Does a small business need an AI usage policy?

If any staff member uses a public AI tool for work, yes. A policy is a short written rule on which tools are allowed and what data may go in. The OAIC advises organisations not to enter personal information, particularly sensitive information, into publicly available generative AI tools.

What should an AI usage policy say?

Keep it to one page. Name the approved tools, list the data that must never go into any AI tool, say who approves new tools, say that a person checks AI output before it reaches a client, and say who to tell if something goes wrong.

Can an MSP stop staff using public AI tools?

An MSP can block or limit tools on managed devices, but that does not cover personal phones or home laptops. A policy, training and an approved alternative work better together than a block alone.

How should an MSP charge for this?

As a fixed-price job with a clear scope: policy, approved tool list, a short staff briefing and a review date. For wider packaging advice, see the MSP compliance pricing guide.

AI usage policy for clients: a one-page quick win for MSPs

Q: Is there an Australian government guide for AI governance?

Yes. The National AI Centre released the Guidance for AI Adoption on 21 October 2025. It sets out six practices, including assigning accountability, managing risk, and keeping human control. It has a Foundations version aimed at smaller organisations.

The short version: Your clients' staff are probably already pasting emails, contracts and customer details into public AI tools. A one-page AI usage policy, an approved tool list and a 20-minute staff briefing fix most of that risk. It is a fixed-price job you can finish in a week, and it gives the client something to show an insurer or a buyer who asks, "What is your AI policy?"

Why does a client need one now?

Because the questions have started. Some supplier questionnaires and insurance forms now ask how a business uses AI and what goes into it. A client with no written answer looks unprepared, even if nothing has gone wrong.

The regulator has also been clear. The Office of the Australian Information Commissioner (OAIC) published guidance on commercially available AI products on 21 October 2024. As a best-practice step, it advises organisations not to enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the privacy risks.

For a law firm, accountant or clinic, personal information is in almost every document. That is why the rule needs to be written down.

What does a one-page policy say?

It answers six questions in plain English. Anything longer will not be read.

Which tools are approved? Name them. For example, the Copilot or ChatGPT plan the business pays for.
What must never go in? Customer personal details, health or financial records, passwords, unreleased contracts, and anything covered by a confidentiality clause.
Who approves a new tool? One named person, not "management".
Who checks the output? A person reads AI-drafted work before a client sees it. AI gets facts wrong.
Can staff use personal accounts for work? Usually no. Personal accounts sit outside the business's control.
Who do I tell if I made a mistake? A name and a number. Make it safe to own up.

That list lines up with the Australian Government's Guidance for AI Adoption, released by the National AI Centre on 21 October 2025. It sets out six practices, including assigning accountability, measuring and managing risk, and maintaining human control. It also has a Foundations version for smaller organisations. Your one-pager is the small-business version of the same ideas.

What do you set up around the policy?

A policy with nothing behind it is a poster. Do these three things in the same job:

Pick the approved tool and switch it on properly. If the business already pays for Microsoft 365, check which AI features its plan includes and who has them. Do not assume it is configured safely because it is a Microsoft product.
Check sign-in protection. Staff using an approved AI tool through a work account should be covered by multi-factor authentication and your normal conditional access rules.
Make the safe option easy. If the approved tool is harder to use than the public one, people will go around it.

If you're a small business

Ask your IT provider for three things. A written list of AI tools your staff may use. A written list of what must never be entered. A named person who approves new tools. If you get a blank look, you have found the gap.

Then ask staff what they already use. Do it as a friendly question, not an audit. You will learn more in five minutes than from any tool report.

If you're an MSP

Sell the outcome, not the document. The client does not want a policy. They want to answer the next questionnaire without panic.

Scope it as a fixed job: a short workshop with the owner, the one-page policy, the approved tool list, a 20-minute staff briefing, and a review date in six months. The review date matters. AI tools change quickly, and a policy that is never revisited goes stale. That review is also your recurring revenue. For how to package and price jobs like this, see the MSP compliance pricing guide.

One caution: do not promise that a policy prevents data leaks. It reduces the chance and shows reasonable care. Say that.

Worked example

A 20-person accounting firm asks its MSP whether staff can use ChatGPT. The MSP asks the staff first. Six people use a free public account, mostly to tidy client emails and summarise tax correspondence. The MSP runs a short workshop with the principal. They approve one paid tool tied to work accounts, ban client names and tax file numbers from any AI tool, and name the office manager as the person who approves new tools. The MSP sends a one-page policy, runs a 20-minute briefing, and books a review for April. The firm now has a dated record it can show an insurer.

Where CYBERWHITE fits

An AI policy covers behaviour. The tenant settings behind it still matter. CYBERWHITE scans a Microsoft 365 tenant and shows, control by control, which settings meet the Essential 8 and SMB1001 requirements, which do not, and which need review, with evidence you can export. That includes sign-in protection, which sits underneath any approved AI tool.

For the governance side, CYBERWHITE includes a self-guided NIST AI RMF assessment. It does not detect which AI tools staff use, and it does not write your policy for you. The Essential 8 and SMB1001 controls do not require an AI policy as such, so treat this as an extra service line, not a compliance requirement.

To see what a client's tenant would show, book a free proof check. We scan one tenant with you. You can also read the Essential 8 compliance guide, try the cyber insurance calculator or see how SMB1001 works for MSPs.

Your checklist

Ask staff which AI tools they already use for work.
Name one approved tool and one person who approves others.
List the data that must never go into any AI tool.
State that a person checks AI output before it reaches a client.
Check sign-in protection on the approved tool.
Run a 20-minute staff briefing and record who attended.
Save the signed policy with its date.
Book a six-month review.

Sources

Office of the Australian Information Commissioner: Guidance on privacy and the use of commercially available AI products (21 October 2024, updated January 2025)
National AI Centre, Department of Industry, Science and Resources: Guidance for AI Adoption (21 October 2025)

Keep reading: Microsoft 365 price rise: a client script for MSPs and The evidence problem