AI policy development for Australian organisations.
Of the 23 licensees ASIC reviewed, 12 had an AI policy that mentioned fairness and none had a way for a customer to contest an AI decision. On 10 December 2026, APP 1.7 to 1.9 require your privacy policy to describe the decisions your systems make about people. We write the policy that closes both gaps, with the statute beside each clause and an owner for the privacy policy update.
Built for
What ASIC found at 23 licensees.
ASIC chose the licensees, so the figures describe that sample. No other Australian regulator has counted AI policies.
Use cases reviewed
624
57% were less than two years old or still in development.
Policies referencing fairness
12 of 23
Fairness, inclusivity or accessibility appeared in the AI policies of 12 licensees.
Policies referencing disclosure
10 of 23
Ten licensees had policies that referenced telling affected consumers that AI was used.
Contestability arrangements
0 of 23
No licensee appeared to have implemented specific arrangements for contesting an AI outcome.
Four ways an Australian AI policy fails.
The first two are ASIC's findings at licensees. The other two are gaps any organisation can check for in its own policy, and every clause we write answers one of the four.
- 01ASIC REP 798
Principles with no standards underneath.
ASIC found that some licensee policies "provided only guiding principles, without establishing clear standards". Roughly half of the licensees had updated their risk management policies for AI at all. Several relied on existing codes of conduct or IT policies, and ASIC could not see that the reliance was a deliberate decision. Each principle in our policies points to the clause that enforces it.
- 02ASIC REP 798
Governance that arrives after the AI does.
ASIC found licensees updating their governance arrangements at the same time as expanding their AI use, and for two licensees the governance lagged the use outright. With 61% of licensees planning to increase AI use within twelve months, ASIC expected the gap to widen. Its governance questions put the point directly: do your policies lead your AI use, and how do you know staff follow them.
- 03Ownership gap
A policy with nobody assigned to run it.
A policy on public generative AI tools can sit beside an AI strategy with no enterprise-wide roles, no central view of where AI is used and no regular monitoring of models in production. Without those three, nobody can implement the document. Every role in our policies has a named person against it.
- 04Adoption gap
Rules that staff work around.
Staff who believe policy forbids the AI tools they use keep using them, and some hide that use from their manager. A policy that bans the tools people use gets ignored, which is why the approved tool list and the request path for new tools come before the prohibitions.
What an Australian AI policy must include.
The OAIC expects entities to set policies and procedures for AI use and to define permitted and prohibited uses. ASIC's seventh governance question asks whether those policies lead AI use. These twelve clauses are how a policy answers both.
The clauses are also the skeleton of our downloadable AI policy template, Australian edition.
- 01
Board sign-off, owner and reporting line
Corporations Act 2001 s 180. ASIC REP 798 question 4. FAR where it applies.
Director duties are technology neutral, and ASIC expects directors to consider reasonably foreseeable AI risks. The policy is approved by the board or a delegated committee, names its owner and compliance monitor, and sets the reporting line back to the board. Accountable entities under the Financial Accountability Regime record which accountable person holds AI in their key functions. - 02
Scope that follows the OAIC's deployer definition
OAIC guidance on commercially available AI products.
The OAIC treats any organisation that uses an AI system to provide a product or service as a deployer, including for internal use. The policy covers employees, contractors and the board, every AI system including features embedded in existing software, and every device. Personal accounts are named and prohibited rather than left unmentioned. - 03
Principles tied to controls
Australia's AI Ethics Principles. Guidance for AI Adoption, six practices.
Each principle points to the clause that enforces it. This is the direct answer to ASIC's finding of principles without standards. The Guidance for AI Adoption condenses the ten guardrails of the Voluntary AI Safety Standard into six practices, and the policy maps to those six. - 04
AI use-case register and screening gate
NAIC register template and screening tool. DTA policy register and impact-assessment thresholds. ASIC question 1.
Every AI use is logged with an owner and a screening outcome. The Commonwealth's own pattern, mandatory for non-corporate Commonwealth entities, is an accountable official, a use-case register, risk-based impact assessments for uses that could cause more than insignificant harm or influence administrative decisions, and an annual transparency statement. We apply the same structure to private organisations without claiming the policy binds them. ASIC's first governance question is whether the licensee has taken stock of its AI inventory. - 05
Approved tools and a request path
OAIC checklist 1, selecting an AI product.
Named enterprise tools and tenancies, a route to request a new one, and a prohibition on everything else. The OAIC expects due diligence on a product to continue after purchase, so each tool on the list carries a review date. - 06
Input rules by data tier
APP 3, APP 6, APP 8, APP 11. Notifiable Data Breaches scheme.
The OAIC expects organisations not to enter personal information, and in particular sensitive information, into publicly available generative AI tools. Under APP 3, personal information an AI tool generates or infers is a collection. APP 6 restricts secondary use of what goes in. APP 8 applies when the vendor is offshore. The policy sets a table of never, approved tenancy only, and permitted, and routes any prompt leakage or vendor breach into the Notifiable Data Breaches assessment. - 07
Output review, verification and labelling
APP 10. FWC guidance note, 20 October 2026.
A person checks outputs before they are relied on, facts and citations are verified, and material AI input is labelled. The OAIC asks for accuracy steps that match the higher risk of error in an AI context. From 20 October 2026, the Fair Work Commission's guidance note requires disclosure of generative AI use in documents lodged with the Commission and verification of their content, so the HR edition of the policy carries that clause. - 0810 Dec 2026
Decisions about people and the APP 1.7 box
APP 1.7 to 1.9. Sex, Racial, Disability and Age Discrimination Acts. Ahpra guidance for clinicians.
AI is never the sole basis for a decision with a legal or similarly significant effect. A named human can overturn it, the decision is recorded, and there is a channel to contest it, which is the arrangement none of ASIC's 23 licensees had. The clause carries an APP 1.7 readiness box: the programs, the kinds of decisions and the kinds of personal information that have to appear in the privacy policy by 10 December 2026, with the owner of that update. Liability for a discriminatory outcome under the anti-discrimination Acts sits with the organisation, so bias testing and records are part of this clause. Health practitioners add Ahpra's position that the practitioner stays responsible for any AI output, including from TGA approved tools. - 09
Transparency to customers
APP 1 and APP 5. ASIC disclosure finding. Australian Consumer Law.
The OAIC expects entities to identify their public-facing AI tools and update privacy policies and notices. Only 10 of ASIC's 23 licensees had a policy that referenced disclosure to consumers. The clause also covers claims about AI capability, because misleading conduct prohibitions under the Australian Consumer Law are technology neutral and a chatbot's statement about a product or a customer's rights is the organisation's statement. - 10
Workforce consultation and WHS
Modern award consultation terms. Fair Work Act 2009. Model WHS Act primary duty.
The standard award clause requires consultation when the employer has made a definite decision to introduce major changes in technology with significant effects on employees. The policy names that trigger, rules out covert monitoring, and treats psychosocial hazards from AI-driven monitoring or work intensification under the existing primary duty of care. The Senate committee's recommendations on AI in the Fair Work Act have not become law, and the policy treats them as recommendations. - 11
Procurement, vendors and the APRA annex
OAIC checklist 1. DTA AI model clauses. CPS 230 and CPS 234.
Vendor access to data, training-use opt-outs, security history, hosting location, breach notice, audit rights and exit. For APRA-regulated entities the annex applies the CPS 230 material service provider test to each registered AI use, with the register due to APRA annually, and the CPS 234 evidence list for information security. Commonwealth suppliers draw on the DTA's AI model clauses for services where the seller uses AI and for bespoke builds. - 12
Incidents, training, non-compliance and review
NDB scheme. DTA training requirement. NAIC annual review plus triggers.
A definition of an AI incident, the authority to take a system offline and the manual fallback, the link into the data breach plan. Induction training for everyone and role training for the people who buy, build and approve AI. Consequences under the code of conduct. An annual review with triggers for an incident, a new law, a new class of tool or an audit finding. Of the Australian policies we have read, only the NAIC template states a review interval.
Start with the NAIC template. Then finish it.
The National AI Centre's AI policy guide and template is free, well structured and the document most Australian organisations should open first. It comes with an AI register template and a screening tool. We built our Australian edition to extend it, and we say plainly where it stops.
The suite, as Australian regulators describe it.
The OAIC, ASIC, the DTA and the NAIC between them describe four instruments. A governance policy carries the schedules; the other three are annexes an organisation switches on when it needs them.
- 01
Enterprise AI governance policy
The board document. ISO/IEC 42001 clause 5.2.
Purpose, scope, principles tied to controls, roles, the register and screening gate, decisions about people, incidents and the review cadence. The NAIC template is this type, and so is the structure the DTA requires of Commonwealth agencies. - 02
Generative AI acceptable use annex
The staff document. OAIC minimums.
Approved tools, the input table, output review and labelling. The OAIC's instruction not to put personal information into public generative AI tools is the regulator-set floor; the council and university policies we have read all ban confidential, sensitive or personal inputs and all require human review of outputs. - 03
Employee AI usage annex
The HR document. Fair Work Act and award terms.
Permitted tasks, disclosure of AI assistance, accountability for outputs, the FWC clause for lodged documents, consequences under the employment contract, and the award consultation trigger. The difference from the acceptable use annex is enforcement through the employment relationship. - 04
AI procurement annex
The buying document. OAIC checklist 1, DTA model clauses, CPS 230.
Due diligence and contract terms for buying AI or AI-embedded services, with the material service provider mapping for APRA entities. Our third-party AI risk service runs the diligence itself; this annex is the rule that makes it a condition of purchase.
Four stages, ending with a signed policy and a dated privacy policy update.
ASIC's first governance question is whether you have taken stock of your AI. The engagement starts there and ends with the APP 1.7 disclosures drafted and owned.
- 01
Inventory and screening.
Interviews and tool discovery across the business, including personal accounts. Each use is entered in the register and screened as normal, elevated or prohibited, and each decision that touches a person is flagged for the APP 1.7 box.
- 02
Drafting against the statute.
Legal, privacy, compliance, HR and IT draft with us. Every clause is written with its APP, Act or prudential standard beside it, and the sector annexes are switched on for APRA entities, health providers and government suppliers. With the template as the base, drafting takes one working week.
- 03
Board approval and workforce consultation.
The board or its risk committee approves. Where the policy changes anyone's work, the award consultation step runs before rollout, with the record kept. We coordinate the sign-offs rather than handing the policy owner a list of people to chase. Allow 2 to 4 weeks from the finished draft to board approval, consultation included.
- 04
Rollout, privacy policy update and first review.
Quick reference guides, manager briefings, the induction module and acknowledgement forms. The APP 1.7 to 1.9 disclosures are drafted into the privacy policy ahead of 10 December 2026, and the annual review date and triggers are in the calendar before we finish.
Australian AI policy questions.
Does Australian law require a written AI policy?
No Act requires one for a private organisation. The obligations arise under the Privacy Act 1988, the anti-discrimination Acts, the Corporations Act, the Fair Work Act and award consultation terms, the Australian Consumer Law and, for APRA entities, CPS 230 and CPS 234. The OAIC expects entities to establish policies and procedures for AI use, and ASIC asks licensees whether they have translated their AI strategy and risk assessment into policies for staff. For non-corporate Commonwealth entities, the DTA policy is mandatory. Australia has not legislated the proposed mandatory guardrails.
What do APP 1.7 to 1.9 require on 10 December 2026?
Where an entity has arranged for a computer program to make, or do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests, and personal information is used, the privacy policy must state the kinds of personal information used, the kinds of decisions made solely by the program, and the kinds of decisions where a related step is done by the program. It is a transparency obligation and gives individuals no right to contest the decision or to an explanation. Assisted decisions can be in scope as well as fully automated ones.
The National AI Centre publishes a free AI policy template. Why engage PolyGovern?
The NAIC AI policy guide and template is a sound principle-level skeleton with defined roles, a screening procedure and an annual review clause. It does not list approved tools, it does not set out prohibited uses beyond deception and manipulation, and it does not map clauses to Australian statute. Our work adds the tool list, the tiered input rules, the APP 1.7 readiness box, the award consultation trigger, the APRA annex where it applies, and a legal reference beside every clause.
What did ASIC find in REP 798?
ASIC reviewed 624 AI use cases across 23 AFS and credit licensees. Of the 23, only 12 had policies for AI that referenced fairness or related concepts, only 10 had policies that referenced disclosure of AI use to affected consumers, and none appeared to have implemented specific contestability arrangements for AI. Some policies provided only guiding principles without establishing clear standards. ASIC treats licensee obligations, consumer protection laws and director duties as technology neutral.
We are APRA regulated. What does the policy add?
An APRA annex. AI vendors in critical operations are material service providers under CPS 230, and the policy applies the material service provider test to every registered AI use. CPS 234 sets the information security capability a vendor has to show for the data an AI tool handles. Under the Financial Accountability Regime, accountable entities consider AI in key functions when assigning accountable persons, and ASIC's governance questions ask licensees to do exactly that. Our CPS 230 for AI guide covers the register and tolerance levels in detail.
How is workforce consultation handled?
Modern award consultation terms require consultation where an employer has made a definite decision to introduce major changes in technology likely to have significant effects on employees. Introducing AI that changes roles, hours, monitoring or skills falls inside that trigger, and the policy names it. From 20 October 2026 the Fair Work Commission's guidance note on generative AI applies to documents lodged with the Commission, so HR teams preparing FWC material get a clause on disclosure and verification.
Related services in Australia.
APP 1.7 to 1.9 commence on 10 December 2026. The policy and the privacy policy update have to be ready before then.
A scoping call establishes which AI uses are already in the business, which decisions about people fall inside APP 1.7, and whether APRA, health or government annexes apply. You leave with a written scope.