Most small businesses don’t need a complicated AI policy. They need three clear rules.
The templates doing the rounds at the moment are written for organisations with AI governance committees, IT security teams and legal departments. They come with AI registers, risk ratings, annual audits and mandatory training programs.
Hand one of those to a business with twelve staff and one of two things usually happens. It gets signed and forgotten, or nobody gets around to signing it at all.
Neither outcome protects your business.
An unenforced rule can create more problems than it solves
Many AI policies prohibit staff from using ChatGPT, Copilot, Claude or similar tools without written approval.
But here’s the reality: your team may already be using them. Often daily, and usually with good intentions. They’re trying to write a quote faster, respond to an email or get through their workload.
The problem is that your business may have a documented standard that nobody follows and nobody enforces.
If a workplace issue arises, you’ll need to demonstrate that your expectations were clear, staff understood them and the rules were applied consistently.
A policy that exists only on paper won’t do much to help you.
Four reasons a small business AI policy matters
1. You need clear expectations before something goes wrong.
If an employee pastes confidential client information into an AI tool and you’ve never established a standard, managing the situation becomes harder.
You may still be able to take action for serious misconduct without a specific AI policy. But for everyday situations involving carelessness, unclear expectations or a genuine misunderstanding, having a documented policy can make a real difference.
It gives you a clear starting point for managing the issue fairly and consistently.
2. Your team may be sharing information without realising the risk.
Think about the information your staff handle every day: client names, pricing, financial records, personal details and confidential business information.
If that information is entered into an AI platform that hasn’t been approved, you may lose control over how it’s processed, stored or used.
Not every AI tool handles information in the same way, which is exactly why your team needs clear boundaries.
3. You could be exposing your business to contractual and privacy risks.
Your client agreements may contain confidentiality obligations. Your employees might not know the detail of those agreements, but your business is still responsible for managing its obligations.
The Privacy Act 1988 may also apply, depending on your business and the information involved. An unauthorised disclosure of personal information can create serious consequences, including potential obligations under Australia’s notifiable data breach scheme.
An AI policy isn’t a substitute for privacy compliance, but it is an important part of setting expectations around how information is handled.
4. You could miss out on work.
This is the commercial side of the issue that often gets overlooked.
Larger clients are increasingly interested in how their suppliers manage information, technology and risk. AI governance questions may appear in tender documents, supplier questionnaires and client onboarding processes.
If your business can’t explain how staff use AI safely, you may struggle to satisfy those requirements.
A practical policy can help you demonstrate that your business takes responsible AI use seriously.
The three rules your AI policy should cover
You don’t need a twenty-page document to get started. You need rules your team can understand and follow.
Rule 1: Which AI tools are approved?
List the tools your team can use and explain who approves new ones.
In a small business, that person will often be the owner or manager. The important thing is that staff know they can’t simply introduce a new tool and start uploading business information without approval.
Rule 2: What information must never be entered?
Be specific.
This might include client names and records, personal information, health information, financial records, passwords and commercially sensitive material.
Don’t leave employees guessing about what’s acceptable. Set clear boundaries that reflect your business, your clients and your privacy obligations.
Rule 3: Who is responsible for checking the output?
AI can produce incorrect information, make assumptions and confidently get things wrong.
Any AI-generated content should be reviewed by a person before it is sent to a client, used in recruitment, relied on for payroll or published.
The person using the output remains responsible for checking it. AI is a tool, not a substitute for professional judgement.
Three straightforward rules. Much more useful than a complicated policy nobody reads.
Don’t forget to connect your policy to your employment contracts
This is where many businesses stop short.
Writing a policy is one thing. Making sure it forms part of your workplace expectations is another.
Your AI policy should be consistent with your employment contracts and broader workplace policies. Staff should receive the policy, understand what is expected of them and acknowledge that they’ve received it.
Your contracts should also address the application of workplace policies and the consequences of failing to follow reasonable and lawful directions.
The exact wording matters. Simply stating that every policy breach automatically justifies dismissal won’t necessarily make it so. Any disciplinary response still needs to be lawful, reasonable and appropriate to the circumstances.
This is the same principle that applies to other workplace policies. Your award sets minimum employment conditions, while your contracts and policies help establish how expectations and conduct are managed.
They need to work together.
What about using AI in recruitment?
Recruitment deserves particular attention because the risks go beyond confidentiality.
Using AI to screen applications, rank candidates or make recommendations can introduce bias and lead to discriminatory outcomes. Employers need to consider how these tools affect their hiring decisions rather than assuming responsibility sits with the software provider.
If you use AI in recruitment, keep meaningful human oversight in place. Understand how the tool is being used, check its limitations and make sure your selection decisions can be explained and justified.
For many small businesses, the simplest approach is to use AI for administrative support while keeping candidate assessment and hiring decisions with a person.
Where should you start?
If your business doesn’t have an AI policy, start here:
- Document which AI tools staff can use.
- Set clear rules around confidential and personal information.
- Require human review of AI-generated work.
- Give the policy to your team and record their acknowledgement.
- Review your employment contracts and related workplace policies to ensure everything works together.
- Nominate someone to approve new tools and manage questions.
You don’t need to overcomplicate it. You need something practical, relevant to your business and clear enough for your team to follow.
Need an AI policy for your small business?
Your team doesn’t need another document that sits in a folder and gets forgotten. You need clear expectations that fit the way your business actually operates.
At Kindred HR, we help small businesses put practical HR foundations in place, including workplace policies and employment contracts that work together.
We can help you develop a plain-English AI use policy, establish clear rules for your team and review how it fits within your existing employment documentation.
Fixed-price options are available, with your scope and fee confirmed before work begins.
Ready to put the right foundations in place? Contact Kindred HR to discuss what your business needs.