How to Develop AI Policies That People Use

An employee pastes meeting notes containing customer information into a public AI tool to save time. Another uses Copilot to draft a report, but cannot explain where several claims came from. These are not simply technology issues, they are everyday leadership, capability and governance issues. Knowing how to develop AI policies means creating clear guardrails that help people make sound decisions when the pressure to work faster is real.

A policy that only tells people what they cannot do will quickly be ignored, worked around or misunderstood. Effective AI policy gives your workforce practical direction: what tools are approved, what information is off limits, when human judgement is required and where to seek help. It turns responsible AI from a legal document into a workplace habit.

Start with the outcomes you want to protect

Before writing rules, clarify why your organisation is using AI and what must not be compromised in the process. For many Australian organisations, the priority is not adopting every new tool. It is improving productivity, service quality, decision making and employee capability without risking privacy, security, intellectual property, fairness or public trust.

Bring together leaders from people and culture, technology, cyber security, privacy, legal, risk, procurement and operational teams. Their perspectives will differ, and that is useful. A policy designed only by IT may be technically sound but difficult to apply. A policy designed only by legal teams may reduce risk on paper while giving employees little confidence to use AI productively.

Set several clear principles that reflect your organisation's values and operating environment. For example, AI should support, not replace, accountable human judgement. Use should be transparent where it affects customers, employees or community members. Sensitive information should be protected. Outputs must be checked before they influence a decision or are shared externally.

These principles create a reference point for situations your policy cannot predict, which will be many. AI tools, embedded features and risks change too quickly for a document to provide a rule for every scenario.

Map real use before setting the rules

The quickest way to write an irrelevant policy is to assume you already know how employees are using AI. Talk to teams across the organisation, including frontline staff, managers, subject matter experts and support functions. Ask what tasks they are automating, drafting, researching or analysing, and which tools they are already testing.

This discovery often reveals both opportunity and exposure. A communications team might be using AI to create first drafts, while a customer service team may be entering case details into an unapproved platform. Neither finding should automatically trigger blame. People often use unsanctioned tools because they are trying to solve a genuine work problem with no approved alternative.

Map use cases by impact, not just by tool. Low risk activity might include brainstorming a workshop agenda using non sensitive prompts. Higher risk activity may involve recruitment shortlisting, performance management, financial decisions, customer eligibility or material supplied to government and community stakeholders. The more significant the impact on a person, the stronger the controls, review and approval should be.

How to develop AI policies around practical decisions

The best AI policies answer the questions employees face at the moment of use. Plain language matters more than policy length. If someone needs ten minutes to work out whether they can use an AI assistant, they are unlikely to make a consistent decision.

Your policy should clearly cover approved tools and accounts, permitted uses, prohibited uses, data handling, ownership and intellectual property, human review, disclosure, record keeping, incident reporting and consequences for misuse. It should also state who owns decisions about new AI tools and how staff can request approval for a new use case.

Avoid treating all AI as the same. An enterprise approved assistant operating within existing security settings is different from a free public chatbot. AI features already embedded in software, such as Microsoft 365, can also create confusion because employees may not recognise when an AI function is processing information. Name the platforms your policy applies to, while making the underlying rules broad enough to cover technology that emerges later.

A simple decision pathway is more useful than pages of general statements. Employees should be able to ask: Is this tool approved? Am I using any personal, confidential or commercially sensitive information? Could this output affect an individual or a high consequence decision? Has a qualified person checked the result? If the answer raises doubt, the next step should be obvious, pause and seek guidance.

Be specific about data, decisions and disclosure

Data rules deserve particular care. Define the categories of information that cannot be entered into external AI tools, such as personal information, health information, customer records, security details, commercially confidential material and information subject to legal or contractual restrictions. Consider obligations under the Privacy Act, Australian Privacy Principles, state based privacy requirements and sector specific standards, with advice from the appropriate specialists.

Human oversight needs equal clarity. AI can produce persuasive language, incorrect facts, biased recommendations and fabricated sources. It can also reproduce patterns that disadvantage particular groups. State that staff remain accountable for the quality, accuracy and appropriateness of work produced with AI. For higher impact uses, specify the required review process, approver and evidence that must be retained.

Disclosure depends on context. A draft internal agenda may not need an AI label. A public report, customer communication or decision affecting an employee may require transparency about how AI was used. Your policy should set a proportionate approach rather than demanding disclosure in every situation.

Design governance that enables progress

Governance should not become a bottleneck that drives people back to shadow use. Create a practical approval process with different pathways for low, medium and high risk use cases. Low risk experimentation may need manager endorsement and an approved tool. High risk applications should involve privacy, security, legal, risk and executive review before implementation.

Assign named accountabilities. Senior leaders set risk appetite and model responsible behaviour. Technology teams manage platform controls and access. People leaders ensure staff understand expectations in the flow of work. Employees use AI within the agreed boundaries and raise concerns early. Without these roles, policy ownership becomes vague and issues are discovered too late.

Review third party suppliers as carefully as the AI functionality itself. Ask how data is stored and used, whether it is used to train models, where it is processed, what audit information is available and how the provider manages incidents. Procurement decisions should reflect the actual use case, not just a generic assurance statement.

Build capability, not just compliance

Publishing a policy does not change behaviour. People need to practise applying it to realistic scenarios: drafting a proposal, analysing survey comments, preparing a recruitment brief or responding to a customer request. This is where confidence grows, particularly for managers who must balance productivity with accountability.

Training should explain the policy and build practical judgement. Participants need to recognise data risks, write safer prompts, verify outputs, identify bias and know when escalation is required. Leaders also need the confidence to have consistent conversations with their teams, rather than responding with blanket bans or untested enthusiasm.

Make support visible after training. Provide a short decision guide, approved use case examples, a channel for questions and a process for reporting mistakes without unnecessary shame. Early reporting is one of the strongest protections an organisation can build.

Treat the policy as a living capability tool

Set a review cycle, but do not wait for the annual review if a new tool, incident, regulatory change or major use case changes your risk profile. Measure more than completion rates. Look at approved use case adoption, employee confidence, reported issues, time saved, quality outcomes and whether teams are avoiding risky workarounds.

People Tank works with organisations to turn AI governance into practical workplace capability through tailored policy support, leader development and hands on AI learning. The aim is not a perfect document sitting on an intranet. It is a workforce that can use AI with curiosity, care and sound professional judgement.

Start with one question for your next leadership meeting: if an employee used AI on an important task tomorrow, would they know what good judgement looks like? The answer will show where policy, systems and learning need to work together.