AI Frameworks &
Systems
Practical governance frameworks to help your team use AI safely and effectively
Traffic Light Protocol
A simple system to classify what data can be used with AI tools
Data that triggers Privacy Act:
- Tax File Numbers (TFNs)
- Biometric Data (facial recognition, voiceprints)
- Sensitive Health Information
- Unreleased IP/Trade secrets
NEVER enter into cloud-based AI, even paid
Internal confidential data:
- Client Names & Addresses (only in Enterprise licenses)
- Financial Reports (P&L, balance sheets)
- Strategy Documents (marketing plans, board minutes)
Safe in Enterprise tools, NOT in free tools
Public/low-risk data:
- Website Content (blogs, landing pages)
- Generic Templates (email drafts, policy skeletons)
- Public Market Data (competitor pricing, industry reports)
Safe in any tool
Human-in-the-Loop Checklist
AI does 90% of the heavy lifting, human does the final 10%. Use this checklist before sending any AI-generated content.
Verified specific dates, prices, names? (AI can hallucinate)
Does this sound like us? (Remove "delve", "tapestry", "comprehensive landscape")
Did I click the links? (AI sometimes invents URLs)
Is language inclusive and appropriate for Australian context?
Plain English AI Policy
A simple, readable policy template you can customize and share with your team
Approved Tools Only
List paid, secure tools only
The 'No-Training' Rule
Never put work data into free tools
The Red Light Rule
Never enter client names, TFNs, passwords
You Are The Pilot
You are responsible for every word sent
Declare It
If AI created substantial part, declare it
PLAIN ENGLISH AI POLICY - TEAM HANDOUT 1. APPROVED TOOLS ONLY Only use paid, enterprise-grade AI tools approved by management. Current approved tools: [INSERT YOUR APPROVED TOOLS HERE] 2. THE 'NO-TRAINING' RULE Never put work data into free AI tools. Free tools may use your data to train their models. Only use enterprise/paid versions. 3. THE RED LIGHT RULE NEVER enter into any AI tool: • Client names or addresses • Tax File Numbers (TFNs) • Passwords or access credentials • Biometric data • Sensitive health information • Unreleased IP or trade secrets 4. YOU ARE THE PILOT AI is your co-pilot, not autopilot. You are personally responsible for every word that leaves this organisation. Always review, verify, and approve AI-generated content before sending. 5. DECLARE IT If AI created a substantial part of any work product, declare it to your manager/team. Transparency builds trust. --- Questions? Contact: [INSERT CONTACT EMAIL] Last updated: 29/09/2026
