Why you need an AI policy now.

Here's the uncomfortable truth for most Australian small businesses: your team is already using AI. Someone's pasting client emails into ChatGPT to tidy them up, someone else is running quotes past Copilot, and nobody's agreed any rules. That's not a reason to panic, and it's certainly not a reason to ban the lot. It's a reason to write a short, clear policy, and this course walks you through doing exactly that. Let's start with why now.

The rules, in plain English

Australia hasn't passed a single sweeping AI law, and the businesses waiting for one to land before they act are waiting for the wrong thing. What we have instead is a set of expectations you're already bound by, plus practical guidance written for organisations your size. Three sources are worth knowing:

• The National AI Centre's guidance. Australia's AI hub, sitting under the CSIRO and the federal government, publishes voluntary AI safety guidance built around a handful of guardrails: accountability, transparency, fairness, human oversight, and keeping records. It's free, it's local, and it's designed to be adopted by any business, not just the big end of town.
• The ASD and ACSC small-business advice. The Australian Signals Directorate, through the Australian Cyber Security Centre, has guidance on engaging with AI safely: the data you feed it, the accounts you use, and the basic cyber hygiene that keeps you out of trouble. If you've ever used the ACSC's small-business cyber guides, this is the same practical, no-nonsense source.
• Your existing obligations. The Privacy Act, your duty of confidentiality to clients, consumer law, and any industry rules already apply to what your business does. AI doesn't get a free pass on any of them. Paste a client's personal details into the wrong tool and you've made a privacy decision, whether you meant to or not.

The deadline that should be on your radar

Here's the one with a date on it. Recent reforms to the Privacy Act introduce a transparency obligation for automated decision-making, and it commences in December 2026. In plain terms: if you use automated processing, and that includes AI, to make or substantially help make a decision that significantly affects someone, you'll need to say so in your privacy policy. Think of a system that screens job applicants, scores a customer for a service, or assesses an application.

It is not a ban and it is not red tape for its own sake. It's a disclosure rule, and the work to meet it is mostly knowing where AI sits in your decisions and writing a couple of honest lines about it. The businesses that map that out now, well ahead of December 2026, will find the deadline a non-event. The ones that ignore it will be scrambling. We give disclosure its own lesson later, so for now just file the date.

Why a ban backfires, and a policy wins

The instinct, when the rules feel fuzzy, is to forbid AI entirely. It feels safe. It isn't. A ban does one reliable thing: it pushes AI use into the shadows, where your team does it anyway on personal accounts, with no settings checked and nobody watching. You get all of the risk and none of the oversight. That's the worst of both worlds.

A short policy flips it. When people know which tools are approved, what's fine to put in, and what never goes near a public chatbot, they can use AI openly and well. You get the productivity, your clients get their confidentiality, and you've got a record that you took reasonable care, which is exactly what the National AI Centre's guidance is pointing at. A page or two of clear rules beats a ban every single time, and it beats the current state of "no rules at all" by even more.

What you'll have by the end

This is a practical course, not a lecture. Over the next four lessons you'll work out what's safe to put into AI and what isn't, choose and properly configure a short list of approved tools, set the human-in-the-loop and disclosure rules that keep you onside, and then write the whole thing up as a one-page policy with a staff one-pager people will actually read. The fill-in playbook does most of the heavy lifting, and rolling the result out safely across a team is the sort of thing our AI consulting helps with. By the end you'll have a policy you could adopt on Monday, and the December 2026 change will be one you've already handled.