# AI use and governance [Read the public page](https://www.adarkcloud.com.au/services/ai-governance) Set clear rules for using AI at work. Review approved tools, sensitive information, access and the checks needed before acting on output. AI governance defines how a business may use AI and who is responsible for the results. A practical starting policy names approved tools, data limits, review requirements and how staff report a problem. Perth based, with remote support across Australia. From $79 an hour ex GST, with the fee agreed before work begins. Call Josh C on 0408 530 303. ## What we can help with - Current tool and usage review - Approved data and access rules - Human review requirements - Policy and specialist scope planning Staff may already use AI to draft messages or summarise documents. The practical question is whether they know which account and tool to use, what information they can share and who checks the result. We can help establish operational rules and the IT around them. Privacy, legal or industry requirements need the appropriate advisers, and broader specialist governance work can be discussed with VibeZero. ## Use actual tasks to define the rule An internal summary of approved material needs different checks from a customer email or a financial recommendation. A policy should let the person doing that work recognise which rule applies. Record business and personal account usage, connected data and any tools taking live actions. Start with what is happening now so the policy deals with actual behaviour rather than an imagined future rollout. ## Find out what people already use Ask about the tasks and tools without turning the review into a blame exercise. Record whether staff use business or personal accounts and what information is being entered. Existing usage is the starting point for a workable policy. A ban that nobody understands may leave the same activity happening outside the business environment. ## Set rules people can apply Explain which tools are approved, what data may be shared and which outputs need review. Keep the rule close to the task. A customer communication, internal summary and financial decision need different checks. Technical access settings can support the policy, but they do not replace training and a clear escalation path. ## Review the policy as use changes Give the policy an owner and review date. New tools, connected data and live actions can change the risk. Specialist governance, privacy or legal requirements need the appropriate advisers. VibeZero is an option for a broader AI governance engagement. ## Make approvals and review responsibilities explicit Name the approved tools, data limits and person who can approve a new use. Describe how staff check output and what they do when it appears wrong or a sensitive record has been shared unexpectedly. Access settings can support those rules, but the settings and policy need to agree. A tool approved for drafting general material should not silently become a connection to the whole customer database. ## What the handover should include The agreed output can include a usage register, short operational policy and action list for technical gaps. The policy needs an owner, a review date and an accessible way for staff to ask questions. Specialist advice and unresolved requirements should be identified clearly. A working policy is maintained as tools, data and intended actions change. ## Common questions ### Is an AI policy legal advice? No. An operational usage policy does not replace advice about privacy, employment, contracts or other legal obligations. ### Should a small business have a policy? If staff use AI for work, clear rules about data and review are useful. The level of detail should match the tasks and risks. ### Do rules need to cover personal AI accounts? Yes, if staff use them for work. The business should make clear which accounts and tools are approved and what information may be shared. ### Can the policy be short? Yes. A short policy can be useful when its rules are clear and match the actual tasks. More complex use or obligations may require further detail and specialist advice. ### Who should approve a new AI use case? The business should name an owner with the authority to review the task, data and consequences. That role belongs in the operational policy. ## Useful next steps - [Staff AI use guide](https://www.adarkcloud.com.au/blog/is-your-team-using-chatgpt-at-work-ai-policy) - [AI and automation](https://www.adarkcloud.com.au/services/ai-automation) - [Microsoft guidance on Copilot data and permissions](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) Reviewed 2026-10-07 - [Ask for IT help](https://www.adarkcloud.com.au/contact) - [Check your IT basics](https://www.adarkcloud.com.au/tools/it-health-check)