AI Policy Template for a Mortgage Brokerage

What an AI Policy Covers

An AI use policy sets the rules staff follow when they use AI for work. It applies to employees and any contractors or temporary staff who handle brokerage information or perform work on its behalf.

Cover AI features inside existing software as well as separate AI services. A meeting platform’s automatic summary can handle client information even if nobody opens a separate chatbot.

The policy needs a named owner with authority to approve uses and handle incidents. The National AI Centre’s AI policy guidance recommends clear rules for permitted uses, data inputs and oversight, with an issue-reporting process and review arrangements.

Keep the staff policy within your broader AI governance framework. The policy tells people what to do, while the framework records approvals and checks whether the rules work.

AI Policy Template

Copy the clauses below as a model policy and adapt them before issue. Complete every field in this setup record, including the location of the approved-tool register. If a register contains no approved use, staff have no authority to use AI for brokerage work.

Policy field	Brokerage to complete
Brokerage	Legal or trading name and the people covered by this policy.
Policy owner	Name, role and contact details of the person who approves AI use.
Backup contact	The person staff contact if the policy owner is unavailable.
Document control	Policy version, approval date, effective date and next review date.
Approved-tool register	Location of the current register and the person who maintains it.
Incident reporting	The reporting channel and contact for urgent privacy or security concerns.

1. Scope and Responsibility

This policy applies whenever you use AI for brokerage work, including on a personal device or account. Follow it alongside our privacy and security policies, client-record procedures and licensee requirements.

You are responsible for checking the work you use. The policy owner approves each tool and task before use, maintains the register and arranges reviews. Ask the policy owner before starting any use that the register does not cover.

2. Approved Tools and Accounts

Use only the tools, plans and accounts listed in the approved-tool register, and only for the tasks listed there. A paid account, trial or feature inside approved software is not automatically approved for AI use.

Use a business-managed account where the register requires one. Do not enable an AI integration, connect client records or extend a tool’s permissions without approval.

3. Prohibited Uses

Do not use AI to invent client facts, supporting documents or evidence of checks that did not happen. Do not use it to bypass access controls, impersonate a client or enter a client’s authentication details.

AI must not make the brokerage’s final credit recommendations or send client communications without the required human review. Do not allow an AI agent to lodge an application or change a client record unless that exact action has separate written approval.

4. Client Information

Enter client information only where the register expressly permits that data for that task and account. Use the minimum information needed, and follow the approved collection, notification and consent process for that use.

Keep passwords and authentication codes out of AI tools. Do not upload identity documents, tax file numbers or sensitive information under a general approval for client data. Each requires a specific assessment and written permission from the policy owner before use.

Do not assume that deleting a name makes a client scenario anonymous. If the remaining details could identify the client, treat them as client information.

5. Checking Outputs

Before using an output, compare client facts and figures with the original records. Verify lender-policy statements against their source and check that all conditions apply to the client’s circumstances.

The reviewer must correct errors and remove unsupported claims before the output is sent, saved as a final record or relied on. Keep the required source material and review evidence with the client file. Escalate an answer you cannot verify.

6. Disclosure and Recording

Follow the approved wording and process when explaining our AI use to clients. Identify any client-facing AI service as AI and give clients a way to contact a person.

Before recording or transcribing a meeting, follow the brokerage’s permission process and applicable recording rules. Do not switch on recording while permission is unresolved. A general AI disclaimer does not authorise recording or entering client information.

7. Errors and Breaches

Report suspected misuse, incorrect outputs and unintended disclosures to the policy owner immediately through the listed reporting channel. Stop the affected use and prevent further sharing where you can do so safely.

Preserve the information needed to investigate, including the tool, account and affected task. Follow instructions on securing evidence and correcting client records. The policy owner coordinates the incident response and assesses any notification obligations with the relevant advisers or licensee.

8. Training and Review

Complete the policy training and acknowledgement before using an approved AI tool. Report changes in a tool’s terms, data settings or behaviour to the policy owner.

The owner reviews this policy at its scheduled review and after material changes or incidents. Staff must follow any restriction or suspension issued during a review.

Approved and Banned AI Tools

List approval by account and task, because approving a product name alone leaves staff guessing about what they can upload. Use a register with these fields and keep its current version accessible to everyone covered by the policy.

Register field	What the entry must say
Tool and plan	Exact product, subscription plan and approved business account.
Permitted task	The specific work staff may perform.
Permitted inputs	Data categories allowed for that task, plus any exclusions.
Output control	Who checks the result and what evidence they retain.
Decision and owner	Approved, restricted or banned, with the decision-maker and reason.
Review trigger	Next review and changes that require reassessment.

For example, a hypothetical approval could allow a business-managed writing assistant to edit public marketing copy. The same entry could prohibit client information and require a staff member to check factual claims before publication.

For a new tool or use, staff submit the task, proposed account and a description of the information involved. Use fictional or public examples in the request. The owner assesses the vendor terms and risks, records the decision and updates the register before staff begin.

A free version and a business plan can have different terms. Approval for one doesn’t carry across to the other, and adding a new feature can require a new assessment.

Client Data Rules

Give staff a rule for each data category in each approved tool. A broad instruction to use AI responsibly cannot tell an employee whether they may upload a payslip.

The Office of the Australian Information Commissioner (OAIC) recommends keeping personal information out of publicly available generative AI tools, particularly sensitive information. It also explains that privacy obligations apply to personal information generated in AI outputs.

Use the following defaults when adapting the model policy. Your register can impose stricter limits for an individual tool.

Information	Suggested default rule
Public material	Allow only for an approved task, subject to confidentiality and copyright restrictions.
Fictional examples	Allow where the example contains no real client details.
Identifiable client facts and financial documents	Prohibit unless the register expressly approves the data, account and task after assessment.
Sensitive information, such as health information	Require a separate assessment and written permission, with the applicable privacy requirements addressed.
Identity documents and tax file numbers	Exclude from general client-data approval and assess the specific need separately.
Passwords and authentication codes	Prohibit entry into AI tools.

The owner’s assessment must address who can access inputs and outputs, model-training permissions, storage locations and retention. Staff also need instructions for exporting or deleting data and for handling shared conversation histories.

Generative AI Rules

Generative AI can help draft client emails and documents, but staff must check every client-specific statement before use. Put the review before sending, including when the draft appears directly inside an email or document editor.

Use this sequence for client communications:

1. Confirm that the tool and the proposed inputs are approved for the task.
2. Ask for a draft using only permitted information. Where client data is prohibited, use a general brief and add client facts outside the AI tool.
3. Compare the draft with the client’s records and the relevant source material. Correct figures, conditions and names, and remove invented claims.
4. Have the responsible staff member approve the finished communication, then save the final version under the brokerage’s record procedures.

For example, AI might turn “we expect to hear from the lender” into a promise of approval. The reviewer must remove that promise unless the underlying facts support it. Check attachments and recipients as part of the normal sending process.

Keep disclosure wording consistent with the brokerage’s actual use. A sentence saying a broker reviews AI-assisted work is appropriate only if that review happens. It cannot replace the review or make an unapproved upload acceptable.

AI Policy Generators

An AI policy generator can produce draft clauses from the information you provide about your business. It cannot establish your actual vendor settings or decide whether staff follow a rule.

Add your approved accounts, data restrictions and incident contacts to any generated draft. Replace generic roles with the people who can act, and check that the policy reflects your licensee’s requirements and the tools staff actually use.

Use fictional details or general business information when trying a generator. Do not upload client files to obtain a policy about protecting those files. Read the draft against the same approval and output-checking rules you intend staff to follow.

Train Staff on the Policy

Train staff with examples from the work they perform, then require them to demonstrate the rule before signing the acknowledgement. A short initial session can use this suggested schedule.

Training part	Suggested time	What staff must demonstrate
Find an approval	10 minutes	Locate the approved account, task and input limits in the register.
Handle client information	10 minutes	Distinguish a public example from information that could identify a client.
Review a draft	15 minutes	Find an incorrect client fact and an unsupported lender claim in a fictional draft.
Report an incident	5 minutes	Identify the contact and first action after an unintended upload.

Keep a sign-off record for each person. Record their name and role, the policy version, training date, trainer and acknowledgement date. Include confirmation that they can find the register and know how to report an incident.

Before the policy takes effect, ask one staff member to use it for a fictional email draft. They must find the approved tool, identify permitted inputs and explain who checks the result. Fix any unclear instruction, then issue the policy and retain the completed training records.