AI Policy Guide

## [Your Organisation's] AI Principles

### Why we're publishing these principles

AI is changing how we work. These principles guide our approach and hold us accountable. We're sharing them publicly because transparency builds trust with our team, clients, and partners.

Clear principles help everyone make confident decisions about when and how to use AI in their work.

### Our principles

#### 1. AI supports people, doesn't replace judgment

We use AI to enhance human capability, not substitute it. Decisions affecting people, strategy, or significant resources require human review.

**In practice**: Team members use AI for research, drafting, and analysis. Managers review and approve all AI-assisted work before it reaches clients or informs major decisions.

#### 2. Quality matters more than speed

We deploy AI when it improves outcomes, not just because it's faster. Every AI application must meet our quality standards.

**In practice**: We test AI outputs against our quality benchmarks. If AI-generated work doesn't meet our standards consistently, we don't use it for that purpose.

#### 3. We're transparent about AI use

We tell clients and stakeholders when AI contributed to our work. We're honest about AI capabilities and limitations.

**In practice**: Client deliverables note when AI tools assisted in research, drafting, or analysis. We explain our quality assurance process and human oversight.

#### 4. We protect your information

We safeguard client and personal data rigorously. We don't use confidential information to train AI models. We comply with Australian privacy law and our data protection obligations.

**In practice**: We use enterprise AI tools with data protection agreements. We never input client-identifying information or sensitive business data into public AI systems. We maintain detailed records of data handling.

#### 5. We respect intellectual property

We honour copyright and attribution. AI assists our work but doesn't replace proper citation or licensing.

**In practice**: We attribute sources properly. We verify AI-generated content doesn't plagiarise existing work. We respect copyright in all materials, including training data.

#### 6. We keep learning

AI evolves rapidly. We regularly review tools, update practices, and train our team on responsible use.

**In practice**: Quarterly tool evaluations, monthly team training, and open discussion of successes and failures. We document lessons learned and share them across the organisation.

#### 7. We address bias and ensure fairness

AI can perpetuate bias. We actively monitor for unfair outcomes and maintain diverse review processes.

**In practice**: We review AI recommendations for potential bias before implementation. Decision-making teams include diverse perspectives. We correct problems when identified.

### Accountability

**Owner**: [Leadership role/team name]  
**Review frequency**: Quarterly  
**Questions**: [email@yourcompany.com]

### Living document

These principles evolve as we learn. Last updated: [Date]

## AI Use Categories

### Approved uses (no approval required)

Your team can use AI for these tasks without seeking permission:

- **Research and information gathering**: Using AI to find information, summarise articles, or explore topics
- **First draft generation**: Creating initial versions of emails, reports, or presentations that will be reviewed
- **Brainstorming and ideation**: Generating ideas, exploring options, or working through problems
- **Learning and skill development**: Using AI as a learning tool or to understand new concepts
- **Code assistance**: Getting help with syntax, debugging, or understanding programming concepts
- **Data analysis support**: Using AI to identify patterns, create visualisations, or suggest analytical approaches

**Requirements**: All outputs must be reviewed by a human before use. Never input confidential client data or sensitive business information.

---

### Requires approval (manager sign-off needed)

These uses require written approval from your manager:

- **Client-facing content**: Any material that will be shared directly with clients
- **Financial analysis**: AI-assisted financial modelling, forecasting, or investment recommendations
- **HR decisions**: Using AI to screen candidates, assess performance, or inform employment decisions
- **Legal interpretation**: AI assistance with contracts, compliance, or legal matters
- **Strategic planning**: AI input into business strategy or significant resource allocation
- **Public communications**: Media releases, social media posts, or public statements

**Requirements**: Submit your use case to your manager. Explain the AI tool, intended use, and quality assurance process. Wait for written approval before proceeding.

---

### Prohibited uses (not permitted)

Your team must not use AI for:

- **Processing sensitive personal information**: Health data, financial information, or government identifiers
- **Automated decision-making**: Decisions about people without human review (hiring, firing, promotion, credit assessment)
- **Legal advice to clients**: AI cannot replace qualified legal counsel
- **Financial advice or transactions**: AI cannot make investment decisions or execute trades
- **Bypassing security controls**: Using AI to circumvent data protection or access controls
- **Creating deepfakes or misleading content**: Generating fake images, videos, or audio of real people
- **Replacing required human oversight**: Any regulated activity requiring professional judgment

**Requirements**: Don't do these things. If you're unsure whether your use case falls into this category, ask your manager before proceeding.

## AI Governance Framework

### Ownership and accountability

**AI Policy Owner**: [Name, title]  
**Responsibilities**:
- Maintain and update AI policy quarterly
- Review high-risk AI use cases
- Monitor compliance with policy
- Report AI-related incidents to leadership
- Coordinate training and communication
- Maintain approved AI tooling register

**Executive Sponsor**: [Name, title]  
**Responsibilities**:
- Approve policy changes
- Allocate resources for AI governance
- Champion responsible AI use across organisation
- Escalate significant issues to board

### Stakeholder roles

**Leaders**:
- Participate in quarterly reviews and education updates
- Actively leverage tools to build AI fluency
- Model responsible use for their teams

**Managers**:
- Ensure team compliance with policy
- Identify safe, high-value AI use cases
- Approve moderate-risk requests from team members

**CTO / IT Security**:
- Maintain approved AI tooling register and configurations
- Review medium/high-risk requests and run quarterly risk reviews
- Provide technical guidance and training support

**All users**:
- Follow policy and complete annual training
- Ask for help if unsure about a scenario
- Report incidents immediately

### Approval process for new AI tools

Before deploying a new AI tool or service:

1. **Submit request** to AI Policy Owner with:
   - Tool name and vendor
   - Intended business use
   - Data it will access
   - Number of users
   - Cost and contract terms

2. **Risk assessment** completed within 5 business days:
   - Data protection and privacy
   - Information security
   - Compliance requirements
   - Vendor reliability

3. **Decision** communicated with:
   - Approval or rejection
   - Any conditions or restrictions
   - Training requirements
   - Monitoring approach

### Tool approval categories

**Approved (enterprise-managed)**:
Use organisation-managed accounts for approved enterprise tools. Follow configurations maintained by CTO/IT Security.

**Conditionally approved**:
Specialist tools are acceptable when they run inside the organisation tenant and appear on the Approved AI Tooling Register.

**Not approved**:
Do not use consumer or personal versions of any AI tool for work content, even if you hold a paid subscription.

### Incident reporting

Report AI-related incidents to the AI Policy Owner immediately:

- Data breach or privacy violation
- Significant inaccuracy in AI output used for decisions
- Bias or discrimination in AI recommendations
- Regulatory inquiry or complaint
- Vendor security incident
- Unauthorised AI tool usage
- Compromise of authentication credentials

### Review schedule

- **Monthly**: Review incident reports and usage metrics
- **Quarterly**: Update policy based on lessons learned
- **Annually**: Comprehensive review with external benchmarking