AI Policy

Last updated: September 2026

Tibballs & Co Pty Ltd trading as Online Lifestyle Co (“OLC”, “we”, “us” or “our”) uses artificial intelligence as a support tool. People remain responsible for the work we produce, the decisions we make and the services we provide. This policy explains how we select, use and supervise AI so that it supports useful work without weakening privacy, confidentiality, accuracy, fairness, security or trust.

1. Purpose

This policy establishes OLC’s requirements for the ethical, responsible and effective use of AI. It is intended to help OLC use AI where it adds genuine value while keeping people accountable for outcomes.

The policy aims to:

protect clients, customers, website visitors, staff, contractors and other people affected by OLC’s use of AI
support efficient and high-quality digital marketing, website, administrative and educational work
maintain human judgment, professional responsibility and appropriate client oversight
identify and manage privacy, confidentiality, security, accuracy, intellectual property, fairness and reputational risks
be transparent about material AI use where disclosure is appropriate or required
comply with applicable laws, contracts, platform rules and OLC policies.

2. Scope

This policy applies to OLC management, employees, contractors and other people who select, configure, manage or use AI for OLC business activities or client work.

It covers AI developed by OLC, purchased or subscribed to from a provider, accessed through a public service, or embedded in software such as marketing, design, website, analytics, customer relationship management, productivity or automation platforms.

The policy applies to each use of an AI system, not only to the tool as a whole. A tool approved for routine drafting is not automatically approved to process personal information, publish content, make decisions or access a client’s systems.

Standard spreadsheet formulas, fixed rule-based automations and traditional dashboards are outside the definition of AI for this policy. OLC’s privacy, confidentiality, security, accuracy and contractual requirements still apply to those technologies.

If a person is unsure whether a tool or feature is within scope, they must treat it as in scope and ask the policy owner before using it.

3. What we mean by artificial intelligence

An AI system is technology that uses data to make inferences and produce outputs such as content, predictions, recommendations, classifications or decisions with some degree of autonomy. This includes generative AI, machine learning, predictive analytics, conversational assistants, and AI features used for writing, design, coding, search, analysis or automation.

AI output includes text, images, audio, video, code, summaries, classifications, analyses, recommendations and other material created or changed with AI assistance.

4. How OLC uses AI

OLC may use approved AI tools to assist our team with the following activities. The extent of AI involvement depends on the project, client requirements, data involved and assessed risk.

researching and summarising public or appropriately authorised information
marketing strategy development, campaign planning, brainstorming and ideation
drafting, editing and improving website, search engine optimisation, social media, advertising, email and other marketing copy
developing content, design concepts, images, presentations, templates, courses and other digital or educational resources
analysing website, campaign, social media, search and business data and assisting with reports
supporting website development, coding, troubleshooting, testing and technical documentation
transcribing or summarising meetings and communications where notice, consent and other safeguards are used when required
supporting workflow automation, project administration, planning and internal knowledge management.

AI assists OLC’s team; it does not replace OLC’s professional responsibility for agreed services. A suitably skilled person must review and approve material AI-assisted work before it is provided to a client or published, unless a particular low-risk automated process has been assessed, approved and monitored under this policy.

OLC will follow written client requirements that restrict or prohibit AI use. Where a contract, brief, platform rule, law or risk assessment requires approval or disclosure, OLC will obtain or provide it before proceeding.

5. Responsible AI principles

Human centred and beneficial use

OLC will use AI for legitimate business or client purposes that are reasonably expected to provide a benefit. AI must support human capability and autonomy and must not be used to deceive, manipulate or exploit people.

Clear accountability

A person must be accountable for every approved AI system or use case. OLC remains responsible for its own services and cannot transfer that responsibility to an AI provider or an AI-generated output.

Proportionate risk management

The review, testing, approval, disclosure and monitoring required for an AI use must match its potential impact. Uses involving personal or confidential information, important decisions, vulnerable people, public trust, system access or regulated subject matter require stronger controls.

Quality reliability and security

AI systems and outputs must be suitable for their intended purpose. OLC will test and monitor higher-risk uses, protect systems and data, and correct or stop a use that does not perform acceptably.

Fairness inclusion and accessibility

AI use must not unlawfully discriminate or create avoidable unfairness. OLC will consider whether outputs could disadvantage a person or group and will apply human review, accessibility checks and other controls appropriate to the use.

Transparency and contestability

OLC will communicate material AI use when appropriate and will give people a practical way to raise concerns about an AI interaction or an outcome materially influenced by AI. Relevant matters will be reviewed by a person.

Human oversight and control

People must be able to review, pause, override or stop an AI-assisted process when necessary. Critical activities must have a reasonable fallback or recovery process where interruption could materially affect a client or another person.

6. Risk assessment and approval

Every new AI tool and materially different AI use must be screened before use. The same tool may fall into different risk levels depending on the data, audience, degree of automation and potential impact.

Risk level	Typical characteristics	Examples	Required action
Routine	Low impact; no sensitive or unnecessary personal information; no material decision about a person; a person reviews the output.	Brainstorming, outlining, formatting, general research using public information, draft copy and non-sensitive administration.	Use an approved tool, follow this policy and complete normal human review.
Elevated	Personal or confidential information; customer-facing interaction; system or publishing access; realistic synthetic media; regulated or high-impact content; material influence on a person.	AI chatbot, AI meeting recorder, profiling or recommendations, code that handles data, or substantial health, financial or legal content.	Document the assessment and obtain management approval before use. Apply stronger testing, privacy, security and disclosure controls.
Prohibited	Unlawful, deceptive, discriminatory, unauthorised or outside OLC’s risk tolerance.	Unapproved disclosure of sensitive data, deceptive impersonation, fabricated reviews or results, or a solely automated decision with a legal or similarly significant effect.	Do not proceed. Escalate any uncertainty to OLC Management.

The assessment must consider:

the purpose, expected benefit and whether AI is necessary or appropriate
the people who may be affected and the seriousness and likelihood of harm
the type, source, quality and permitted use of input and output data
privacy, confidentiality, security, cross-border processing and data retention
accuracy, bias, accessibility, reliability and foreseeable misuse
copyright, trade marks, licences, attribution, image rights and other intellectual property issues
the level of human review, testing, monitoring, fallback and ability to stop the system
client instructions, contractual terms, platform rules and disclosure requirements
the provider’s terms, settings, security practices, data use and change history.

Approved tools and material use cases must be recorded in OLC’s internal AI register with an owner, purpose, approved data types, risk level, controls and review date. Approval must be reconsidered when the tool, provider, data, integration, audience or purpose changes materially.

7. Human review and professional responsibility

The OLC team member responsible for a task must apply professional judgment to AI output. Review must be performed by a person with enough knowledge to identify likely errors and understand the consequences of relying on the output.

Depending on the work, review may include:

checking facts, dates, prices, calculations, statistics, quotations and sources against reliable material
checking marketing claims, testimonials, case studies and performance statements for accuracy and evidence
checking legal, financial, health or other regulated subject matter with an appropriately qualified source or adviser
reviewing code, integrations, permissions and security before production deployment
checking spelling, grammar, tone, brand requirements, accessibility and platform rules
checking for bias, harmful assumptions, confidential information and intellectual property concerns.

AI must not invent sources, reviews, testimonials, results, credentials, client approvals or facts. If a material error or harmful output is identified after release, OLC will assess the impact and take reasonable steps to correct, withdraw or clarify it and notify affected parties where appropriate.

8. Privacy confidentiality and data protection

OLC’s Privacy Policy and confidentiality obligations apply to information used with or produced by AI. Privacy requirements apply to both inputs and outputs, including personal information inferred or generated by an AI system.

OLC personnel must:

use the minimum information reasonably necessary for the task and remove or de-identify personal details where practical
use personal information only in an approved system and for a lawful purpose consistent with the reason it was collected, or with another valid legal basis such as consent where required
take particular care with sensitive information and obtain specific approval and consent where required
not enter personal, sensitive, client-confidential or commercially sensitive information into a publicly accessible or unapproved generative AI tool
not enter passwords, private keys, full payment credentials, protected security information or other secrets into AI tools unless the specific secure use has been approved
review whether a provider may retain inputs, use them for model training, disclose them to other parties or process them outside Australia
use available privacy and security settings, access controls and deletion options
report any suspected unauthorised disclosure or data breach immediately.

OLC will not intentionally use client confidential information or personal information to train a general-purpose AI model for an unrelated purpose. Any proposed model training, fine-tuning or dataset creation involving such information requires a documented assessment, appropriate authority and compliance with applicable privacy, confidentiality and contractual obligations.

9. Fairness inclusion and accessibility

OLC will consider whether an AI system or output may reproduce stereotypes, exclude people, create inaccessible content or treat people unfairly. Review must reflect the audience and the potential impact, with additional care for vulnerable or marginalised people.

OLC must not use AI to unlawfully discriminate, conduct unjustified surveillance, infer sensitive characteristics without a lawful and necessary basis, or target or exclude people using protected attributes in a way that breaches applicable law or platform rules.

AI will not be the sole decision-maker for recruitment, employment, eligibility, pricing, credit, access to essential services, legal rights or another decision that has a legal or similarly significant effect on a person. Any AI assistance in such a context requires prior management approval, a documented impact assessment and meaningful human review.

10. Accuracy quality reliability and security

AI can produce confident but false, outdated, biased or unsafe output. OLC will set review and testing requirements that reflect the intended use and risk. Higher-risk uses must have documented acceptance criteria and, where practical, tests using representative scenarios before deployment.

Systems with access to websites, advertising accounts, customer data, source code, email, publishing tools or other external services must use the least access necessary. Actions that can publish, send, spend, delete, change permissions or alter production systems require an appropriate approval step, logging and a practical way to stop or reverse the action.

The system owner must monitor material uses for errors, unexpected behaviour, security issues and provider changes. OLC may suspend or retire a tool or use case if its performance, terms, security or risk is no longer acceptable.

11. Transparency and AI generated content

OLC will be transparent about AI use in a way that is proportionate to the degree of AI involvement, the audience and the potential impact. OLC does not need to label every minor AI-assisted edit where a person has reviewed the work and AI has not materially changed its meaning, subject to applicable law, contract, client policy and platform rules.

Clearer disclosure, labelling, watermarking or metadata should be used when:

a person is interacting directly with an AI chatbot or automated conversational system
AI created most of the content or materially changed its meaning
the content could influence a decision or affect a person’s rights, safety, finances, health or trust
synthetic or altered media could reasonably be mistaken for an authentic image, voice, video, event or statement
a client, contract, law, regulator, platform or professional standard requires disclosure.

OLC must not present synthetic media as authentic, impersonate a real person without appropriate permission, conceal material AI use where that would be misleading, or claim that content is wholly human-created when that claim is not accurate.

A client or other affected person may ask OLC for general information about material AI use in work supplied to them. OLC will provide a reasonable response while protecting confidential information, system security, intellectual property and the rights of other parties.

12. Intellectual property and client material

OLC will respect copyright, trade marks, moral rights, licences, confidential information and rights relating to a person’s name, image, voice and likeness when using AI.

OLC personnel must:

use client-supplied material only as reasonably necessary and permitted for the engagement
avoid uploading third-party or licensed material to an AI service where the licence or authority does not permit that use
review outputs for substantial copying, confusing similarity, unauthorised branding, false attribution or inappropriate imitation
obtain any permission needed to create or use a realistic representation of an identifiable person
check the provider’s terms concerning input rights, output rights and restrictions before relying on an output
retain records of AI involvement and source material where provenance or ownership may be important.

Ownership and licensing of client deliverables, OLC materials, digital products and third-party components remain governed by OLC’s applicable client terms, purchase terms, written agreements and third-party licences.

13. Restricted and prohibited uses

The following elevated-risk uses require prior management approval and documented controls:

materially influencing a decision about a person while retaining meaningful human review
processing personal, sensitive, confidential or security information in an approved system
publishing, sending, spending, deleting or making production changes automatically
connecting AI to a client account, dataset or system within the permissions granted for the engagement
creating realistic synthetic media of a real person with appropriate authority
assisting with substantial regulated content that an appropriately qualified person will review
political persuasion, high-impact profiling or surveillance within the agreed and lawful service scope.

AI must never be used to:

make a material decision about a person without meaningful human review or present AI output as regulated professional advice
process protected information in an unapproved system or access a client account, dataset or system without authority
break the law, breach a contract, infringe intellectual property or evade platform requirements
deceive, manipulate, harass, discriminate against or exploit a person, including through impersonation, fabricated reviews or fabricated results
create or distribute malicious code, facilitate unauthorised access, bypass security controls or expose credentials
train or improve an AI model with client or personal information for an unrelated purpose without appropriate authority
continue operating after a person becomes aware of a serious uncontrolled risk or incident.

14. Third party AI providers

OLC may rely on third-party AI providers and AI features embedded in other platforms. Popularity, convenience or a paid subscription does not by itself make a tool suitable for OLC or client information.

Before approving a material use, OLC will conduct due diligence proportionate to the risk. This may include reviewing the provider’s terms, privacy and security information, data retention, use of customer data for training, hosting locations, subprocessors, access controls, testing information, incident history, content safeguards, intellectual property terms, export or deletion options, and ability to disable or stop the service.

The system owner must monitor relevant changes to the provider, product and terms. Where a service is changed, withdrawn or no longer acceptable, OLC will stop or modify the use and take reasonable steps to protect or retrieve OLC and client information.

15. Incidents concerns and contestability

An AI incident includes suspected unauthorised disclosure, harmful or misleading output, material bias, a security weakness, unauthorised action, impersonation, intellectual property concern, loss of human control or a serious failure to follow this policy.

A person who becomes aware of an incident must stop or contain the affected use where safe to do so, preserve relevant records, and report it promptly to the system owner and OLC Management. Privacy or security incidents must also be handled under OLC’s applicable incident and data-breach procedures.

OLC will assess the impact, investigate the cause, correct or remove affected material where appropriate, notify relevant clients, individuals, providers or authorities when required, and update controls or training before use resumes.

A person who believes an OLC AI interaction or AI-assisted outcome has materially affected them may contact OLC. OLC will arrange a human review and provide a reasonable response, correction or escalation where appropriate.

16. Roles responsibilities and records

OLC is a small organisation, so one person may perform more than one governance role. Responsibilities must still be clear for every approved system and material use case.

Role	Who holds the role	Responsibilities
AI policy owner and approver	OLC Management	Approves this policy, approved tools and elevated-risk uses; sets risk tolerance; maintains oversight of the AI register, training, incidents and annual review.
Privacy and compliance contact	OLC Privacy Officer or designated management representative	Advises on privacy, confidentiality, transparency and incident obligations; supports assessments and complaints; coordinates escalation when needed.
AI system or use case owner	The person assigned to the relevant tool, integration, process or client use	Documents the purpose and risk; confirms approval, testing and controls; monitors use and provider changes; keeps records; responds to issues and retires the use when needed.
All AI users	OLC personnel who use AI	Use approved tools and purposes; protect information; review outputs; follow client and disclosure requirements; complete training; report concerns promptly.

Records should be proportionate to risk and may include the AI register, risk or privacy assessments, approvals, data sources, prompts or configuration where relevant, testing results, disclosure decisions, human approvals, provider reviews, incidents, corrections and review dates.

17. Training and compliance

People who use AI for OLC must understand this policy and receive training appropriate to their access and responsibilities. Training should cover approved tools, capabilities and limitations, privacy, confidentiality, security, intellectual property, accuracy, bias, disclosure, human review and incident reporting.

A breach of this policy may result in removal of access, additional training, corrective action, disciplinary or contractual consequences, and notification to a client, provider or authority where required. Questions and mistakes should be raised early so risks can be contained.

This policy should be read with the following OLC documents:

This AI Policy describes OLC’s approach to responsible AI use. It does not replace a specific client agreement, product licence, privacy notice or legal obligation. If requirements differ, OLC will apply the requirement that governs the relevant activity and seek advice where necessary.

19. Australian guidance

This policy has been adapted from the Australian Government AI policy guide and template supplied to OLC and is informed by Guidance for AI adoption, Australia’s AI Ethics Principles, Be clear about AI-generated content, OAIC guidance on commercially available AI products.

20. Policy review

OLC Management will review this policy at least annually. An earlier review may be triggered by a significant AI incident, a new or materially changed AI tool or use case, a change in provider terms, a material client concern, or a change to applicable law, regulation, government guidance or industry practice.

Substantive changes require approval by OLC Management. The current public version will display the month and year of its latest update.

21. Contact us

Questions, concerns or requests relating to this AI Policy or OLC’s use of AI can be directed to:

Tibballs & Co Pty Ltd
Trading as Online Lifestyle Co

Email: team@onlinelifestyleco.com
Phone: 0407870267
Website: www.onlinelifestyleco.com
ABN: 11682363293 | 31752673732

Victoria, Australia