AI policy template for NZ and Australian teams.
A one-page AI acceptable use policy for a team on Claude or ChatGPT, shown in full below. Copy it, fill in the brackets, and you have a policy people will actually read. No email needed.
The short answer
An AI policy for a small or mid-sized business fits on one page. It names the approved AI tools and plans, says what information may and may not go into them, requires a person to review anything before it is sent, posted or paid, names an owner, keeps a register of every AI tool and agent, says how to report an incident, and sets a review date. The template below does exactly that for a team on Claude or ChatGPT, with each section mapped to the six practices of Australia's Guidance for AI Adoption, and it applies equally in New Zealand under the Privacy Act 2020.
The one-page AI policy template
Eight sections, written for a team on Claude, ChatGPT or Copilot. Replace everything in square brackets. The label on each section shows which AI6 practice it serves; it is left out when you copy.
[Company name] AI policy
1. Purpose
AI6 practice 1This policy sets out how [Company name] uses AI tools such as Claude and ChatGPT. It applies to everyone who works for us, including contractors, and to every AI tool used for our work.
We use AI to work faster and better. We stay responsible for everything we send, publish or decide, whether or not AI helped.
2. Approved tools and plans
AI6 practice 1Approved: [for example, Claude Team, ChatGPT Business, Microsoft Copilot]. Use only these, on the company plan, signed in with your work account.
Do not use personal AI accounts for work. To request a new tool or connector, ask the AI owner (section 5) before you start.
3. What may and may not go in
AI6 practices 2 and 3May go in: our own documents, drafts, public information, and customer or staff information where the approved tool and the task need it.
Must not go in: passwords and access keys, payment card details, health information, [anything a client contract forbids], and anything into a tool that is not on the approved list.
If you are unsure, leave it out and ask.
4. Human review before anything is sent, posted or paid
AI6 practice 6A person reads and approves AI output before it is sent to a customer, posted publicly, used in a decision about a person, or used to pay or change money.
AI agents may [read / draft] on their own. Anything that sends, publishes, deletes or pays waits for a named person to approve it.
5. Accountability and owner
AI6 practice 1AI owner: [Name, role]. They approve new tools and agents, keep the register, and can pause any AI use.
Each tool or agent in the register also has its own named owner, responsible for how it is used and what it does.
6. Register of AI tools and agents
AI6 practices 3 and 5The AI owner keeps a register at [location] listing every AI tool and agent in use: what it is for, who owns it, what data and systems it can access, what it may do on its own, and its review date.
If it is not in the register, it is not approved.
7. Incidents
AI6 practices 4 and 5Report to the AI owner the same day if AI output was wrong and reached a customer, if information went somewhere it should not, or if an agent did something it was not meant to.
The owner records what happened, fixes the cause and updates this policy or the register. If personal information is involved, we follow our privacy breach process.
8. Review date
AI6 practice 5This policy was approved by [Name] on [date] and will be reviewed by [date, no more than six months later], or sooner if we adopt a new tool, give an agent new access or have an incident.
Ours, or the official AI policy template?
The National AI Centre publishes its own policy guide and template as part of the Guidance for AI Adoption, alongside an AI screening tool, an AI register template and a glossary. It is thorough and worth reading, especially if you are in Australia and want to work through all six practices.
Ours is deliberately shorter: one page, for a team whose AI is mostly Claude or ChatGPT, written so the people it applies to will read it. Both point at the same practices. If you outgrow ours, the official template and ISO 42001 are where a fuller policy goes next.
AI policy notes for New Zealand and Australia
The template works in both countries. These are the differences worth knowing when you fill it in. General information, not legal advice.
New Zealand
There is no AI-specific law. The Privacy Act 2020 applies to personal information whether a person or an AI tool handles it, so section 3 is where most of the care goes. Collect only what the task needs, keep it on the approved plan, and keep the register current so you can say where information went.
Australia
The Privacy Act applies in the same way, and privacy policy changes due in December 2026 require disclosure of automated decisions that significantly affect individuals. If AI helps make a decision like that, say so in your privacy policy as well as here. The national reference point is the voluntary Guidance for AI Adoption and its six practices.
Both
Consumer law applies to what you publish whoever drafted it, which is why section 4 holds anything customer-facing for a person to approve.
Making it stick
A policy nobody follows is not governance
The policy is the easy part. What makes it real is the register in section 6 being current and the review in section 4 actually happening. Most businesses find more AI tools in use than they expected the first time they look, which is why we start with finding the AI staff already use.
For section 3, our worked AI risk register shows how to decide what may go in for each use. Sentry AI sets up the register, the policy and the decision trail on your own Claude or ChatGPT workspace. We are not a law firm, and this template is not legal advice.
Frequently asked questions
What is an AI policy template?
A starting document a business adapts into its own AI policy: which AI tools staff may use, what information may and may not go into them, who checks the output, who is accountable and how incidents are handled. A template saves the blank page; the value comes from filling in the names, tools and dates that make it yours.
What should an AI acceptable use policy include?
At minimum: the approved tools and plans, what may and may not be entered into them, which outputs need a person to review them before they are sent, posted or paid, a named owner, a register of the AI tools and agents in use, how to report an incident, and a review date. Anything longer than a page or two tends not to be read.
Does the Australian government publish an AI policy template?
Yes. The Guidance for AI Adoption from the National AI Centre includes a policy guide and template, alongside an AI screening tool, an AI register template and a glossary. Ours is a shorter, one-page version for a team working in Claude or ChatGPT, with each section mapped to the six AI6 practices.
Do New Zealand businesses need an AI policy?
No law in New Zealand requires one. New Zealand has no AI-specific legislation and relies on existing law, principally the Privacy Act 2020, which applies to personal information whether a person or an AI tool handles it. A short policy is the simplest way to show staff how to stay inside that law when they use AI.
Should staff use personal ChatGPT or Claude accounts for work?
Not for anything involving customer, staff or company information. Work like that belongs on a business or team plan the organisation administers, so it controls who has access, which settings apply and what happens when someone leaves. The policy should say so in one sentence.
How often should an AI policy be reviewed?
Set a fixed date, a quarter or six months out, and review sooner when you adopt a new tool, give an agent new access or have an incident. AI tools change faster than most policies, so a review date that is actually kept matters more than the length of the document.
Is this AI policy template legal advice?
No. It is a practical starting point written by a team that sets up AI for businesses, not by a law firm. Adapt it to your business, and ask a lawyer where you have specific legal obligations, for example in a regulated industry.
A policy is a start. The register is the proof.
The free AI Readiness Check shows which AI tools are in use across the business, which is the register section 6 asks for. If the gaps are real, a short call covers what setting it up involves.
Ask an AI about this page
Opens the assistant with this page loaded: read it, summarise it, cite it.