A policy that says yes

Can I use AI for this? The question can come up about a client email or a spreadsheet of month-end figures, and usually the person asking is checking before they start.

An AI policy puts the answer in writing. It tells people which tools they can use, what work they can use them for and where to go when they are unsure. It may also be called an AI use policy, or an AI acceptable use policy.

AI tools reached people's desks quickly, and a written answer takes a firm time to agree. In the meantime, people tend to work it out for themselves. Some hold back, and some carry on quietly. A policy that sets out what people can do can make it easier to use AI openly.

1AI policy and AI strategy

The National AI Centre's guidance for AI adoption tells organisations to "Create an AI policy that sets out how your organisation will use AI responsibly." Its AI policy guide and template says the policy "acts as a reference for staff, stakeholders and auditors who want to understand your organisation's approach to AI".

The Centre's guide to creating a policy says a policy gives an organisation "a shared set of rules for responsible AI use". Among other things, it suggests the policy cover what AI can and can't be used for, what data staff can put into tools, how staff should report issues, and when the policy will be reviewed.

An AI strategy sets the direction, while the policy sets out how people use AI day to day. The Centre's implementation guidance asks organisations to document and communicate "the organisation's strategic intent to develop and deploy AI systems in line with organisational strategy and values".

Commonwealth agencies are required to develop a strategic position on AI and put responsible AI governance into practice. Under the Digital Transformation Agency's Policy for the responsible use of AI in government, in effect from 15 December 2025, "agencies must develop a strategic position on AI adoption within 6 months of this policy taking effect", and they must name accountable officials. For a firm, the strategy can be a short paragraph at the top of the policy.

Microsoft's 2026 Work Trend Index, a vendor survey, asked 2,000 Australian workers who use AI whether their organisation was clearly aligned on AI strategy and policies, and 28% said it was. Across the Tasman, Datacom's 2026 State of AI Index, a vendor survey of 207 senior leaders at New Zealand organisations with 100 or more staff, found 62% had some form of AI strategy and 16% had a clearly defined standalone one.

2Regulators and professional bodies

The Law Society of NSW's guide to responsible use of AI, updated in January 2026, says it is necessary "that law practice principals have policies and procedures in place for the appropriate use and supervision of generative AI in their legal practices."

In a joint statement in December 2024, the Victorian Legal Services Board and Commissioner, the Law Society of NSW and the Legal Practice Board of Western Australia set out what those policies should cover: "what AI tools they have decided to use in their practice, who can use those tools, for what purposes, and with what information". The policies should also say how the practice will "continuously and actively supervise the use of AI tools by junior and support staff".

In February 2026, the Queensland Law Society and six other law societies published an AI selection and use checklist. One item asks firms to "ensure staff know that they can only use approved AI systems, and only within the terms of that approval." Another asks whether the firm has "updated internal policies and procedures to incorporate AI usage".

For tax practitioners, the Tax Practitioners Board's guidance on AI and the Code of Professional Conduct, issued on 22 July 2026, includes the requirement: "You must document and enforce the policies and procedures of your system of quality management." It also says practitioners need each client's permission before divulging client information to a third party, which "can include entering client information into AI models and tools, depending on how these tools are configured and used".

3Unsure what's allowed

In the 2025 Victorian Lawyer Census, 42% of the 1,674 lawyers who answered the question said their workplace had AI guidelines, 45% said it did not, and 13% were unsure. Among lawyers already using AI, 7% were using it without knowing whether guidelines were in place. Among those not using it, "the absence of clear legal and ethical guidelines" was the second most common reason (32%), after concerns about data and privacy.

Outside law, a PagerDuty survey of 250 Australian office workers at organisations with at least $500 million in revenue, a vendor survey run by Wakefield Research, found 28% were unsure whether their AI use was allowed. In Gartner's survey of 574 employees in Australia, Gartner found "only half of Australian employees report clear guidance, training or support for AI use".

Without a written answer, each use of AI comes with small calls along the way. Is this tool allowed? Can this file go into it? Should I mention that I used it? We looked at what the research on decision fatigue does and doesn't show, and at the AI calls that can land on a person's list. A written policy can answer the recurring questions and give people somewhere to take the ones it does not cover.

When people aren't sure, some keep their AI use to themselves. In the PagerDuty survey, 36% of those using AI for work said they would hide it to avoid scrutiny from their superiors. Salesforce research, a vendor survey run by YouGov, found 56% of Australian workers who use AI at work were using tools their employer had not provided or approved.

The same PagerDuty survey found 82% believed their company had policies for AI tools, and 70% had used AI at work even though they believed it wasn't allowed under those policies. A policy can exist and still leave the person at the desk unsure whether the job in front of them is covered.

When people keep their AI use to themselves, the firm can't see which tools are in use or decide whether useful methods should be shared. We look at how that happens in shadow AI and in Shadow IT vs Shadow AI.

4The whole firm on the same page

With one written policy, the IT provider, the partners and the front desk can all work from the same document. The accounts team can check which approved tool helps draft replies to invoice queries, and what stays out of it. A graduate with a research task can see the tool is approved for that work, and who to ask about the parts that aren't clear. When the practice management system adds an AI feature, the IT provider can set it up to match what the firm has decided.

Questions, new tools and things that went wrong can go to a named person or channel, rather than being worked out separately in each team.

Most of the Victorian lawyers using AI (63%) had workplace guidelines to work from, against 31% who had none. The census found training and workplace guidance were both "associated with increased perceived benefits, without a corresponding increase in perceived risk". It is an association from one survey, and it can't tell us whether the guidelines led to the use.

In the United States, Bick and colleagues found that among workers whose employer had provided no training or tools, 47% had adopted AI where the employer encouraged it, against 10% where it did not. The study measured employer encouragement in general.

5Writing a draft AI policy

If your partners have already worked through who owns AI in the firm and the decisions that go with it, those answers go straight into the draft. If a team has already written down its agreed tools and checks, as we suggest in When the computers arrived, that page is a starting point too.

6Where we come in

Our investigation looks at the AI tools your people use, the work they use them for and where the questions come up. Along the way we run a leadership session with your partners and prepare a draft AI use policy for them to finalise. The investigation also measures how long your firm's work takes today, so you start from a baseline of your own. The findings belong to your firm whether or not we go any further together.

After that, the whole firm completes AI Foundations, and each team has an AI Champion who helps keep it going once we step back.

If you would like your people using AI openly, with one place to take their questions, reach out to our team. The first conversation works out whether your firm is the right fit for the AI Uplift Program, and whether we are the right people to help.

Writing a draft AI policy