Can AI turn an old policy into a practical checklist?
Turn a public policy into source-linked checks with AI. Keep missing roles and deadlines visible, quote vague timing, then check the table both ways.
PRACTICAL APPLICATIONS
The Question
You have the policy. Now you need the checks to follow it.
Can AI turn those paragraphs into a practical checklist, with a source section beside every action?
The Problem
Reading a policy and applying it are different tasks. An instruction might sit in one section, its exception in another, and the responsible role somewhere else. A summary tells you what the policy covers. A useful checklist shows what to check, who the policy names and when the instruction applies.
The Real facts behind this
OpenAI (ChatGPT), Microsoft (Copilot) and Anthropic (Claude) document ways to work with uploaded text and ask questions about it [1–3]. Microsoft's licensed work-data route differs from a manual upload [4]. That gives you a way to try extracting policy actions into a table. AI can miss an instruction or add one, so check the table against the source before using it. OAIC recommends testing and human oversight [5]
Practical use
Pick your policy. Use the OAIC's data breach response plan, from “How do we respond to a data breach?” to the end of step 2, or your own organisation's policy in an approved tool.
Keep the original beside you. You'll check every row against it.
Ask for actions, not a summary. Use columns for action, policy section, who does it, by when, conditions or exceptions, and anything unclear. Where the policy doesn't say, the table should say “not stated”, not guess.
Keep the wording honest. In the OAIC plan, the EL2 Director notifies the Chief Privacy Officer “within the same working day”: a named role and a deadline. The same plan says an assessment “must be conducted expeditiously”, which is not a deadline. The table should quote that wording, not turn it into a date.
Check both ways. Match every row to its section, then read each section against the table to find actions the AI missed.
Before anyone uses it: if it's your own policy, have the policy owner resolve unclear wording and approve the checklist. If it's the public example, treat the table as practice; your organisation's version will differ.
Test it and report back
Try it this week. Did it work? If not, why do you think? If it did, what did it solve? Tell us how it went on our LinkedIn post LinkedIn Post: which action, exception or missing detail needed a closer look? Prefer to keep it private? Send us an email at hello@25hours.ai.
Get the next practical exercise for your team every fortnight: subscribe.
Want to see what this could look like for your team? Book a 20-minute catch-up and tell us where you are with AI and where you're stuck. Start with tailored training in prompts and source checking.
Exercise block
Use an AI tool your organisation has approved, such as Microsoft 365 Copilot, ChatGPT or Claude.
• No policy handy? Use our public example: the OAIC's data breach response plan. It's a public document, so you can paste it into any tool, including free ones. Copy from “How do we respond to a data breach?” to the end of step 2 (about 600 words).
• Using your own organisation's policy? Only use a tool your organisation has approved for internal documents (usually a licensed workplace tool, not a free personal account), and follow your organisation's AI, privacy and information security policies. If you're not sure, check with your IT or privacy team first, or use the public example.
Whatever you use, check the output against the original before you rely on it. This exercise is for practice, not legal or compliance advice.
ChatGPT (free): “Turn the policy text below into a checklist table with these columns: action, policy section, who does it, by when, conditions or exceptions, anything unclear. Use only the text below. If the text doesn't say who or when, write ‘not stated’. Quote timing words exactly, such as ‘immediately’ or ‘expeditiously’; don't turn them into dates.” [paste the text]
Microsoft Copilot (free): Same prompt as above.
Claude (free): Same prompt as above.
Microsoft 365 Copilot (licensed): Same prompt as above. To use your own policy, type / and select the file from SharePoint or OneDrive instead of pasting.
ChatGPT / Claude paid plans: Same prompt as above. If your organisation allows it, you can upload your policy file instead of pasting.
Agent tools: An agent could pick up each new version of a policy, draft the checklist and send it to the policy owner to review before anyone uses it. If you'd like to see this set up for your team, book a catch-up.
What a good table shows (OAIC example)
• A staff member notifies their EL2 Director “immediately”.
• The Director gathers the facts for an initial assessment “within the first hour”.
• The EL2 Director notifies the Chief Privacy Officer “within the same working day”, ideally by phone first.
• The assessment “must be conducted expeditiously”, quoted as written rather than turned into a date, and concluded within 30 days.
Why it works
• The policy section column shows the reviewer exactly where to check each row.
• “Not stated” keeps gaps in the policy separate from guesses by the AI.
• Quoting timing words stops the AI inventing deadlines.
• Checking in both directions catches actions the AI missed.
If it doesn't work
• If the tool tries to open the link, or says it can't, paste the text instead.
• If it cuts off or drops details, paste a smaller section.
• If it adds a role, deadline or action, ask it to quote the source sentence for that row. If it can't, delete the row.
• With your own policy, take unclear wording to the policy owner. The table doesn't make an old policy current or confirm compliance.
F. Data-handling note
Before you try this: free and personal AI tools may use what you paste to improve their models, depending on your settings. Don't paste personal, health, student, resident or client information. Use a de-identified sample, or your organisation's licensed tool if it has one.
Sources
OpenAI — Uploading files and audio to ChatGPT; undated. help.openai.com
Microsoft — File upload in Microsoft Copilot; undated. support.microsoft.com
Anthropic — Upload files to Claude; 23/07/2026. support.claude.com
Microsoft — How Copilot Chat works with and without a Microsoft 365 Copilot licence; undated. support.microsoft.com
OAIC — Guidance on privacy and the use of commercially available AI products; updated 17/01/2025. oaic.gov.au
OAIC — Data breach response plan; updated 23/05/2025. oaic.gov.au
Disclosure: This blog was conceptualised and planned by the 25 hours AI team and then researched and drafted with AI assistance. Once the structure, content, and resources were reviewed, verified and tested, the team finalised and publishes the content. Images that were generated with AI were conceptualised and sketched by the team prior to AI generation.
Thumbnail texture image by: photo by Erika Löwe and background image by: Arisa Chattasa, vis Unsplash