AI Policy Template for Mortgage Brokers

Build an editable AI use policy from your approved tools, data permissions and review rules.

Brokerage

Brokerage name

Policy owner

The person or role approving tools and data permissions.

Approved tools

Approved tool 1

Tool and plan

Name the exact plan and workspace staff may use.

Allowed data

Client categories need a recorded privacy assessment.

Permitted tasks

Up to five approved tools.

Use and review

Prohibited tasks

Output reviewer

Incident contact

Include the internal person or role and reporting channel.

Review frequency

Your AI use policy

Editable AI acceptable use policy

Ready for your brokerage's review.

AI ACCEPTABLE USE POLICY

Brokerage: Banksia Example Finance
Policy owner: Practice owner
Applies to staff and contractors working for this brokerage.
Effective date: ____________________
Version: ____________________

Approved tools and data rules
1. Writing assistant / brokerage business workspace
Permitted tasks: Draft general educational posts and rewrite public website copy
Allowed data: Public information only
Client personal information is prohibited.

Use only the listed plan and brokerage-approved account. Personal accounts, new features, connectors and meeting bots need approval before use. A paid or private-labelled plan does not itself authorise client information. Give each tool only the minimum information needed for its approved task. Treat uploaded files and connected data as inputs covered by the same rules.

Before allowing client information, the policy owner records the lawful use or disclosure basis, privacy assessment, notices or consent where required, provider access, retention, training controls and overseas handling. Obtain licensee approval where required. If that assessment is incomplete, staff must use public or properly de-identified information only.

Permitted work and human review
Use each tool only for its listed tasks.
Prohibited tasks: Client recommendations, credit assessments, lender submissions and unsupervised client messages
Output reviewer: The broker responsible for the work
The reviewer checks facts and calculations against original records, checks the suitability of language and removes invented information. Review every output before it reaches a client or enters a client file. AI output does not approve a loan or replace the responsible broker's judgement and obligations. Keep the approved final work and the material review record in the brokerage's authorised record system. Follow its retention rules.

Incidents and questions
Report suspected disclosure immediately to: Practice owner through the internal incident channel.
Stop the affected AI task and pause further sharing. Preserve the prompt, output and access details in the authorised incident record without spreading client information. The policy owner follows the brokerage's incident response process, involves the licensee and privacy contact as appropriate, and assesses any notification obligations. Staff must not assume deleting a chat retrieves information already disclosed.
Request approval before changing a tool, plan, data rule or permitted task. Staff must wait for a recorded decision before proceeding outside this policy.

Policy review
Review frequency: Every three months.
The policy owner also reviews changes to provider terms or settings, new uses and incidents. Check staff practice against the approved tool list and withdraw access when approval ends. Record the version, approval and next review in the policy register. Give staff the updated policy and training before changed permissions apply.

Staff acknowledgement
I have read this policy, understand the tool and data restrictions, and know how to report an incident or ask for approval.
Staff name: ____________________
Signature: ____________________
Date: ____________________
Policy approval: ____________________

Editing the policy pauses automatic replacement. Exports use the displayed text.

The initial policy is a fictional example. Entries and policy text stay in this browser.

AI ACCEPTABLE USE POLICY Brokerage: Banksia Example Finance Policy owner: Practice owner Applies to staff and contractors working for this brokerage. Effective date: ____________________ Version: ____________________ Approved tools and data rules 1. Writing assistant / brokerage business workspace Permitted tasks: Draft general educational posts and rewrite public website copy Allowed data: Public information only Client personal information is prohibited. Use only the listed plan and brokerage-approved account. Personal accounts, new features, connectors and meeting bots need approval before use. A paid or private-labelled plan does not itself authorise client information. Give each tool only the minimum information needed for its approved task. Treat uploaded files and connected data as inputs covered by the same rules. Before allowing client information, the policy owner records the lawful use or disclosure basis, privacy assessment, notices or consent where required, provider access, retention, training controls and overseas handling. Obtain licensee approval where required. If that assessment is incomplete, staff must use public or properly de-identified information only. Permitted work and human review Use each tool only for its listed tasks. Prohibited tasks: Client recommendations, credit assessments, lender submissions and unsupervised client messages Output reviewer: The broker responsible for the work The reviewer checks facts and calculations against original records, checks the suitability of language and removes invented information. Review every output before it reaches a client or enters a client file. AI output does not approve a loan or replace the responsible broker's judgement and obligations. Keep the approved final work and the material review record in the brokerage's authorised record system. Follow its retention rules. Incidents and questions Report suspected disclosure immediately to: Practice owner through the internal incident channel. Stop the affected AI task and pause further sharing. Preserve the prompt, output and access details in the authorised incident record without spreading client information. The policy owner follows the brokerage's incident response process, involves the licensee and privacy contact as appropriate, and assesses any notification obligations. Staff must not assume deleting a chat retrieves information already disclosed. Request approval before changing a tool, plan, data rule or permitted task. Staff must wait for a recorded decision before proceeding outside this policy. Policy review Review frequency: Every three months. The policy owner also reviews changes to provider terms or settings, new uses and incidents. Check staff practice against the approved tool list and withdraw access when approval ends. Record the version, approval and next review in the policy register. Give staff the updated policy and training before changed permissions apply. Staff acknowledgement I have read this policy, understand the tool and data restrictions, and know how to report an incident or ask for approval. Staff name: ____________________ Signature: ____________________ Date: ____________________ Policy approval: ____________________

What an AI Use Policy Covers

An AI use policy tells staff which tools they may use, which information each tool may receive and who reviews its output. This AI policy template turns those decisions into an editable staff policy. You can copy the text, download it or print it.

The Office of the Australian Information Commissioner (OAIC) recommends avoiding personal information in publicly available generative AI tools. Its guidance on commercial AI products covers product assessment and privacy risks. An approved business plan still needs an assessment of its actual settings and use.

The Australian Securities and Investments Commission (ASIC) examines AI governance in Report 798, Beware the gap. Its review includes credit licensees. Use the policy alongside your licensee's requirements and existing privacy and incident procedures. The generated document does not certify compliance.

Complete the Policy

Replace the fictional brokerage name and policy owner first. Name the person or role staff can approach for an approval. The policy owner maintains the approved list and records changes.

For each approved AI tool, enter its exact plan and workspace. Record the tasks staff may perform in that tool. Add another tool when its account, data permissions or permitted work differ. The form holds up to five tools. You can add further tools in the editable policy.

Choose public information, de-identified information or specified client categories for each tool. Public information excludes client personal information. De-identification requires assessing whether the remaining details could identify someone. Removing a name can leave an identifiable address, unusual transaction or financial history.

If you choose client categories, name the categories and the approved purpose. Before issuing that permission, record the privacy assessment and lawful basis for the use or disclosure. Assess provider access, model training, retention and overseas handling. Include required notices or consent and any licensee approval.

Enter prohibited tasks separately from permitted tasks. Name the output reviewer and incident reporting channel. Choose a review frequency that your brokerage can carry out. The document also requires review when tools, terms, settings or uses change.

You can edit the generated policy directly. Editing pauses automatic replacement so a later form change does not overwrite your work. Discard edits and rebuild applies the form's decisions again. Reset example restores every field and removes added tools. Copy, download and print use the displayed text.

An Example AI Policy for a Brokerage

Banksia Example Finance is a hypothetical three-person brokerage with an owner, a broker and an administrator. Its practice owner approves one writing assistant in the brokerage's business workspace. The tool may rewrite public website copy and draft general educational posts using public information only.

The example prohibits client recommendations, credit assessments, lender submissions and unsupervised client messages. The broker responsible for the work reviews each output before use. Staff report suspected disclosure to the practice owner through the internal incident channel. The owner reviews the policy every three months and after a relevant change or incident.

The tool opens with these decisions. A staff member must obtain approval before adding a meeting recorder or supplying a client's payslip. Neither action is covered by the example's permission to draft public copy.

Roll It Out to Staff

Review the completed policy against your brokerage's actual tools and licensee instructions. Add its effective date and version, obtain the required approval and save the issued copy in your policy register. Keep a record of who receives each version.

Walk staff through a permitted task and an incident example. Show them how to report an accidental upload and how to request a new tool. Record acknowledgement after that training. An acknowledgement records understanding of the rules.

Find unapproved accounts through a shadow AI review before treating the approved list as complete. At each policy review, compare actual staff use with that list. Remove old access and give staff the revised rules before changing their permissions.

Track My Trail Team

We develop software to simplify trail book management for mortgage brokers. Our tools provide fast and practical insights to help brokers get the most out of their trail books.