What do regulators expect?
ASIC reviewed 23 financial services and credit licensees in 2024 and found that some were adopting AI faster than they were updating their risk and compliance frameworks. Only 10 had policies covering how to tell consumers when AI was used (REP 798, "Beware the gap").
The legal regulators were blunter. The Law Society of NSW, the Legal Practice Board of WA and the Victorian Legal Services Board asked practices to adopt clear, risk-based policies naming which AI tools they use, who uses them, for what, and with what information, plus how AI-assisted documents get checked.
A policy that covers those points is the evidence you'll want if a regulator, insurer or client ever asks.
The AI policy template
1. Owner
[Name, role] owns this policy and reviews it every [six months] and whenever we add a tool.
2. Approved tools
Staff use only these tools, on the business plan named, with model training switched off.
| Tool | Plan | Who | Approved uses |
|---|---|---|---|
| [Claude] | [Team] | [All staff] | [Drafting emails, summarising file notes, first drafts of letters] |
| [Microsoft 365 Copilot] | [Business] | [Paraplanners] | [Meeting summaries] |
3. Client information
Client information goes only into approved tools. Client names, financial details, identity documents and privileged material never go into a free or personal AI account.
4. Off limits
AI never produces final advice, a credit proposal or legal advice. A qualified person forms the advice and signs it off. We don't use AI to translate advice, and no program decides a client's application, eligibility or fees.
5. Checking
A qualified person checks every client-facing document AI helped prepare, including every fact, figure and citation, before it goes out. The file records that AI was used and who checked it.
6. Telling clients
We tell clients how we use AI and give them this policy on request.
7. Privacy
Our privacy policy lists any automated decisions we make about clients, as the Privacy Act requires from 10 December 2026, and says where approved tools store data overseas.
8. Incidents
Client information in an unapproved tool, or an AI error that reaches a client, goes to [owner] the same day. A possible data breach gets assessed within 30 days, and eligible breaches are reported to the OAIC and the people affected as soon as practicable.
9. Training
Everyone completes [our AI training] before access and again when this policy changes.
10. Billing (law practices)
We bill for the legal work our people do. Time AI saves is never billed as manual work.
What should law firms add?
Name the courts you appear in under section 4 and follow their practice notes on AI: the NSW Supreme Court's SC Gen 23, the Federal Court's generative AI practice note and the Victorian Supreme Court's SC Gen 25. The regulators' statement also suggests keeping AI to lower-risk work that's easy to verify, like drafting a polite email or structuring an argument. Write that into section 2. More in our guide to AI for law firms in Australia.
What should advisers and brokers add?
Section 6 is where most licensees in ASIC's review fell short. If AI plays any part in assessing a client's application or suitability, list it in section 4 and in your privacy policy.
Check the privacy side in minutes with the free AI privacy and compliance check. If you want the tools in section 2 chosen and set up properly, book a 15-minute call.
Frequently asked questions
Do Australian law firms need an AI policy?
The Law Society of NSW, the Legal Practice Board of WA and the Victorian Legal Services Board recommend one, setting out approved tools, users, purposes, information and review.
What did ASIC find about AI governance?
In REP 798, ASIC reviewed 23 licensees and found some were adopting AI faster than they were updating their risk and compliance frameworks. Only 10 had policies covering disclosure of AI use to consumers.
Can staff put client information into ChatGPT?
Only into a business plan your firm has approved, with training switched off. Never into a free or personal account.
Do we have to tell clients we use AI?
The legal regulators ask lawyers to be transparent about AI use. For advisers and brokers, ASIC flagged disclosure as a gap. Our template tells clients and hands over the policy on request.
How long should an AI policy be?
One or two pages: long enough to name the tools and the rules, short enough that staff read it.