In most cases, yes. Free AI tools are available to everyone, so staff at organisations that have not formally adopted AI are probably already using it. Without an AI policy, each person decides individually what goes into which tool, and leadership has no view of how AI is being used. A short, practical policy that answers a small number of questions properly is enough.
What an AI policy should answer
- Which tasks can staff use AI tools for, and which are off-limits?
- What data can go into an AI tool, and what must stay out, such as personal information about clients, members or staff and confidential material?
- Which tools are approved, and who decides when a new one is added?
- Where does a tool store the data entered into it, and how does the provider use it?
- Who checks AI output before it is used or published?
- What happens if confidential information ends up somewhere it should not, or a decision is made on AI output nobody checked?
- How does leadership see how AI is being used across the organisation?
Why data needs the most attention
AI tools are built on data, and the terms and privacy policies that govern them are long and rarely read. Knowing what has been entered, where it is stored and how it is used matters for the privacy obligations the organisation holds and for what clients, members and donors would agree to. This applies whether or not the organisation is legally subject to Australian privacy regulations. Our blog post on privacy risk in Australia covers the wider picture.
Keeping it short
Staff are more likely to follow a policy they can read in a few minutes. One or two pages that state what is permitted and who to ask usually work better than a long document that sits unread. Tools change quickly, so the policy needs a named owner and a regular review.
Who is responsible
The board or committee approves the policy and a named person keeps it current and answers staff questions. This is a governance decision as much as a technology one, which is why AI policy is part of technology governance.
How we help
We help organisations develop an AI policy and report on AI use to leadership through our Technology Governance service, typically as an Advisory engagement. Selecting, configuring and automating AI tools is covered by AI Automation. The FAQs on what AI is and choosing AI tools are a useful starting point for staff.
