A better starting point is one page. Short enough to read in two minutes, specific enough to answer the questions staff actually have, and easy to update when the tools change.

What the page needs to answer

Staff have four questions, and the policy should answer each in a sentence or two:

1. Which tools can I use? Name them. "Approved AI tools" means nothing; "the practice assistant at assistant.example.com.au" means something.
2. What can never go into anything else? Be concrete: patient or client names, health information, Medicare numbers, tax file numbers, case details, anything from a client file.
3. What do I have to check? AI output is a draft. Someone qualified reads it before it goes to a patient, client, court or colleague.
4. Who do I ask? One named person, not "management".

What to leave out

A one-page policy works because it is short. Resist the urge to add:

• a history of artificial intelligence;
• long lists of every possible risk;
• vague principles such as "use AI responsibly" without saying what that means;
• anything you wouldn't actually enforce.

If you need more detail for your own records, such as a vendor assessment or a privacy impact assessment, keep it in a separate document. The page for staff stays a page.

The template

Copy this, replace the parts in square brackets, and delete anything that doesn't apply.

[Practice name]: using AI at work
Last updated [date]. Questions to [name, email].

1. Approved tools. You may use [tool name and link] for work. It runs [on our own server / under our business agreement with provider], and what you put in it is not used to train AI models.

2. Everything else. Do not put any of the following into any other AI tool, including free chatbots, browser extensions or apps on your own phone: patient or client names or details, health information, identifiers such as Medicare numbers or TFNs, anything from a patient or client file, or anything marked confidential.

3. Check before you send. Treat every AI output as a first draft. Read it in full, check facts, names, dates, doses and citations, and fix anything wrong. You are responsible for what you send, not the tool.

4. Be open about it. If a patient or client asks whether AI was used, tell them honestly. [If you use an AI scribe: always ask the patient before recording, and switch it off if they say no.]

5. If something goes wrong. If you think confidential information has gone into a tool it shouldn't have, tell [name] the same day. You won't be in trouble for reporting it; we need to know quickly.

6. Ideas welcome. If there is a task you think AI could help with, or you are using a tool that isn't listed here, talk to [name]. We would rather add a good tool than have people work around this page.

Making it stick

A policy only works if the approved option is genuinely convenient. If staff have to jump through hoops to use the sanctioned tool, they will drift back to whatever is on their phone. A few habits help:

• Launch it in a staff meeting, not by email. Show the approved tool doing a real task, such as tidying a referral or summarising a long letter.
• Make the "tell us the same day" rule safe. If reporting a mistake leads to blame, people stop reporting.
• Review it every six months, or whenever you add or drop a tool. Change the date at the top each time.
• Keep a copy where people look. The staff intranet, the shared drive, or pinned in the team chat.

Where this fits

A one-page policy doesn't make a practice compliant on its own, and it doesn't replace your privacy policy or professional obligations. What it does is give staff a clear, honest answer to "can I use this?", which is where most problems start. If you want help choosing the approved tool to name in point 1, that is exactly what our free assessment covers.

It isn't a discipline problem. People reach for free chatbots because they genuinely help: a messy referral becomes a clean letter, a forty-page affidavit becomes a one-page summary, a blunt email becomes a polite one. The trouble is what goes in with the request.

Where the text actually goes

When someone pastes a document into a consumer chatbot, the text is sent to the provider's servers, which for the big names are mostly outside Australia. Depending on the product and the account settings, it may be:

• kept in the user's chat history, on a personal account the practice cannot see or delete;
• retained by the provider for abuse monitoring, sometimes for weeks;
• used to improve future models, unless someone found and switched off the right setting;
• reviewed by the provider's staff or contractors in some circumstances.

None of that is sinister. It is written into the terms. But the practice didn't agree to those terms; a staff member did, on their own phone, in a lunch break.

Three ordinary examples

These are illustrative, not real incidents, but anyone who has worked in a practice will recognise them.

• A receptionist tidies a referral letter by pasting in the patient's name, Medicare number and history. Health information has now been disclosed to an overseas company.
• A junior lawyer uploads a family law affidavit to get a quick chronology. Confidential, possibly privileged, material has left the firm.
• A bookkeeper asks a chatbot to draft a client email that includes income figures and a tax file number.

Why it matters

For practices covered by the Privacy Act 1988 (Cth), and every health service provider is covered regardless of turnover, a few of the Australian Privacy Principles come into play straight away:

• APP 6 limits using or disclosing personal information for purposes other than the one it was collected for.
• APP 8 deals with sending personal information overseas. In many cases the practice stays accountable for what the overseas recipient does with it.
• APP 11 requires reasonable steps to protect the information you hold.

The Office of the Australian Information Commissioner said as much in its 2024 guidance on commercially available AI products, recommending that organisations do not enter personal information, and particularly sensitive information, into publicly available AI tools. Professional bodies have said similar things: the Victorian Legal Services Board, for example, has warned lawyers against putting confidential client information into public AI chatbots.

For lawyers there is a second layer. Confidentiality is a professional duty, and putting privileged material somewhere outside the firm's control invites an argument about whether privilege survives.

Why a ban rarely works

The instinctive fix is a policy line: "Do not use AI." It tends to fail for the same reason shadow IT always has. The tools are useful, they are on everyone's phone, and nobody can see who is using them. A ban mostly moves the use somewhere less visible.

What works better is the boring combination:

1. Find out what is actually happening. Ask staff, without blame, which tools they use and for what. The answers are usually tasks you'd be happy to support: letters, summaries, rewording, checklists.
2. Give them a sanctioned tool that is just as easy. If the approved option is slower or worse, people will drift back.
3. Write a short, specific policy. One page: which tool is approved, what must never go into anything else, and who to ask.
4. Check in after a month. See whether the approved tool is being used and what people still go elsewhere for.

What "sanctioned" can look like

There are several reasonable options, and the right one depends on the practice. Enterprise versions of the major cloud tools offer contractual commitments about training and retention, and are a big step up from personal accounts. Some practices go further and want the assistant to run on hardware they control, so client and patient documents never leave the building or, at most, a dedicated server in Australia. That is the approach we take, but the first step, knowing what your staff already do, is worth taking whichever way you go.

This guide covers the parts that matter most for a small medical, legal or professional practice.

First: does the Act apply to you?

Most businesses with annual turnover of $3 million or less are exempt from the Privacy Act. There are important exceptions, and the big one for our readers is that any organisation providing a health service and holding health information is covered regardless of size. A two-doctor GP clinic, a physio or a psychologist in solo practice is bound by the Australian Privacy Principles (APPs).

Victorian health providers also have the Health Records Act 2001 (Vic) and its Health Privacy Principles, which cover similar ground. Law firms under the threshold may be outside the Privacy Act, but they are never outside their professional duty of confidentiality.

The principles that matter for AI

What the OAIC has said

In October 2024 the Office of the Australian Information Commissioner published two pieces of guidance: one on using commercially available AI products, and one for developers training generative AI models. For practices, the first is the relevant one. Its main points, paraphrased:

• Privacy obligations apply to personal information you put into an AI tool and to personal information the tool generates.
• As a matter of best practice, don't enter personal information, and particularly sensitive information such as health information, into publicly available generative AI tools.
• Do your due diligence on any AI product before using it with personal information, including where data is stored and whether it is used for training.
• Be transparent with the people whose information it is.

It is worth reading in full. It is short, practical and written for organisations rather than lawyers.

The 2024 reforms

The Privacy and Other Legislation Amendment Act 2024 was the first tranche of a long-running overhaul. Two parts are worth knowing about:

• A statutory tort for serious invasions of privacy, which commenced in June 2025. Individuals can now sue directly for serious, intentional or reckless invasions of privacy, including misuse of information.
• Transparency about automated decisions, which starts in December 2026. If a computer program is used to make, or substantially help make, decisions that significantly affect people, your privacy policy will need to say what kinds of personal information and decisions are involved.

A second tranche of reforms has been foreshadowed. Removing or narrowing the small business exemption has been discussed for years; nothing is settled, but it would be unwise to plan on the exemption lasting forever.

A short checklist

1. List the AI tools in use, approved or not.
2. For each, find out where the data goes, how long it's kept and whether it trains models.
3. Decide what kinds of information may go into which tool, and write it down.
4. Update your privacy policy and, where relevant, your patient or client information.
5. Make sure a qualified person reviews AI output before it is relied on.
6. Revisit this when the automated decision-making rules commence.

The duty hasn't changed

Under rule 9 of the Australian Solicitors' Conduct Rules, a solicitor must not disclose information that is confidential to a client, subject to narrow exceptions. Nothing about that rule mentions technology, and nothing needs to. Pasting a client's affidavit, advice or correspondence into a tool run by a third party is, in plain terms, giving that information to someone else.

Whether that is a breach depends on the tool and its terms. A firm's document management system is also run by a third party, after all. The difference is that firms choose those systems deliberately, with contracts about where data is held and who can see it. A junior lawyer's personal chatbot account comes with none of that.

What the regulators have said

In December 2024 the Victorian Legal Services Board and Commissioner, the Law Society of New South Wales and the Legal Practice Board of Western Australia issued a joint statement on the use of AI in Australian legal practice. Paraphrasing its main points:

• Lawyers should not enter confidential, sensitive or privileged client information into public AI chatbots or any other tool that does not guarantee the information stays private.
• AI cannot replace a lawyer's own judgement, and lawyers remain responsible for the accuracy of anything they file or send.
• Lawyers should understand the tools they use well enough to recognise their limitations.
• Time spent and costs charged should reflect the actual work done, including where AI made it faster.

The courts have also issued guidance. The Supreme Court of Victoria's guidelines on the responsible use of AI in litigation stress that parties and practitioners must understand the tools they use, and must not put confidential or privileged material into tools that aren't secure. Other courts have gone further, and some now require disclosure of AI use in certain documents. It is worth checking the current practice notes for each jurisdiction you appear in.

The privilege question

Privilege protects confidential communications made for the dominant purpose of legal advice or litigation. Disclosure to a third party can, in some circumstances, waive it. There's little Australian authority yet on whether putting a document into an AI tool counts, and a lot would turn on the facts: the terms of service, whether anyone could access it, whether it was used for training.

The safest position is not to have to find out. If privileged material never leaves systems the firm controls, there is nothing to argue about.

Where AI is genuinely useful in a firm

None of this means firms should avoid AI. Used carefully, it saves real time on:

• first-draft chronologies and summaries of long documents;
• turning file notes into tidy correspondence;
• comparing versions of an agreement and listing what changed;
• finding the precedent or earlier advice buried in the firm's own files;
• plain-English explanations for clients, which a lawyer then checks.

What these have in common is that a lawyer reviews the output. AI is very good at a first draft and unreliable as a final authority, especially on case citations. Treat it like a capable graduate who has never been to court.

Practical steps for a small firm

1. Write a one-page AI policy. Which tools are approved, what can go into them, and a flat rule against client material in anything else.
2. Choose tools on their data terms, not their demos. Ask where data is processed and stored, how long it's kept, whether it trains models, and who at the provider can access it.
3. Keep the permissions you already have. An assistant that searches the firm's files should only show each person the matters they can already open.
4. Verify every citation. Every time, without exception.
5. Talk to clients. Some will ask; it's better to have an answer ready.

Some firms settle on an enterprise cloud product with strong contractual terms. Others, particularly in family, criminal and estates work, prefer an assistant that runs entirely on the firm's own server so client files never leave the building. Both can be defensible. Using whatever is free on a staff member's phone is not.

The hardware

For a typical small practice, it is a single quiet, desktop-sized server with a powerful NVIDIA graphics card (GPU) and encrypted storage. It sits in a comms cupboard or under a desk, plugs into the normal network and uses about as much power as a gaming PC under load. Nobody needs to touch it day to day.

The GPU matters because language models are, underneath, enormous amounts of arithmetic. A graphics card does that arithmetic in parallel and fast enough that answers arrive at reading speed.

Practices that don't want hardware on site can have the same setup on a dedicated server in an Australian data centre. Dedicated means unshared: nobody else's workloads run on it.

The model

The "brain" is an open-weight language model. Several companies and research labs publish models whose weights, the learned numbers that make the model work, can be downloaded and run by anyone. Well-known families include Llama, Qwen and Mistral.

Once downloaded, the model runs entirely on the local server. It doesn't phone home, it doesn't need an internet connection to answer a question, and nothing you type is sent back to whoever trained it. You can, quite literally, unplug the internet and it keeps working.

Searching your own files

An assistant that only knows what it learned in training isn't much use for practice work. The useful part is asking questions of your own documents: "What did we advise this client about the lease in 2023?" or "Summarise the last three specialist letters for this patient."

This works through a technique usually called retrieval-augmented generation, or RAG:

1. The server builds a private search index of the folders you choose, stored on the same encrypted disk.
2. When someone asks a question, the server searches that index for the most relevant passages.
3. Those passages are handed to the model along with the question, and it writes an answer that points back to the source documents.

Crucially, the search respects existing permissions. If a staff member can't open a folder today, the assistant won't show them anything from it. Nothing is copied to a cloud service to make search work.

Using it

Staff use it in a web browser, in a chat window that looks and feels much like ChatGPT. They sign in with their normal practice account. There is no app to install on every machine.

The honest limits

Open-weight models have improved remarkably, and for everyday practice work such as drafting, summarising, rewording and searching they are very capable. But it would be misleading to pretend there is no gap.

• The very hardest reasoning tasks. The leading frontier cloud models are still ahead on long, multi-step problems and on the most difficult analysis.
• Breadth of general knowledge. Larger cloud models know more about more things. For practice work this matters less, because the important knowledge is in your own files.
• It is still AI. It can be confidently wrong. Every output is a draft for a qualified person to check, not clinical or legal advice.
• It doesn't make you compliant on its own. Keeping data in-house removes a large category of risk, but policies, training and good judgement still matter.

Who it suits

A private server makes the most sense when the information is genuinely sensitive (health records, privileged legal material, financial details), when a practice wants a straightforward answer to "where does our data go?", and when staff are already using AI and need something approved that is just as convenient. For a practice that only ever handles public information, a reputable cloud subscription may be all it needs, and we'll say so.

That is a real benefit, and worth having. It also means recording some of the most sensitive conversations anyone ever has. Before switching one on, a clinic should be able to answer the questions below.

1. How will we get the patient's consent?

Ahpra and the National Boards have published guidance on meeting professional obligations when using AI in healthcare. Among other things, it expects practitioners to involve patients in the decision to use tools that record their consultation, and to obtain informed consent. The RACGP has published practical guidance on AI scribes that makes similar points.

In practice that usually means a notice at reception, a sentence in the new-patient form, and a quick verbal check at the start of the consultation, with a genuine option to say no. Some consultations, such as those about family violence, mental health or sexual health, may call for switching it off without being asked.

2. Where does the audio go, and how long is it kept?

This is the question that separates products. Ask the vendor directly:

• Where is the audio processed, and where are transcripts stored? Is any of it outside Australia?
• Is the audio deleted once the note is generated, or kept? For how long?
• Is any patient data used to train or improve the vendor's models, even "de-identified"?
• Which subcontractors (cloud hosts, AI model providers) can access it?

Health information is sensitive information under the Privacy Act 1988 (Cth), and Victorian providers also have obligations under the Health Records Act 2001 (Vic). If data goes offshore, APP 8 can leave the clinic accountable for what happens to it there. The answers should be in writing, not in a sales call.

3. Who checks the note?

The draft note is a draft. Scribes can mishear drug names and doses, attribute a symptom to the wrong person when a parent and child are both talking, or include something said in passing that doesn't belong in the record. The treating practitioner remains responsible for the accuracy of the record, so build time into the workflow to read and correct each note before it is saved.

A useful habit for the first few weeks: compare a handful of AI notes against what you would have written yourself, and keep a short list of the kinds of errors you see.

4. Is it a medical device?

The Therapeutic Goods Administration has indicated that scribes which only transcribe and summarise a consultation are generally not regulated as medical devices, but that products which go further, such as suggesting diagnoses or treatments, may be. If a scribe offers clinical suggestions, ask the vendor about its regulatory status and whether it is included in the Australian Register of Therapeutic Goods.

5. What happens to everything else it hears?

Consultations wander. A patient mentions a partner's diagnosis, an employer's name, a worry about a child. Ask how the product handles third-party information and whether the clinic can control what ends up in the note versus what is discarded.

6. Does it fit our systems?

The practical questions matter too: does it work with your clinical software, does it handle the accents and languages of your patients, and what happens if the internet drops mid-consultation?

Where private AI fits

Many clinics will reasonably choose a well-established cloud scribe with clear Australian data residency and strong contractual terms. Others, particularly those with sensitive patient groups, prefer that recordings and transcripts never leave the practice at all. A private AI server can transcribe and draft notes on-site, with the same model also available for letters, summaries and searching the clinic's own documents. Either way, the questions above are the right place to start.