Does my small business need an AI policy?

The short answer

There is no federal or Victorian law that requires a café, shop, clinic or trade business to write an AI policy. The Australian Government decided in its National AI Plan (December 2025) not to pass AI-specific rules for business, and to rely on existing laws instead: “established laws remain the foundation for addressing and mitigating AI-related risks.” [1]

So the real question isn’t “do I need a policy?” but “which laws already reach the way my staff use ChatGPT, Claude or Copilot?” For most small businesses that’s three: privacy, consumer law and workplace law.

1. Privacy: are you covered by the Privacy Act?

Most small businesses aren’t. The Privacy Act 1988 doesn’t cover a business with an annual turnover of A$3 million or less, counting “all income from all sources”. [2] The 2024 privacy reforms didn’t change that, and the next round of changes (an exposure draft released in 2026) is still a draft and doesn’t propose removing the exemption. [3]

But some small businesses are covered whatever their turnover. The ones that matter most for small businesses in Melbourne: [2]

• Health service providers. This is wide: medical practitioners, pharmacists, allied health professionals, complementary therapists and child care centres are all named.
• Businesses that trade in personal information.
• Contractors providing services under a Commonwealth government contract.
• Businesses that have opted in to be covered.

If you’re covered, the privacy regulator (the OAIC) has published guidance on using AI products such as ChatGPT. Its main recommendation: “As a matter of best practice, the OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools.” It also tells covered businesses to “establish policies and procedures for the use of AI systems”, and to update their privacy policy to say how they use AI. [4]

One date to know: from 10 December 2026, covered businesses must say in their privacy policy if a computer program, including generative AI and chatbots, makes or helps make decisions that significantly affect people and uses their personal information. This can apply even when a person reviews the AI’s output. [5]

If you’re not covered, none of this is a legal duty. It’s still good practice: your customers don’t know or care what your turnover is.

2. Consumer law: you’re responsible for what AI writes for you

Australian Consumer Law applies to every business. If AI writes a product description, a quote, a menu or an ad that misleads a customer, the business that publishes it is responsible. Treasury’s 2025 review of AI and consumer law put it plainly: the ban on misleading conduct applies “regardless of the technology”, a business can break it even when it “acts honestly and reasonably”, and “the onus is on businesses to ensure the technologies they use are fit-for-purpose.” [6]

In practice: someone reads anything AI wrote before it goes to a customer.

3. Workplace law: tell your staff before you change their work

Under the Fair Work Act, employers sometimes have to consult employees about major changes, and the government notes this “can include the introduction of AI in the workplace.” [7] If AI is about to change how someone does their job, talk to them first.

One special case: Victorian Government work

If your business does work for a Victorian Government department and can see its information, the Victorian public sector’s generative AI guideline may apply to you too. It covers “contractors, consultants and volunteers … with access to public sector information”. [8] Check your contract.

What the government recommends

The National AI Centre’s Guidance for AI Adoption (October 2025) replaced the 2024 Voluntary AI Safety Standard. It has six essential practices: decide who is accountable; understand impacts and plan accordingly; measure and manage risks; share essential information; test and monitor; maintain human control. [9] Its first step under “decide who is accountable” is: “Create an AI policy that sets out how your organisation will use AI responsibly.”

There’s a free official AI policy template (April 2026). [10] It’s written for organisations with an AI governance committee, policy approvers and system owners. A business with three staff won’t have any of those. The government’s own “Foundations” guidance says: “You don’t need to do everything at once. Adapt each practice to fit your organisation’s size”. [9]

A one-page AI policy for a small business

This covers the six things the National AI Centre says a policy should spell out [10], cut down to fit a small business. Copy it and fill in the brackets.

1. What we use AI for. [Replying to customer emails and reviews, first drafts of quotes and notices, sorting receipts.] Tools: [ChatGPT / Claude / Copilot], on accounts in the business’s name, not staff’s personal accounts.
2. What we don’t use AI for. [Deciding who gets hired, giving health or legal advice, anything sent to a customer without a person reading it.]
3. What never goes into AI. Customers’ names, phone numbers, addresses, health details, card or bank details, passwords, staff records. [Add your own: client files, supplier prices.] If something has to go in, take the names and numbers out first.
4. Who checks. [Name] reads anything AI wrote before it goes to a customer or goes public. [Name] decides if we start using AI for something new.
5. When something goes wrong. If customer information went into AI by mistake, or AI got something wrong that a customer saw, tell [name] the same day.
6. When we look at this again. Every [six] months, or when we start using a new AI tool.

If your business is covered by the Privacy Act, add one more line: our privacy policy says how we use AI, and from 10 December 2026, whether a computer program makes or informs decisions that significantly affect customers. [5]

Put it where staff will see it, and go through it with them once. A policy nobody has read doesn’t protect anyone.

Questions

Sources

All checked on 22 October 2026. This page explains the rules in plain words; it isn’t legal advice.

1. Department of Industry, Science and Resources, National AI Plan: Keep Australians safe, 2 December 2025.
2. OAIC, Small business.
3. Attorney-General’s Department, Privacy and Privacy reform consultation (exposure draft, submissions closed 18 September 2026).
4. OAIC, Guidance on privacy and the use of commercially available AI products, 21 October 2024, updated 17 January 2025.
5. OAIC, New resources on transparency for use of AI and automated decision-making, 30 September 2026, and the APP 1.7–1.9 transparency fact sheet.
6. Treasury, Review of AI and the Australian Consumer Law: Final report (PDF), October 2025.
7. National AI Centre, AI and Australian law.
8. Victorian Government, Administrative guideline for the safe and responsible use of generative AI in the Victorian Public Sector, updated 12 February 2025.
9. National AI Centre, Guidance for AI Adoption: Foundations; Department of Industry, Voluntary AI Safety Standard (notice of replacement).
10. National AI Centre, Create an AI policy and AI policy guide and template (DOCX), 22 April 2026.

Written by the AI team at Super Intelligence Melbourne, 22 October 2026. Found something out of date? Email hello@melb.si.

Want it done for you?

Writing this one page for your business is part of our online AI setup, along with two everyday jobs handed over to AI.