AI Use Policy: One in Three Staff Use AI in Secret. Silence Is Not a Policy.
One in three Australian workers now use AI tools at work without their employer knowing. That use is happening whether or not you have rules for it. Without an AI use policy, client information, fabricated facts and unmanaged cyber exposure become your problem. Here is what is at stake, and what a practical policy should say.
Your team is already using AI. The only open question is whether you know what they are putting into it.
Research released by Employment Hero in July 2026 found that one in three Australian workers use AI tools at work without their employer knowing. Forty-four per cent of employers say staff are using personal AI accounts on the job. A Salesforce survey from May 2026 found that 56 per cent of workers using AI at work rely on tools their employer never approved.
None of that is a reason to panic. Most of the use is ordinary. Someone rewords an email, summarises a report or drafts a quote. The problem is not the tool. The problem is that without an AI use policy, you have no say over which tools are used or what goes into them. Nobody checks the output before it reaches a client, a court or a regulator.
That gap creates five hidden risks:
Confidential and personal information leaves your business through a public chatbot, often into a tool that may keep it.
Confident but wrong output goes out under your name, unchecked.
You cannot fairly discipline behaviour you never defined.
Personal accounts sit outside your security controls, and AI tools give attackers new ways in.
Work your business paid for may attract no copyright at all.
Every one of those risks has already cost an Australian organisation something real. A Victorian lawyer lost the right to run his own practice. A state child protection agency was ordered to block all generative AI tools on its network for 2 years. A small hospitality employer lost an unfair dismissal case over a redundancy email drafted by ChatGPT.
The answer is not a ban. Bans push use underground and take away the visibility you need. The answer is a short, plain-English AI use policy. It lists the approved tools, specifies what must never be entered, requires a human to check anything that leaves the business, and identifies who is accountable. The Australian Cyber Security Centre now recommends exactly that for small businesses.
If you do nothing else this month, do that. The rest of this article explains why, risk by risk and sector by sector, and gives you a checklist to build it.
The point in one minute
One in three Australian workers use AI at work without telling their employer. Silence does not stop it. It only removes your control.
The five exposures are confidentiality, accuracy, discipline, security and ownership. Each has a live Australian example.
A two-page AI use policy fixes most of it: approved tools, a never-enter list, a verification rule, disclosure triggers and a named owner.
Regulators have moved. The OAIC, Ahpra, the Tax Practitioners Board and the Fair Work Commission have all published AI expectations that apply to your staff today.
Free Resource: The AI Use Policy Starter Checklist
A practical, six-part checklist for building or testing a small-business AI use policy. Work through every item. Anything unticked is a gap your staff are filling with guesswork.
Digging Deeper
Silence is the riskiest policy you can have
The numbers are consistent across every study. Jobs and Skills Australia reported in 2025 that between 21 and 27 per cent of workers, mostly in white-collar roles, use generative AI without their manager knowing. Employment Hero puts the 2026 figure at 34 per cent. A PagerDuty survey of 250 Australian office professionals found that 70 per cent had used AI tools at work while believing it was against company policy.
The reasons people hide it are revealing. Forty-two per cent say using AI to do parts of their job feels like cheating. Others fear being seen as incompetent. More than half taught themselves on YouTube or TikTok rather than through anything their employer provided. That is a workforce guessing at the rules because nobody wrote any.
Consider what happened when a Victorian child protection worker used ChatGPT to draft a report for the Children’s Court. The Office of the Victorian Information Commissioner found the department had relied on general privacy, security and human rights policies. There were no technical controls and no AI-specific guidance. It described those policies as far from sufficient. Nearly 900 staff, about 13 per cent of the workforce, had accessed ChatGPT over a six-month period. The department was ordered to block a long list of generative AI tools until November 2026.
The lesson scales down. A twelve-person accounting practice or a physiotherapy group faces the same dynamic. General policies do not mention AI, so people assume silence means permission. An AI use policy replaces that assumption with a clear answer.
Risk one: client information walks out the door
When a staff member pastes a client file into a public chatbot, the information has left your business. Depending on the tool, the account type and the settings, the provider may store it, review it or use it to train future models. The Australian Cyber Security Centre warns that this can depend on subscription level and configuration, and that most small businesses never check.
The Office of the Australian Information Commissioner set the benchmark in October 2024. As a best practice, it recommends that organisations do not enter personal information, particularly sensitive information, into publicly available generative AI tools. The Privacy Act applies to every use of AI that involves personal information. Australian Privacy Principle 6 limits use to the purpose for which the information was collected, and a chatbot is rarely that purpose.
This is not theoretical. The Australian Cyber Security Centre cites a case from early 2025. A contractor uploaded names, contact details and health records of people in a government program into an AI system. It became a notifiable data breach.
Professional obligations add a second layer. On 22 July 2026, the Tax Practitioners Board published TPB(GS) 55/2026. It treats entering client information into an AI tool as a disclosure to a third party. The practitioner must obtain the client’s permission first. Ahpra’s guidance makes health practitioners personally accountable for any AI used in their practice, including privacy and data security. The Law Institute of Victoria issued its own AI guidelines in September 2025 with confidentiality at the centre.
The legal exposure has grown too. Since 10 June 2025, individuals can sue directly for a serious invasion of privacy under a new statutory tort. They no longer need to wait for the regulator to act. The OAIC can now issue infringement notices. Businesses with turnover under $3 million remain largely exempt from the Privacy Act, and the exposure draft released on 31 August 2026 maintains that exemption for now. Health service providers have never been exempt. From 1 July 2026, accountants, lawyers, conveyancers and real estate agents captured by the anti-money laundering reforms are covered regardless of turnover. Confidentiality clauses in client contracts apply no matter what the Act says.
The practical fix is simple. Your AI use policy needs a never-enter list, and every person who touches client information needs to know it by heart.
Risk two: confident, wrong, and sent under your name
Generative AI produces fluent text. It does not know whether the text is true. It will invent a case, a statistic, a clause of an award or a product specification with the same confidence it brings to the correct answer. The cyber security agencies call this a hallucination. The courts call it something less polite.
In August 2025, the Victorian Legal Services Board varied the practising certificate of a lawyer known as Mr Dayal. He had handed a court a list of authorities generated by AI. Several did not exist. He can no longer practise as a principal, handle trust money or run his own firm, and he must work under supervision for two years. It was an Australian first. It was not the last. The Federal Circuit and Family Court referred a Western Australian solicitor to the regulator that same month for four fictitious cases.
The Fair Work Commission has now moved as well. On 24 August 2026, it published a final Guidance Note that takes effect on 20 October 2026. Anyone who uses generative AI to prepare an application, submission, or witness statement must disclose that use. They must verify every fact, citation and quote, and confirm the checking was done. It applies to employers defending a claim just as much as to employees making one. Commission Members reported signs of AI use by one or both parties in 50 to 75 per cent of the cases they handled in the six months to March 2026.
Then there is Hayley Lord v Millet Hospitality Geelong. A small business owner used ChatGPT to draft a redundancy email. The email told the employee that the decision was final, even though the award required consultation before any final decision. The owner argued the tool got it wrong because of his poor instructions. The Commission did not accept that. It found that the process failed to meet a standard of basic decency, and that the dismissal was unfair. The AI did what it was asked. The employer owned the result.
The same logic applies outside the courtroom. An AI-drafted quote that misstates a compliance requirement is still your representation under the Australian Consumer Law. So is a marketing claim that turns out to be false. A grant application with fabricated statistics is still your signature on the declaration. A verification rule and a named approver for anything external belong in every AI use policy.
Risk three: you cannot discipline what you never defined
Suppose you discover a staff member has been pasting client data into a personal ChatGPT account for months. Your instinct is a warning, or worse. Employment lawyers at Gadens, writing for the Australian HR Institute, put the difficulty plainly. It may be reasonable to discipline an employee who presents AI-generated work as their own, but ambiguity about what counts as acceptable use weakens the employer’s position. Most employment contracts and workplace policies still say nothing about AI at all.
Unfair dismissal law asks whether the employee knew the standard, whether it was applied consistently, and whether the response was proportionate. Without a written and communicated AI use policy, the argument that they should have known is thin. The Commission has also shown, in the Millet Hospitality decision, that it will hold managers to account for how they use AI in the other direction.
A policy that is written, briefed, acknowledged and applied to everyone gives you a fair basis to act. It also gives your good people the confidence to use AI openly, which is where the productivity gains actually sit.
Risk four: a cyber door you did not know was open
In January 2026, the Australian Cyber Security Centre published dedicated guidance on AI for small businesses, in collaboration with the Council of Small Business Organisations Australia. It names three risk areas: data leaks, unreliable or manipulated outputs, and supply chain vulnerabilities. Its first recommendation regarding data protection is to establish an internal AI use policy that clearly defines which data cannot be uploaded to AI platforms.
Personal accounts are the weak point. They sit outside your multi-factor authentication, your logging and your offboarding. When a staff member leaves, months of chat history containing your client information leaves with them, on an account you cannot see or close. Browser extensions and AI plug-ins installed without approval widen the hole.
Prompt injection is the newer threat. Attackers hide instructions in documents, emails or web pages so that an AI tool reading them behaves in ways the user never intended. Staff are now connecting AI agents to inboxes and file systems. Joint guidance from the Australian Cyber Security Centre and its international partners, issued in May 2026, is blunt on this. Never grant an AI agent broad or unrestricted access, and use agents only for low-risk, non-sensitive tasks. Your AI use policy should say who may connect what, and who signs off.
Risk five: work you may not own
Australian copyright protects works created through independent intellectual effort by a human author. Text, images or designs generated by AI with little human input may attract no copyright at all. The Copyright Act has not been amended, and the government’s Copyright and Artificial Intelligence Reference Group is still working through the question.
That has two consequences. The marketing copy, manual or template your staff generated may be free for a competitor to copy. And AI output can still infringe someone else’s copyright, because a provider’s terms cannot create ownership that the law does not recognise. If you want to own it, you need to shape it, and you need to be able to show you did. A short note on this should be included in your AI use policy.
What a good AI use policy covers
Keep it to two pages. A policy nobody reads protects nobody. The National AI Centre’s Guidance for AI Adoption, updated in May 2026, sets out six essential practices. Decide who is accountable, understand impacts, manage risks, share information, test and monitor, and maintain human control. A small-business AI use policy can meet all six in plain English. It should cover:
Approved tools and accounts. Name the tools staff may use, require business accounts, and switch off data training where the setting exists. No personal accounts for work.
The never-enter list. Client names and identifiers, health information, financial details, passwords and credentials, unreleased commercial information and anything covered by a confidentiality clause.
Verification and sign-off. A human checks everything that leaves the business. Name an approver for legal, financial, clinical and HR content.
Disclosure triggers. When staff must tell a client, patient, funder, court or tribunal that AI was used, including requirements from the Tax Practitioners Board and the Fair Work Commission.
Records. What prompts and outputs must be kept for regulated work, and for how long.
Security. Multi-factor authentication, no unapproved plug-ins, and no AI agents connected to email or files without sign-off.
Training and acknowledgement. A short briefing, a signed acknowledgement, and a place to ask questions without judgement.
An owner and a review date. One named person is accountable. The policy is reviewed every six months because the tools and rules keep evolving.
The Australian Government has so far chosen voluntary guidance over a mandatory AI law. That does not make the guidance optional in practice. It is fast becoming the standard of care that insurers, regulators, funders and larger clients expect to see.
What this looks like in your sector
Professional services. Accounting, legal, bookkeeping and consulting firms carry the heaviest confidentiality load, and their regulators have been the first to act. TPB(GS) 55/2026 requires client permission before client information is entered into any AI tool and expects practitioners to verify AI output and document each step. The anti-money laundering reforms have brought many of these firms under the Privacy Act since 1 July 2026 regardless of turnover. Engagement letters should now say whether and how the firm uses AI, and the AI use policy should mirror that promise.
Allied health and NDIS providers. Health information is sensitive under the Privacy Act, and health service providers have never had the small-business exemption. Ahpra expects practitioners to understand the AI tools they use, tell patients, obtain informed consent and record it. AI scribes and note-taking tools are the pressure point. For NDIS providers, participant data sits under the Practice Standards as well, and an auditor will ask how it is protected.
Trades and services. The risk here is quieter. An apprentice drafts a quote or a safe work method statement with AI on a personal phone. The customer’s address, gate code and site photos go in with it. A misstated compliance requirement in that quote is your representation under the Australian Consumer Law. The never-enter list and the verification rule do most of the work for a trade business, and both fit on one page in the ute.
Not-for-profits. Charities hold donor records, beneficiary information and often data about vulnerable people, and much of it is handled by volunteers on personal devices. Funding agreements usually contain confidentiality obligations that apply whether or not the Privacy Act does. Grant applications drafted with AI need a human to verify every figure before the declaration is signed. An AI use policy for a not-for-profit must cover volunteers, not just staff.
Where to start this week
-
Ask, do not audit. Find out which tools people are using and for what. Make it clear there are no consequences for honesty. You need the map before you can draw the boundaries.
-
Choose the approved tools. Set them up with business accounts, turn off data training where you can, and enable multi-factor authentication.
-
Write the never-enter list and the verification rule first. These two items remove most of the risk. The full AI use policy can follow within the month.
-
Brief the team in twenty minutes. Explain the why, walk through the examples in this article, and collect a signed acknowledgement.
-
Put the review date in the calendar. The Privacy Act, the Fair Work Commission, and the professional bodies have all changed their positions in the past 12 months. They will again.
Frequently Asked Questions
Should we ban AI at work?
For most businesses, no. Bans push use onto personal accounts where you cannot see it. The Victorian Information Commissioner ordered a block only because child protection demands the highest standard of care. For a typical small business, an AI use policy with approved tools and a never-enter list provides better protection while preserving productivity gains.
Does the Privacy Act apply to my small business?
It depends. Businesses with turnover under $3 million are generally exempt, and the exposure draft released on 31 August 2026 leaves that exemption in place. Health service providers are always covered. Accountants, lawyers, conveyancers, and real estate agents captured by the anti-money laundering reforms are covered as of 1 July 2026. The statutory tort for serious invasions of privacy and your contractual confidentiality obligations apply regardless.
Can I discipline a staff member for using ChatGPT?
Only fairly if a clear, communicated standard existed at the time. Without a written AI use policy, an employee can reasonably argue they did not know the rule. Put the policy in place first, brief everyone, and apply it consistently.
Do we have to tell clients we use AI?
Increasingly, yes. The Tax Practitioners Board requires client permission before client information goes into an AI tool. Ahpra expects practitioners to tell patients. From 20 October 2026, anyone using generative AI to prepare a Fair Work Commission document must disclose it. Beyond those rules, a line in your engagement letter is good practice and protects trust.
How long should an AI use policy be?
One to two pages. Cover approved tools, the never-enter list, verification and sign-off, disclosure triggers, records, security, training and a named owner with a review date. Anything longer will not be read, and a policy that is not read will not help you in front of a regulator.
Put Guardrails Around AI Before Someone Else Does
Your staff are using AI now. The choice in front of you is whether they do it inside a framework you wrote or one they improvised. SBAAS works alongside professional services firms, allied health and NDIS providers, trades businesses and not-for-profits across Queensland. We build AI use policies that are clear, compliant, and short enough to follow. If you would like to talk through where your business stands, we are ready when you are.
Find out more about SBAAS and book a conversation.
This article provides general information for Australian businesses as at 7 September 2026. It does not constitute legal, financial or professional advice. AI regulation and guidance are changing quickly. The Fair Work Commission’s Guidance Note commences on 20 October 2026; the Privacy Amendment (Personal Data Protection) Bill 2026 is under consultation; and professional bodies continue to update their positions. Businesses should seek advice from a qualified legal or professional adviser before relying on this material, particularly where sector-specific regulation applies.
Sources
Australian Cyber Security Centre. (2026, January 14). Artificial intelligence for small business. https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/artificial-intelligence-for-small-business
Australian Cyber Security Centre. (2026, April 30). Careful adoption of agentic AI services. https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/careful-adoption-of-agentic-ai-services
Australian Health Practitioner Regulation Agency. (2024). Meeting your professional obligations when using artificial intelligence in healthcare. https://www.ahpra.gov.au/Resources/Artificial-Intelligence-in-healthcare
Australian HR Institute. (2026, January 19). About 1 in 4 employees use AI tools without telling their managers. https://www.ahri.com.au/articles/1-in-4-employees-use-ai-without-telling-managers
Colin Biggers & Paisley. (2026, September 1). Round 2! The Australian Government has released the exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026. bill-2026-exposure-draft-released-for-second-tranche-o”>https://www.cbp.com.au/insights/publications/privacy-amendment-(personal-data-protection)-bill-2026-exposure-draft-released-for-second-tranche-o
Employment Hero. (2026, July). The AI paradox at work. https://employmenthero.com/news/ai-paradox-report-2026/
Fair Work Commission. (2026). President’s statement and draft guidance for use of generative AI published. https://www.fwc.gov.au/about-us/news-and-media/news/presidents-statement-and-draft-guidance-use-generative-ai-published
HR Law. (2025, November 11). Case brief: Hayley Lord v Millet Hospitality Geelong Pty Ltd [2025] FWC 2740. https://www.hrlaw.com.au/case-brief-hayley-lord-v-millet-hospitality-geelong-pty-ltd-2025-fwc-2740/
Human Resources Director. (2026, August 24). Fair Work Commission sets new rules for AI use in cases. https://www.hcamag.com/au/specialisation/employment-law/fair-work-commission-sets-new-rules-for-ai-use-in-cases/587124
Human Resources Director. (2026). Australian workers still hiding AI use from employers, studies find. https://www.hcamag.com/au/specialisation/employee-engagement/australian-workers-still-hiding-ai-use-from-employers-studies-find/581494
InnovationAus. (2024, October 1). Vic child protection agency ordered to block GenAI tools. https://www.innovationaus.com/vic-child-protection-agency-ordered-to-block-genai-tools/
Jobs and Skills Australia. (2025). Our Gen AI transition: Implications for work and skills. https://www.jobsandskills.gov.au/publications/generative-ai-capacity-study-report
King & Wood Mallesons. (2026, June 12). Generative AI and copyright law: Infringement and ownership. https://www.mallesons.com/au/en/insights/latest-thinking/generative-ai-and-copyright-law.html
National AI Centre. (2026, May 5). Guidance for AI adoption: Foundations. https://www.ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-foundations
Norton Rose Fulbright. (2024). Australian privacy alert: Parliament passes major and meaningful privacy law reform. https://www.nortonrosefulbright.com/en/knowledge/publications/be98b0ff/australian-privacy-alert-parliament-passes-major-and-meaningful-privacy-law-reform
Office of the Australian Information Commissioner. (2024, October 21). Guidance on privacy and the use of commercially available AI products. https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products
Office of the Victorian Information Commissioner. (2024). Investigation into the use of ChatGPT by a Child Protection worker. https://ovic.vic.gov.au/regulatory-action/investigation-into-the-use-of-chatgpt-by-a-child-protection-worker/
Salesforce. (2026, June 16). AI is widespread in Australian workplaces, but fragmentation is holding back impact. https://www.salesforce.com/au/news/stories/ai-is-widespread-in-australian-workplaces-but-fragmentation-is-holding-back-impact/
Tax Practitioners Board. (2026, July 22). TPB(GS) 55/2026 The use of artificial intelligence and the Code of Professional Conduct. https://www.tpb.gov.au/tpbgs-552026-use-artificial-intelligence-and-code-professional-conduct
Victorian Legal Services Board and Commissioner. (2025, September 2). Statement on the ‘Mr Dayal’ matter. https://lsbc.vic.gov.au/news-updates/news/statement-mr-dayal-matter
Eric Allgood is the Managing Director of SBAAS and brings over two decades of experience in corporate guidance, with a focus on governance and risk, crisis management, industrial relations, and sustainability.
He founded SBAAS in 2019 to extend his corporate strategies to small businesses, quickly becoming a vital support. His background in IR, governance and risk management, combined with his crisis management skills, has enabled businesses to navigate challenges effectively.
Eric’s commitment to sustainability shapes his approach to fostering inclusive and ethical practices within organisations. His strategic acumen and dedication to sustainable growth have positioned SBAAS as a leader in supporting small businesses through integrity and resilience.
Qualifications:
- Master of Business Law
- MBA (USA)
- Graduate Certificate of Business Administration
- Graduate Certificate of Training and Development
- Diploma of Psychology (University of Warwickshire)
- Bachelor of Applied Management
Memberships:
- Small Business Association of Australia –
International Think Tank Member and Sponsor - Australian Institute of Company Directors – MAICD
- Institute of Community Directors Australia – ICDA
- Australian Human Resource Institute – CAHRI
Our Consulting Services
Management Consulting
Compliance & Risk
Professional Writing Services
Consistency in Communication
Small Business Consulting
Sustainable Businesses
Start-ups
Set-up for Success
Further Reading
AI Use Policy: One in Three Staff Use AI in Secret. Silence Is Not a Policy.
One in three Australian workers now use AI tools at work without their employer knowing. That use is happening whether or not you have rules for it. Without an AI use policy, client information, fabricated facts and unmanaged cyber exposure become your problem. Here is what is at stake, and what a practical policy should say.
The Employee Choice Pathway
The rules for casual conversion have flipped. Under the employee choice pathway, eligible casuals now tell you they want to go permanent, and you must respond in writing within 21 days. For early childhood centres that run on casuals, this changes how you roster and plan. Here is who is eligible, how to respond, and the few grounds on which you can say no.
Policy Review Services: Workplace Policies Expire. When Did You Last Check Yours?
Review your workplace policies at least once a year, and immediately when the law, your business, or your risks change. Since January 2025, employers have absorbed criminal wage theft laws, the right to disconnect and Payday Super, and new privacy policy rules starting on 10 December 2026. This guide covers how often to review, what triggers an early review and where to start.
You Just Screened Out Your Best Candidate. They Were 52.
A quarter of Australian employers now call a 52-year-old an older worker. AI screening tools are being sued in the United States for rejecting applicants over 40. Meanwhile, KPMG puts the value of getting more over-55s into work at $29 billion a year. Here is what age bias actually costs, and how to take it out of your hiring in 30 days.
Your Honest Ad Might Still Be Breaking the Law
You did not lie. You did not mean to mislead anyone. You believed every word. And you can still be on the wrong side of the law. That is the hard truth about advertising in Australia: good intentions are not a defence. What matters is the impression your words leave, not the honesty behind them. Here is how to stay on the right side of the line.
The Contractor on Your Books Might Now Be an Employee
Since August 2024, the paperwork no longer settles whether a worker is an employee or contractor. A new Fair Work test looks at the real substance of the relationship, not the label on the agreement. For allied health practices built on contractor clinicians, that change carries real risk. Here is what the test asks, and how to check your arrangements before an audit or a dispute does it for you.