| What happens | Ban AI tools | Ignore it | One-page AI policy |
|---|---|---|---|
| Where staff use AI | Personal phones, in secret | Personal accounts, openly | Approved business accounts |
| Where customer data goes | Unknown | Unknown | Kept out of chatbots by rule |
| What the owner knows | Nothing | Very little | A list of every tool in use |
| Time saved by staff | Hidden, not shared | Kept by one person | Shared across the team |
The OAIC's guidance on AI products says the Privacy Act applies to all uses of AI involving personal information. It recommends keeping personal information out of public AI chatbots. A ban can't enforce that on a staff phone, but an approved tool can. The Voluntary AI Safety Standard adds 10 guardrails, and following them is voluntary.
What Did a Pre-Launch Audit Teach Us About Hidden Risks?
The risks that hurt small businesses are usually the ones nobody listed. An AI policy is mostly a list of tools and rules, so it brings those risks into view.
In a recent audit we ran, a property advisory firm in Melbourne was about to launch its new website. We found 18 old backup pages publicly live on the production site. The site's photos also carried location data accurate to about 1 metre. Both were removed before launch.
Nobody at the firm put those pages there on purpose. They were left over from old builds, and no one had a list to check against. Shadow AI works the same way: a free account here, a browser add-on there. In our own audits, what leaks is usually something nobody listed. That's why our consulting work starts by mapping what's really in use.
Is Your AI Policy Ready? A Checklist
Your AI policy is ready when every box below is ticked. Each item is one line on the page.
The one-page AI policy checklist
If you'd like UnderCurrent Automations to write your one-page AI policy with you and find where data leaks today, book a consult.
Frequently asked questions
Is an AI policy a legal requirement in Australia?
An AI policy isn't a legal requirement for an Australian small business on its own. But if your business is covered by the Privacy Act, the OAIC says those privacy duties apply to any personal information put into an AI tool. They also apply to what comes back out. A written AI policy is the simplest way to show staff how to meet those duties day to day, and to show a customer you thought about it.
Is there a free AI policy template for Australian businesses?
Yes, the National AI Centre offers a free AI policy guide and template on ai.gov.au, published as a Word file on 22 April 2026. It covers principles, expected behaviours, roles, approval points and review. It's thorough, so many small businesses use it as a reference and boil it down to one page. The one-page version keeps the parts staff use daily: approved tools, data rules, checks and reporting.
What is the difference between an AI policy and AI governance?
An AI policy is the written rule staff follow, while AI governance is the whole system around it. Governance covers who's accountable, how risks are checked, how tools are tested, and how use is monitored over time. For a small business, governance can be as simple as one named owner, a list of tools, and a review date. The policy is the page, and governance is the habit of keeping that page current.
Can I ban staff from using ChatGPT at work?
You can ban ChatGPT at work, but a ban rarely stops the use. Staff who find it saves time often keep using it on personal phones, where you can't see what goes in. The National AI Centre suggests making it safe for people to say what they use instead. A better approach is to approve one business tool, set a clear data rule, and invite staff to bring their existing habits into the open.
Does an AI policy need to cover AI features inside existing software?
Yes, an AI policy should cover AI features built into software you already pay for, not only chatbots. Many email, document and accounting apps now include AI assistants as standard. Staff may not even think of them as AI tools. Add a line to the approved tools section listing which built-in features are allowed. Then ask your admin to switch off the ones that aren't.
