Operating guide · AI governance
Introducing a safe-use artificial intelligence policy before tool sprawl takes hold
A policy and adoption rollout for a growing Australian business.
Gaps to close
- Enable useful experimentation without uncontrolled disclosure
- Make rules understandable in everyday work
- Ensure the policy changes day-to-day behaviour
- Create an approval and exception path
Decisions to settle
- Approved tools and account types
- Data that may not enter public services
- Decisions that require qualified human ownership
- How exceptions and new tools are approved
How to know it is working
- Staff can classify examples from their own work
- Approved tools and owners are recorded
- Sensitive-data and high-impact rules are clear
- Incident and exception channels are tested
Working documents
- Plain-language artificial intelligence use policy
- Approved-tool and use-case register
- Training scenarios
- Supplier-assessment questions
- Review and exception workflow
Putting the routine in place
- 01
Use and data discovery
Survey real tools, tasks, information, outputs, customer commitments and existing contracts.
- 02
Risk and policy design
Define approved, conditional and prohibited use; data rules; human review; recordkeeping; supplier assessment; and incidents.
- 03
Control and education
Configure approved services, access and retention where available and train staff with real examples.
- 04
Operate and improve
Review new requests, incidents, value and vendor changes and update the policy with dated decisions.