AI Usage Policy for Australian Businesses: What Staff Sign Before AI Touches Your ERP

An AI usage policy is a short document staff sign that says what AI can and can’t be used for, what data may go into tools, who approves higher-risk uses, how to report misuse and when it gets reviewed. Those five checks come from Australia’s National AI Centre. A business running Odoo or MYOB Acumatica needs a sixth: which agents may write to the ERP.

At a glance

• Who it is for: owners, CFOs and operations managers of Australian businesses on Odoo or MYOB Acumatica whose staff already use AI tools, with or without permission, and who are about to connect one to live business data.
• Problem it solves: nobody has written down which tools are approved, what data can go into them, or who may give an agent the ability to create and change records. Without that, every later control rests on guesswork.
• Platforms: Odoo 20 and MYOB Acumatica, plus whatever general AI tools staff use beside them.
• What it covers: approved tools, data rules, who approves a new use, who may hand out ERP keys and write skills, the approval gate on every write, how to report a problem, and the review date.
• Who signs: every staff member with an ERP login, and a named owner who approves changes.
• What it never does: replace your privacy policy, your agent register or legal advice. It is the internal rulebook that sits beside them.
• Typical cost: the National AI Centre’s AI policy guide and template is free. We don’t publish a separate price for policy work; a signed staff policy is one of the controls listed on our AI agents for ERP in Australia page, where a pilot starts from $5,000 ex GST as at 12 October 2026.
• Typical timeline: no published figure for the policy on its own. The same hub page lists discovery at 1 to 2 weeks, and the policy should be signed before the sandbox pilot that follows it.
• Last verified: 12 October 2026 against the National AI Centre’s Create an AI policy page, the OAIC’s guidance on commercially available AI products, the ASD’s AI guidance for small business, Odoo’s 20.0 AI agents and MCP server documentation and MYOB’s AI feature page.

Most AI policies we get shown were downloaded, renamed and filed. They talk about ethics and fairness, which is fine, and say nothing about the accounts payable clerk who pasted a supplier statement into a chatbot last Tuesday. This post is about the version that changes what people do on a Wednesday.

What is an AI usage policy, and who needs one?

An AI usage policy is the internal document that tells staff which AI tools they may use for work, what they may put into them, and who decides when someone wants to do something new. The National AI Centre calls it “your organisation’s essential guiding resource for all AI related activities” on its Create an AI policy page, and its foundations guidance tells organisations to create one.

Who needs one? Anyone whose staff use AI at work, which is more businesses than have decided to. The ABS Characteristics of Australian Business release of 25 June 2026 reports that 12% of Australian businesses used AI in 2024-25. That figure counts businesses that said yes. It can’t count the staff who never asked.

The need gets sharper once an ERP is involved. A chatbot that drafts a marketing email is one risk. An assistant holding a key to your customer ledger is another, and the policy is where you say who is allowed to create that key.

What should an AI usage policy cover?

The National AI Centre’s page gives five things to check before you publish: what AI can and can’t be used for, what data staff can put into tools, who approves higher-risk use cases, how staff should report issues or misuse, and when the policy will be reviewed. We’d keep all five and add one for any business with an ERP.

Two pages is enough. If the policy needs an appendix, make it the list of approved tools and the list of agents, because those change and the principles don’t. The list of agents is your AI agent register, and the policy should point to it by name.

What data can staff put into AI tools?

Start with the regulator’s own words. The OAIC’s guidance on commercially available AI products recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. The ASD’s AI guidance for small business tells businesses to define what data can’t be uploaded into AI platforms, and its checklist includes confirming whether your data will be used to train AI models.

An ERP holds exactly the data those two documents are worried about. So the data clause should name it in the words your staff use:

• Never in a public tool: customer and supplier contact lists, anything with a bank account number, employee records, and customer-specific price lists.
• Only in an approved tool: aged receivables, sales history, stock and margin reports, and supplier bills.
• Fine anywhere: your own published product information, and a question about how a feature works.

“Approved tool” needs a definition too. In practice it means a tool where someone has read the terms and can say where the data goes. For AI inside the ERP, the vendors publish that. MYOB’s AI page says MYOB Acumatica stores customer data in Australia, that processing may happen in Australia or on global infrastructure depending on the feature, and that AI providers cannot store the data or use it to train their models. Odoo’s 20.0 AI agents documentation says Odoo supports two providers, ChatGPT from OpenAI and Gemini from Google, so the question for an Odoo site is which provider each agent uses and under whose account. Write the answers into the approved-tool list with the date you checked.

Where does the policy meet the ERP?

This is the clause the downloaded templates don’t have, because they weren’t written for a business whose AI can post a document.

Odoo 20

Odoo 20, released on 24 September 2026, makes two things easy that a policy needs to control. The first is agents with write skills. Odoo’s agents documentation says an agent with no skills can only provide information, and lists Create Records and Update Records among the skills you can assign. One tick turns an agent that answers questions into one that changes data.

The second is outside assistants. Odoo’s 20.0 MCP server documentation describes a built-in server that lets an external AI client call tools in the database, authenticated by an API key a user generates in their own preferences. Five tools are exposed by default, and others stay hidden until someone ticks Available in MCP on a server action. We went through who that connection runs as in our post on Odoo 20 MCP server permissions.

So the Odoo lines of the policy are short. Staff don’t generate an MCP key without the system owner’s approval. Only the system owner assigns Create Records or Update Records to an agent or exposes a new tool. Anything an agent creates stays in draft until a named person confirms it.

MYOB Acumatica

MYOB’s AI page lists eight AI features as at 12 October 2026, including an AI Assistant for plain-language questions and AI Automation. MYOB describes AI Automation as something power users or administrators build, which anyone in the business can then use. That’s the policy line: name who may build an automation, and who reviews it before it’s shared. We covered how the result is handed back to a person in our post on MYOB Acumatica AI Automation.

On both platforms the rule we’d put in bold is the same. Drafts first. A person approves every write to the ledger, to prices, to stock and to tax. Language models make mistakes, and the policy’s job is to make sure a mistake arrives as a draft.

A worked example: the price file and the order agent

Picture a Gold Coast building-supplies wholesaler on Odoo 20, about 45 staff, with one agent in production. It reads emailed PDF purchase orders and drafts sales orders, and a sales coordinator approves each one before it’s confirmed.

In the first month under a signed policy, three things happen. A sales rep wants to tidy a customer’s price file and reaches for a public chatbot. The data clause says customer-specific price lists don’t go there, so he uses the approved tool and the job takes the same ten minutes. A warehouse supervisor asks whether she can connect an assistant on her laptop to Odoo to check stock. The approval clause sends the request to the system owner, who issues a key on a login that can read stock and nothing else, and adds a row to the register. And the order agent drafts an order against the wrong customer, because two accounts share a trading name. The coordinator catches it at the approval step, rejects the draft and reports it to the agent’s owner that afternoon, which is what the reporting clause asks for. The owner adds an ABN check to the agent’s instructions.

Nothing in that month is dramatic, and that’s the idea. Each clause did one small job.

“I can tell in about a minute whether a policy was written for the business or downloaded for the auditor. The downloaded one talks about fairness and transparency. The real one says who’s allowed to give an agent a key to the ledger, and it has a name next to it.”

Bill Alvarez, Practice Manager, Auboros

Does Australian law require an AI usage policy?

Not by that name, as far as we can find. The government’s own summary of AI and Australian law is a list of existing laws that apply to AI risks: the Australian Privacy Principles, the Australian Consumer Law, work health and safety law and the Fair Work Act among them. It notes that Fair Work obligations can include consulting staff when AI is introduced, which is a good reason to draft the policy with the people who will sign it.

One date is worth separating out, because it gets confused with this topic. From 10 December 2026, a business covered by the Privacy Act has to describe in its privacy policy certain decisions that computer programs make or substantially help make, per the OAIC’s guidance of 30 September 2026. That is your public privacy policy, a different document for a different reader. The internal usage policy is how you find out which of those decisions exist, since it’s the place every new use has to be approved. None of this is legal advice; take the privacy policy wording to your adviser.

How do you get staff to actually follow it?

A signature is the easy part. Three habits make the difference in our experience.

• Write it with the people who use the tools. The National AI Centre’s advice is to test the draft with the people who will use, review or oversee it. They know which rules will be ignored.
• Give people an approved way to do the thing. A rule that says no public chatbots, with no approved tool beside it, gets quietly broken within the week.
• Review it on a date. Every six months, after an ERP upgrade, and whenever the list of agents changes. The ASD’s guidance says to train and remind staff, and a review is the natural reminder.

We run agents over our own operations under the same kind of rules, drafts-first, with a person on every approval. The policy is the cheapest of the controls and the one the others depend on. The rest of the set is in our guide to AI agent governance.

Goes well with

• The AI agent register: the list the policy points to, with an owner, a permission set and an approval gate for each agent.
• Odoo 20 MCP server permissions: what a key actually opens, before you decide who may hold one.
• What an AI agent costs to run in Australia: the budget conversation that follows once the rules are agreed.

Need an AI usage policy your staff will sign and your ERP will back up?

Auboros designs and governs drafts-first AI agents over Odoo and MYOB Acumatica from Brisbane, for businesses across Queensland and Australia, and the usage policy is where that work starts. If your team is already using AI and nothing is written down, book a free consultation. We’ll go through what’s in use, what’s connected, and what the first two pages should say.