Before You Use a Template
These editable sample templates are provided by Workplace AI Governance for general educational and guidance purposes only. They are intended as starting points and do not constitute legal or professional advice, certification, or proof of compliance with applicable laws or regulations.
Before using any template, review and adapt its contents to your organisation’s operations, workforce, applicable laws, regulatory requirements and specific workplace risks. Seek independent professional advice where appropriate.
Responsibility for the accuracy, suitability, implementation and ongoing review of each document remains with the organisation using it.
Shadow AI policy and employee acknowledgement
For employers and managers: an editable DOCX sample policy and acknowledgement covering approved AI, prohibited uses, work information, reporting and employee responsibilities.
Workplace-specific review required: Do not adopt this sample unchanged. Disciplinary action, dismissal and summary dismissal are fact-dependent. Check contracts, policies, applicable awards or enterprise agreements, consultation duties and fair-process requirements, and obtain independent Australian workplace-relations or legal advice before taking action.
Mandatory workplace rule
- No unapproved or unregistered AI for business duties or tasks
- Approval must cover both the AI system and the proposed use
- Rules for personal accounts, confidential information and incident reporting
Acknowledgement and consequences
- Employee and manager or witness signature fields
- Proportionate disciplinary options, including warnings or dismissal
- Summary dismissal reserved for sufficiently serious conduct and a fair process
AI use register
For business owners, managers and risk leads: an editable DOCX inventory for approved, embedded and user-created AI uses, owners, data, controls and review dates.
System and use
- System or feature name
- Purpose and workflow
- Owner and users
- Vendor and version
Risk and controls
- Data types and locations
- People affected
- Risk rating and rationale
- Human review, testing and monitoring
- Approval and next review date
- Retirement or exit plan
AI impact assessment
For project owners and decision-makers: an editable DOCX assessment for privacy, security, safety, bias, accuracy, worker impact, human review and residual risk before deployment or material change.
Scope
- Decision or task supported
- Alternatives considered
- Affected groups and consultation
- Jurisdictions and applicable instruments
Evidence
- Privacy and security
- Safety and psychosocial hazards
- Bias, discrimination and accessibility
- Accuracy and limitations
- Human review and contestability
- Residual risk and accountable approval
AI vendor questionnaire
For buyers, procurement and technology leads: an editable DOCX questionnaire covering vendors, hosting, data handling, security, testing, accessibility, change notices and exit arrangements.
Service
- Model, hosting and subcontractors
- Data locations and transfers
- Training or reuse of customer data
- Retention and deletion
Assurance
- Security controls and incident notice
- Testing, known limitations and change notices
- Accessibility
- Audit logs and export
- Contract exit and data return
Consultation checklist
For employers and managers: an editable DOCX checklist to plan consultation with affected workers and representatives and record issues, responses and follow-up.
Before consultation
- Describe proposed change and reason
- Identify applicable award, agreement, policy and WHS/OHS law
- Provide accessible information and enough time
During and after
- Invite views and alternatives
- Record issues and responses
- Explain the decision
- Monitor impacts and reopen consultation when use changes
AI incident report
For incident owners and managers: an editable DOCX report to capture facts, contain harm, preserve evidence, assess notification triggers and record corrective action.
Triage
- Date, system, workflow and reporter
- Actual or potential harm
- Containment and evidence preservation
- People, data and services affected
Escalation
- Privacy/NDB assessment
- Cyber incident response
- Safety regulator or emergency trigger
- Employment, discrimination or consumer escalation
- Root cause, corrective action and closure approval
Acceptable-use policy starter
For employers and policy owners: an editable DOCX starter for approved tools, permitted purposes, prohibited data, output checks, disclosure, security and incident reporting.
Rules
- Approved tools and permitted purposes
- Prohibited data and uses
- Verification and disclosure
- Copyright, confidentiality and records
- Security and access
Accountability
- Training
- Incident reporting
- Monitoring and privacy
- Exceptions
- Review and version control
Automated-decision inventory
For privacy, governance and process owners: an editable DOCX inventory for decisions made or substantially supported by computer programs, including transparency, review and correction pathways.
Decision
- Decision kind and legal effect
- Program and owner
- Personal information used
- How substantially the program supports the decision
Transparency
- APP entity coverage assessment
- Privacy policy disclosure for APP 1.7–1.9
- Notice and explanation
- Human review or correction route
- Evidence and review date
Sources and currency
Jurisdiction: Australia. Currency: Sources checked 27 October 2026. Legislation is binding where it applies; regulator and government material is guidance unless stated otherwise. Standards and recommended governance practices are not legislation. Check the instrument, jurisdiction and facts that apply to you.