AI policy for small business is quickly moving from something only large corporations worry about to something every growing Australian business should consider.
Your staff may already be using ChatGPT, Microsoft Copilot, Google Gemini, Claude or AI features built into software your business already pays for.
They might use AI to draft emails.
Summarise meetings.
Analyse spreadsheets.
Write proposals.
Research customers.
Create marketing content.
Improve reports.
The productivity opportunity is significant.
The risk is that many business owners do not actually know what information employees are entering into these tools, which platforms are being used, or whether AI-generated work is being checked before reaching customers.
That is why Perth SMEs need something more practical than simply telling employees to “use AI responsibly.”
They need clear rules.
Here are seven areas every AI policy for small business should address in 2026.
Table of Contents
- Decide Which AI Tools Are Approved
- Define What Information Must Never Be Uploaded
- Make Human Review Mandatory
- Set Rules for Customer-Facing AI
- Assign Someone Accountable for AI
- Create an AI Tool Register
- Train Staff and Review the Policy
- What Should an AI Policy for Small Business Include?
- How ACS Consulting Can Help Perth SMEs
1. Decide Which AI Tools Are Approved
The first rule in an AI policy for small business should be simple.
Which AI tools are employees allowed to use?
Without guidance, staff can easily create accounts across multiple platforms using personal email addresses, free subscriptions or unapproved software.
That creates what is sometimes called shadow AI.
The business loses visibility over where information is going.
Instead, create an approved list.
For example:
Approved: Enterprise ChatGPT account, Microsoft Copilot within the company environment, approved CRM AI features.
Not approved: Random free AI websites, unknown browser extensions or tools that have not been reviewed.
The Australian Government recommends that businesses assess AI tools before using them and understand how data is handled and stored.
Read the Australian Government guidance on responsible AI use.
This does not mean your business needs an IT department.
It means somebody needs to make a deliberate decision before another AI platform becomes part of the business.
2. Define What Information Must Never Be Uploaded
This may be the most important part of an AI policy for small business.
Employees need to know exactly what information they should not enter into publicly available generative AI systems.
Depending on your business, this may include:
- Customer personal information
- Employee records
- Banking information
- Passwords
- Confidential contracts
- Pricing models
- Commercially sensitive information
- Medical or health information
- Proprietary intellectual property
- Unreleased financial data
- Client documents
Australian cyber security guidance specifically warns small businesses about the potential for data leaks and privacy breaches when sensitive information is uploaded into AI tools.
Read Cyber.gov.au’s AI guidance for small businesses.
Your policy should make the boundary obvious.
Do not rely on employees deciding individually whether something is “probably okay.”
3. Make Human Review Mandatory
AI can produce polished answers that are completely wrong.
This is one of the biggest operational risks for businesses using generative AI.
A proposal can contain an invented statistic.
A marketing article can include a false claim.
A report can misinterpret data.
A customer email can provide incorrect information.
That means your AI policy for small business should establish where human review is mandatory.
At minimum, employees should review AI-generated material before it is:
- Sent to customers
- Published publicly
- Used for financial decisions
- Added to contracts or proposals
- Used in compliance documentation
- Used to make employment decisions
- Presented as business advice
The Australian Government recommends human oversight because generative AI systems can produce inaccurate or misleading outputs.
The business remains responsible for what it sends, publishes or acts upon.
AI does not take responsibility when something goes wrong.
Your business does.
4. Set Rules for Customer-Facing AI
AI is increasingly being used in customer service.
Chatbots can answer common questions.
Automated systems can qualify leads.
AI assistants can respond to enquiries.
These tools can improve efficiency, but customer-facing applications need tighter control.
Your AI policy for small business should answer questions such as:
Is the customer told they are interacting with AI?
Which questions can the AI answer?
When must the conversation be transferred to a person?
Can the AI provide pricing?
Can it discuss customer account information?
Can it make promises about delivery dates?
Who checks the answers it provides?
Transparency is particularly important.
Australian Government guidance recommends telling customers when AI use is relevant to their interaction, especially where they may believe they are communicating with a human.
Your automation should make the customer experience better.
It should not create confusion.
ACS Consulting has already covered practical automation opportunities in our guide to AI automation for Perth SMEs.
The next step is making sure those automations operate inside clear rules.
5. Assign Someone Accountable for AI
Someone needs to own the system.
That does not mean hiring a Chief AI Officer for a 15-person business.
It could simply be the owner, operations manager, IT lead or another senior employee.
The important thing is accountability.
Your AI policy for small business should identify who is responsible for:
- Approving AI tools
- Reviewing risks
- Maintaining the AI register
- Updating staff guidance
- Investigating problems
- Reviewing new AI features
- Escalating privacy or security concerns
This prevents AI governance becoming everyone’s responsibility and therefore nobody’s responsibility.
Business.gov.au specifically recommends assigning accountability for responsible AI use.
For many Perth SMEs, this is fundamentally an operations issue.
It requires clear ownership, defined processes and review.
That is exactly the kind of structure ACS Consulting addresses through Strategy and Business Planning.
6. Create an AI Tool Register
You probably already maintain registers for important business assets.
Vehicles.
Software subscriptions.
Equipment.
Customer systems.
Why not AI?
An AI register gives you visibility over which systems are operating inside your business.
For each AI tool, record:
- Tool name
- Business purpose
- Who uses it
- Who owns it internally
- What information it accesses
- Whether personal data is involved
- Subscription type
- Key risks
- Review date
This does not need to become bureaucratic.
A spreadsheet may be enough for a small business.
The Australian Government currently recommends businesses document their AI systems, including their purpose, ownership, capabilities, limitations and risks.
You can also access the government’s AI Policy Guide and Template when developing your own policy.
An AI register becomes particularly valuable as software vendors quietly add AI features to existing products.
You may discover your business is using much more AI than you originally realised.
7. Train Staff and Review the Policy
Writing an AI policy for small business and saving it in a folder nobody opens achieves very little.
People need to understand it.
Training does not have to involve a three-hour seminar.
A practical 30-minute session may cover:
What tools are approved?
What information cannot be entered?
How should outputs be checked?
When must a manager approve AI use?
What should employees do if they accidentally upload confidential information?
Where should potential AI problems be reported?
Employees should understand both the benefits and boundaries.
This matters because responsible AI is not about stopping people from using technology.
It is about helping them use it productively without creating unnecessary risk.
Your policy should also be reviewed.
AI platforms change quickly.
Software features change.
Business processes change.
Privacy risks change.
Review the policy at least annually and whenever your organisation adopts a major new AI system.
Privacy Must Be Part of Your AI Policy for Small Business
Privacy deserves particular attention.
The Office of the Australian Information Commissioner states that privacy obligations can apply when personal information is entered into commercial AI products or generated by those systems.
The OAIC recommends businesses consider policies and procedures around AI use and be cautious about entering personal information into publicly available generative AI tools.
Read the OAIC guidance on privacy and commercial AI products.
For Perth SMEs, the practical lesson is straightforward.
Do not wait for a privacy problem before deciding how staff should use AI.
Put the rules in place first.
What Should an AI Policy for Small Business Include?
A useful AI policy for small business does not need to be 50 pages long.
For most SMEs, it should clearly cover:
Purpose
Why the business uses AI and what the policy is designed to protect.
Scope
Which staff, contractors and business systems the policy applies to.
Approved Tools
Which AI systems employees may use.
Prohibited Information
What information cannot be entered into AI platforms.
Human Oversight
Which outputs require checking or approval.
Customer Transparency
When customers should be told that AI is involved.
Accountability
Who owns AI governance internally.
Incident Reporting
What employees should do if something goes wrong.
Training
How staff will be educated about responsible AI use.
Review
How frequently the policy and tool register will be updated.
Keep the language simple.
If employees cannot understand the policy, they will not follow it.
The Biggest AI Policy Mistakes Perth SMEs Should Avoid
A common mistake is banning AI completely.
Employees may simply use it privately instead.
Another mistake is allowing every tool because the business wants to appear innovative.
Neither extreme is useful.
The stronger position sits in the middle.
Use AI where it genuinely improves work.
Control the risks.
Set boundaries.
Measure whether it is actually improving productivity.
Another major mistake is creating an AI policy without reviewing existing workflows.
If your business has unclear processes, AI can simply make those processes move faster without making them better.
ACS Consulting’s approach is to understand the process before automating it.
That is why businesses considering significant AI adoption may benefit from first examining how work currently moves through their organisation.
AI Policy for Small Business Is Really an Operations Issue
AI governance sounds technical.
For most SMEs, it is actually a business systems problem.
You need:
Clear responsibilities.
Documented workflows.
Approved tools.
Decision rules.
Data controls.
Review processes.
Staff training.
Accountability.
These are the same foundations required for any reliable business system.
A strong AI policy for small business gives your employees permission to use new technology while making the boundaries clear.
That can create a much healthier environment than either uncontrolled AI use or complete prohibition.
Need an AI Policy for Your Perth Business?
If your team is already using ChatGPT, Copilot, Gemini, Claude or AI-enabled business software but you do not have clear internal rules, now is the time to put the structure around it.
ACS Consulting helps Perth SMEs improve the systems behind how work gets done.
We can help you review current AI use, map workflows, identify operational risks, define responsibilities and build practical processes that your team can actually follow.
For businesses that are not sure where the biggest operational issues sit, ACS Consulting Diagnose provides a structured review of your processes, data, responsibilities and operational constraints.
Build the Rules Before AI Becomes the Risk
A practical AI policy for small business can give your team clearer boundaries while allowing you to keep the productivity benefits of AI.
Contact ACS Consulting to discuss your current systems and where AI fits.
ACS Consulting
Perth, Western Australia
Phone: 0452 665 021
Email: zoey@acsconsulting.com.au