AI has moved into Australian workplaces faster than most policies can keep up. Citation Group’s Workforce Pulse Report shows adoption now sits at 48 per cent of small businesses, 65 per cent of medium businesses and 73 per cent of large businesses, but only 29 per cent of businesses using it strongly agree it’s being used safely and appropriately – a figure that drops to just 23 per cent among medium businesses. That gap between adoption and governance is where the risk sits, and a clear AI policy is one of the highest-leverage steps HR managers and business owners can take to close it.

What happens without a policy

Without a policy, employees decide for themselves which AI tools to use and what information goes into them. Those calls can be expensive and risky decisions to unwind.

The most common risk is confidential information ending up in external AI platforms with unclear data retention practices. Information like client records, financial data, employee details, and commercial strategies should never be placed into AI tools. Once that information is uploaded, a business loses control over where it’s stored, who can see it, or whether it’s used to train someone else’s model. That’s a data breach waiting to happen, and it can cost a business its clients’ trust long before it costs a fine.

From 10 December 2026, new obligations under the Privacy Act 1988 will require businesses to disclose their use of automated decision-making in their privacy policies. Businesses using AI to help with hiring, performance management or customer decisions will need documented governance in place well before that deadline.

There’s a legal angle too. The Fair Work Commission has flagged rising workload linked to AI-assisted claims, with President Justice Adam Hatcher briefing the Victorian Bar Association in February 2026 on how AI is helping employees build faster, more sophisticated grievances. Poorly managed AI use in disciplinary processes raises the risk of procedural errors and costly disputes.

Then there’s shadow AI – tools staff pick up without approval. When nobody’s assessed what’s being used, the business has no visibility over what data is shared or with whom. A policy closes that gap by defining what’s approved, what’s conditional and what’s off-limits.

Building the policy

An AI policy doesn’t need to be complicated – clear, practical rules beat dense language every time. The core elements:

1.     Scope and definitions. Cover employees, contractors and volunteers, and define what counts as an “AI tool” – generative platforms, AI-assisted features, automated decision-making systems.

2.     Approved tools register. Sort tools into approved, conditional and prohibited categories, and review the list every quarter – a tool cleared six months ago might not meet today’s standard.

3.     Acceptable use guidelines. Spell out what’s encouraged (drafting internal comms, summarising notes, first-draft content) and what’s not (final hiring decisions, client-facing advice without human review).

4.     Prohibited inputs. List what must never go into an AI tool: personal information, passwords, confidential strategies, anything covered by a non-disclosure agreement.

5.     Output verification and human oversight. Require staff to check AI-generated content before acting on it or sending it externally.

6.     Monitoring and enforcement. Set out how usage is monitored and what happens on a breach – a refresher conversation for a first, minor slip; formal steps for anything serious or repeated.

Making it stick

Writing the policy is the easy part. Start with an audit: a short staff survey on which AI tools are already in use, for what, and how often. That gives an honest read on real exposure, not assumed exposure.

Training should match the risk. A payroll officer and a customer service representative face different AI risks, so build role-specific modules where it matters.

Someone needs to own the policy – typically an HR manager or operations lead – responsible for reviewing the tools register quarterly, updating the policy yearly, fielding questions, tracking breaches and watching for regulatory change, including the Privacy Act update landing in December 2026. New starters should get this training as part of induction, before habits form without it.

Why it’s worth doing

A documented AI policy does more than manage risk – it gives staff the confidence to use AI productively instead of avoiding it or using it carelessly. Unclear governance also leaves businesses less prepared to respond when a formal grievance, AI-drafted or not, lands on the desk.

The practical payoff:

•      Compliance support ahead of the December 2026 automated decision-making transparency requirements.

•      Lower legal risk around AI use in performance and disciplinary processes.

•      Data security, through prohibited inputs and classification rules.

•      Staff confidence – clear rules remove the guesswork that leads to either avoidance or recklessness.

•      Accountability, through defined and predictable consequences for breaches.

The time it takes to draft and roll out a policy is modest next to the cost of a single data breach, regulatory inquiry or employment dispute.

How Citation HR can help

HR policies are a simple way to ensure your business is well-equipped to handle several common workplace issues. Our HR software solution allows you to download HR policies and more. Better yet, Citation HR’s workplace relations specialists will draft tailored HR policies to suit your unique business needs.

If any of this information has raised questions or concerns about AI workplace regulations for your business or you have another workplace matter you need assistance with, why not put our HR advice to the test? Arrange a complimentary workplace compliance consultation today.

FAQ’s