If a client emailed you this afternoon and asked to see your firm's AI policy, what would you send them?
For most firms the answer is one of three things. Nothing. A paragraph inside the IT policy that predates ChatGPT. Or a template downloaded last year, with the firm's name typed into the header.
You're in good company. The University of Melbourne and KPMG's 2025 trust in AI study found that only 30% of Australian employees say their organisation has a policy guiding generative AI use. Seven in ten either don't have one or don't know they do, which in practice comes to the same thing.
So the instinct to grab a template is a sound one. It's just the wrong first step.
The trouble with an AI policy template
A template isn't useless. A good AI policy template saves you a day of drafting, gives you headings you'd have forgotten, and puts the language in a shape a lawyer will recognise.
What it can't do is answer the questions. It will say "staff must only use approved AI tools". It will not tell you which tools are approved, because it does not know. It will say "client information must be protected", and leave you to work out what that means when a senior adviser wants to summarise a file note at six on a Thursday.
The analogy I keep coming back to is aviation. Pilots understand this better than anyone. They run a checklist before every flight, one they've read ten thousand times, because it was written for the exact aircraft they're sitting in. Nobody flies a 737 off a Cessna checklist and calls it safe because the headings looked right.
A template is somebody else's aircraft. These eight questions turn it into yours.
My advice here cuts against what most firms do. Don't open the template at all until the eight answers are on a page. The moment those headings are in front of you, you'll start writing to fill them, and you'll finish with a document that describes a firm you don't run.
1. Name the tools you allow
Write them down the way you'd write them on a whiteboard. "Microsoft 365 Copilot under the firm's own tenant, and nothing else for client work."
A category is not a rule. "Reputable AI tools" is something nobody can follow at 4pm on a Friday, and something everyone will read in their own favour.
2. Write the never list, and keep it short
Tax file numbers. Client identification documents. Health information. Anything covered by a confidentiality clause you've signed.
Firms that write "sensitive information" and stop there have handed that decision to whoever is most stressed in the building that week. Four specific items beat a paragraph of principle every time.
3. Decide who approves a new tool, and how long they get
Name a role, and a process measured in days. Somebody asks, somebody checks the terms and where the data goes, somebody says yes or no in writing.
"IT will assess it", with nothing behind it, is the version that fails. If approval takes a quarter, staff will route around it inside a fortnight, and you'll have swapped a policy problem for a shadow IT problem.
4. Say what happens to AI output before it reaches a client
Describe a real check. Who reviews it, against what, and what they're accountable for when it's wrong.
"Staff are responsible for accuracy" is true, and it's also what a policy says when nobody has thought about it.
Beware: A policy that says "a human reviews all AI output" can create a false comfort. If the reviewer is skimming forty summaries an hour, the review exists on paper and nowhere else.
5. Decide what clients are told, and where
This one is about to matter more. From 10 December 2026, organisations covered by the Privacy Act have to describe in their privacy policy where computer programs make or substantially shape decisions that significantly affect people. Your internal AI policy and your public privacy policy need to tell the same story, because a client who reads both will notice when they don't.
Point to the wording in each document. "We'd tell them if they asked" isn't a position you can hold at a board table.
6. Deal with personal accounts and phones
Say it directly. Personal AI accounts aren't for firm work, here's what to use instead, and here's what to do when client information has already gone into one.
Most policies write as though personal phones don't exist. They do, and they're where the bulk of unapproved AI use actually happens. A policy that is silent on the phone in somebody's pocket is silent about most of the problem.
7. Separate a mistake from a pattern
Someone who pastes a client email into the wrong tool once and reports it straight away should be thanked, and the policy should say so in writing. Otherwise the next person keeps quiet, and you hear about it from the client.
Silence on this is a choice too, as is a disciplinary clause lifted from the template that nobody intends to use. Staff read those clauses closely, and they draw conclusions about whether reporting is safe.
8. Put a name and a date on it
One person owns the policy, and the date of the last review sits inside the last six months. AI tools change monthly. A policy reviewed annually is describing a world that's already gone.
"It's in the handbook" is not ownership. The handbook is where documents go to be forgotten about.
Tip: Put these eight questions to your leadership team before anyone opens a template. Write the answers on one page. Getting stuck on one of them usually means the firm hasn't made that decision yet, and no amount of drafting will make it for you.
I've watched that argument run longer than anyone in the room expected, and it's almost always worth the hours. The eight answers are the hard yards. The document is the easy part.
Why the order matters
Back in 2024 I wrote about setting staff guidelines for AI, and the argument there still holds. The guidelines that work are the ones written after the firm has decided what it wants AI to do.
That's also the thread through how to use AI in your business: use first, rules second, both specific to you.
It's the same idea behind not automating chaos. A policy is a process written down. Where the process does not exist yet, the policy will describe one that does not, and anyone reading it carefully will notice.
One caveat on the number at the top. That 30% is from 2025 and the ground moves quickly here, so by the time you read this more firms will have something written down. Having something written down and having something true are different problems.
A note on what this isn't. An AI policy is not legal advice, and neither is this post. I am not a lawyer and I am not pretending to be one here. Once your eight answers are on a page, a lawyer should read the result, particularly anything touching client consent or your privacy policy. We're happy to sit beside that process. We don't replace it.
Back to the email
So picture that client email again. This time you can reply in a sentence: here's our policy, here are the tools we use, here's what never goes into them, here's who checks, and here's what our privacy policy says about it.
That's a reply that makes the client trust you more for having asked.
You can work through the eight questions yourself with a template open beside you, and most firms can. If you'd rather do it in a room with someone who's done it before, it's part of our AI Discovery Workshop, and you'll leave with the policy drafted for your own legal review.
Where these numbers come from
- Trust, attitudes and use of artificial intelligence: A global study 2025, Australian findings, The University of Melbourne and KPMG
Yener
