AI Acceptable Use Policy Template

This AI policy template creates an editable acceptable use policy from your organisation’s rules. Enter the approved tools with their plans and permitted information, then record banned tools and uses.

The fictional example permits public legal research in a firm-managed workspace. It bans personal AI accounts and unapproved browser assistants. Replace both lists with your organisation’s actual decisions.

Tool approval applies to a specific plan and use. The generated client information clause requires separate assessment and authority before client information enters an approved managed tool.

Review the draft in the editor, then download the Word-compatible document. The file uses the .doc format and contains editable text. Changing an input replaces direct edits.

This draft is a starting point for your organisation to adapt. A partner or general counsel must approve it before adoption, including jurisdiction-specific professional and public-sector requirements.

An AI acceptable use policy needs scope, named tool approvals and rules for information handling. It must also assign human review, client disclosure, record keeping and breach reporting.

The Law Society of South Australia’s AI guidance covers tool suitability, professional duties and supervision. The draft applies those themes through source checks, practitioner approval and matter-file records.

The Law Society of NSW’s responsible AI guide addresses accuracy, confidentiality and professional obligations. Adapt the clauses to the conduct rules and court directions that apply to your work.

The Office of the Australian Information Commissioner’s AI guidance recommends keeping personal information out of public generative AI tools. It also addresses vendor assessment, privacy notices, staff training and ongoing monitoring.

The generated information rule prohibits confidential, privileged, personal and sensitive material in public AI tools. A paid plan alone does not establish permission to use client information.

Covered entities must also assess the automated decision-making privacy-policy requirements, which commence on 10 December 2026. They concern qualifying uses of personal information in decisions that could significantly affect an individual’s rights or interests.

Adopt the approved AI use policy through staff training and recorded sign-off. Give staff the controlled policy, its approved-tool list and a reporting contact before authorised use begins.

Use the first training session to practise signing into the approved workspace and recognising prohibited inputs. Show how to verify a citation and report an accidental disclosure using synthetic information.

Explain the client disclosure process and demonstrate where staff record material AI use on a matter file. Record each attendee, session date and policy version, then obtain acknowledgement and arrange catch-up training.

Send requests for a new tool or plan to the policy owner before use. Record the proposed task, information involved, vendor terms and approval conditions. Update the approved list after a written decision.

The selected review interval is an internal choice, not a statutory timetable. Review earlier after an incident, changed vendor terms or a new court requirement.

Connect the policy to your controls for unapproved AI use and your incident response procedure. Compare declared use with authorised account and procurement records, then assign any unexplained use for investigation.

After an accidental disclosure, staff use the incident channel immediately and preserve relevant evidence. The authorised incident lead decides containment and any client or regulatory notification.