AI governance: simple rules for using AI safely at work
2026-11-10
Definition
AI governance is the set of rules, roles and checks that decide how a business may use AI, what data may go into it, who approves new tools and who answers when something goes wrong.
What a small business needs
You do not need a committee. You need a short written policy that answers a few questions. Which tools are approved? What information must never be entered, such as client financials, health records or staff files? Which outputs need a person to check them, as covered in human in the loop? Who owns the list and updates it? Clear rules make shadow AI less likely, because staff know what is allowed.
Your privacy obligations under the Privacy Act 1988 and any industry rules still apply when AI is involved. This page gives general information only, so get advice from a qualified professional for your situation. A review of AI readiness is a sensible time to write the first version. The OAIC publishes guidance on commercial AI products, and our guide to writing an AI use policy gives a starting template.
A hypothetical example
Picture a ten-person accounting firm. Its one-page policy lists two approved assistants, bans pasting tax file numbers into any tool and requires a partner to review any AI-drafted advice before it is sent.
Policy design is included in our AI strategy work.