SMB1001:2026 and AI policies: what the new control asks for
BuildAIPolicy Research · Published 31 October 2026 · 2 min read
SMB1001 is a cyber security certification standard for small and medium businesses, developed in Australia. Its 2026 edition added something new: a written policy on how the business uses AI. Here's what has been reported about the control, and a practical way to prepare the policy.
What SMB1001 is
SMB1001 is published by Dynamic Standards International (DSI). Businesses are certified at one of five tiers, from Bronze to Diamond, with more controls at each tier, and certification is renewed every year. According to IT provider DJC, the 2026 edition was released on 1 September 2025 and became certifiable in January 2026, and the standard becomes free to read from 1 January 2027.
The AI policy control
When the 2026 edition was announced in October 2025, DSI said it adds a control requiring a formal policy for the acceptable and secure use of artificial intelligence, to address the risks of data leakage, loss of intellectual property and privacy breaches (as reported by techpartner.news).
IT providers that certify clients report that the control applies from the Gold tier upward, and not at Bronze or Silver. Epic IT describes the policy as covering seven areas:
- acceptable use;
- data governance;
- risk management;
- security measures;
- training and awareness;
- compliance with the laws that apply to you;
- regular review.
We haven't seen the standard's own text, which DSI sells until it becomes free to read. Check the exact wording with DSI or your certifying body before you rely on any summary, including this one.
How to prepare the policy
- List the AI tools your team uses, including AI built into software you already pay for and any personal accounts used for work.
- For each tool, decide what it may be used for and what information must never go into it.
- Make someone responsible for each tool, and for the policy as a whole.
- Write down how staff should check AI output before relying on it, and how to report a mistake or a data leak.
- Train staff on the policy, suited to their role, and keep a simple record of who has been trained.
- Set a date to review the policy, and review it sooner when you add a tool or something goes wrong.
Our free AI policy generator gives you a short starting policy in a few minutes. The AI Policy & Risk Pack adds a risk register, a tool inventory, a staff acknowledgement form and a rollout plan, written from how your business uses AI; you can see a sample. Neither is a substitute for your certifying body's assessment.
For IT providers
If you help clients reach Gold or above, a written AI policy is now one of the documents each client needs. Our Partner plan, for IT providers and consultants who look after several clients, is on the waitlist.
Training records matter here too; our guide to AI training for staff covers what to include and how to record it.
Related
Free checklist (PDF)
AI tools audit checklist
Find out which AI tools your team uses, how, and with what information. The first step in any AI policy.
- Where to look for AI tools, including ones built into software you already use
- What to record for each tool, from the data that goes in to who is responsible
- What to decide once you have the list
Free tools, no sign-up
- Free AI policy generatorA short AI use policy in a few minutes
- Australia: automated decisions checkerDoes the 10 December 2026 rule apply to you?
- US: Colorado and California checkerAutomated decision rules from 1 January 2027
- EU AI Act checkerWhich transparency duties apply to you
- AI regulations trackerAI rules by region, with email alerts
- Free checklistsAI tools audit and 10 December readiness, as PDFs
Sources
- techpartner.news: SMB1001 2026 update focuses on email-based attacks, threat detection (October 2025)
- DJC: SMB1001:2026, what changed and what it means
- Epic IT: SMB1001 AI policy requirement
This article is general information, last checked against these sources on 31 October 2026. It isn't legal advice. For advice on your situation, speak to a qualified adviser.