AI governance and responsible use

Why it matters

AI amplifies whatever it is pointed at, including mistakes. A staff member pasting a client list into a free chat tool, an assistant quoting a price that no longer exists, an automated screening tool quietly disadvantaging older applicants, a chatbot posing as a person: each is a small decision with an outsized consequence, and each is prevented by rules that take an afternoon to write. Good governance also makes the business more willing to use AI, because people know where the lines are. The alternative is either a free-for-all or a nervous ban, and both cost more than a page of sensible rules.

The Australian context in plain terms

Australia does not yet have a dedicated AI law. Instead, existing laws apply to how AI is used. The Privacy Act 1988 and its Australian Privacy Principles govern how personal information is collected, used, disclosed, secured and sent overseas; many small businesses have historically been exempt below a turnover threshold, but the exemption has been under review and sector rules such as those for health providers apply regardless, so check the current position with the OAIC. The Notifiable Data Breaches scheme requires eligible breaches to be reported. Australian Consumer Law prohibits misleading or deceptive conduct, which covers AI-generated claims and undisclosed bots. Anti-discrimination and Fair Work obligations apply to any AI used in hiring, rostering or managing people.

Alongside the law, the federal government has published Australia’s AI Ethics Principles and a voluntary AI safety standard offering practical guardrails for organisations deploying AI. Neither is mandatory for a small business, but they describe what reasonable, careful use looks like, and aligning with them is a sensible way to show you took care if anything is ever questioned. Rules in this area are moving; part of governance is checking for changes once or twice a year.

• Privacy Act and APPs: collection, use, disclosure, security, overseas transfer of personal information.
• Notifiable Data Breaches scheme: report eligible breaches to the OAIC and affected people.
• Australian Consumer Law: no misleading claims, including AI-written ones and disguised bots.
• Anti-discrimination and Fair Work: AI in hiring and people management must not produce unlawful outcomes.
• Voluntary frameworks: Australia’s AI Ethics Principles and the Voluntary AI Safety Standard describe good practice.

The one-page policy

A small-business AI policy answers six questions. Who owns AI in the business and approves new tools? Which tools are approved, on which plans? What data may go into them, and what never may? Which decisions always need a person? Where do we disclose AI use to customers and staff? And how do we report and fix mistakes? Write the answers plainly, make the document easy to find, and walk every staff member through it, including new starters.

The data rule is the one most worth getting specific about. A simple traffic-light scheme works: green for public and generic information, amber for internal business information that may go into approved business-plan tools, red for personal, health, financial and legally privileged information that goes only into tools explicitly approved for it, or nowhere. Staff cannot comply with a rule they cannot remember; three colours they can.

Human oversight and the decisions that stay human

The principle is simple: AI may inform or draft any decision, but a person is accountable for decisions that affect a person’s money, job, health, legal position or access to your services. In practice that means a named human approves customer refunds and disputes, hiring and performance outcomes, pricing changes, anything sent to a regulator, and any communication on a sensitive matter. For routine, low-stakes outputs, oversight can be sampling rather than checking every item, but it should never be zero for anything customer-facing.

Be especially careful with AI in people decisions. Screening tools, performance analytics and rostering optimisers can reproduce historical bias and produce outcomes that breach anti-discrimination law even though nobody intended it. If you use AI in hiring or managing staff, understand what it is doing, test it for uneven outcomes, tell candidates and staff, and keep a human making the final call.

Make it a habit, not a document

Governance fails when it is written once and filed. Keep it alive with a short cycle: the register is updated whenever a tool is added or removed, incidents are logged and reviewed as they happen, and once a quarter the owner spends an hour reviewing the register, the incident log, any changes to tool terms, and any changes in law or guidance. Twice a year, refresh the staff briefing.

Treat mistakes as information. An AI incident that is reported quickly, fixed with the affected customer and used to tighten a rule is a sign of a healthy system. One that is hidden because staff fear blame is how a small error becomes a notifiable breach. For businesses with several AI systems in production, this review cycle naturally grows into formal governance tooling, which is where specialist support such as SMBH Consulting’s AI governance service fits; for most small businesses, a disciplined owner and a quarterly hour are enough.

How to set up AI governance in a fortnight

1. Name an owner One person approves tools, keeps the register and runs the review.
2. Build the register Every AI tool in use, its plan, what it does, what data it sees, who uses it.
3. Classify data in three colours Green, amber, red, with examples staff will recognise.
4. List the human-only decisions Money, jobs, health, legal position, access to services.
5. Write the one-page policy Owner, approved tools, data rules, human decisions, disclosure, incident reporting.
6. Update your privacy policy and disclosures Reflect AI use in customer-facing notices and recruitment materials.
7. Brief the team and book the quarterly review Thirty minutes now, one hour a quarter.

Real-world example

A Canberra allied health clinic writes its first AI policy

Lake View Allied Health has eight practitioners and three reception staff. The practice manager, Jonah, discovers that two practitioners have been using a free consumer chat tool to help draft clinical letters, pasting in de-identified but detailed case notes, and that reception has trialled an AI phone-answering service without telling anyone. Nothing has gone wrong yet, but health information is among the most sensitive under the Privacy Act and the clinic has obligations regardless of its size.

Jonah becomes the AI owner. The register reveals five tools in use. The policy classifies all patient information as red: it may only go into tools the clinic has approved for health data, under a contract, with Australian residency, and the consumer chat tool is replaced with a business plan that meets those conditions for drafting support, with practitioners still signing every letter. The phone service is kept but configured to introduce itself as automated, to never collect health details, and to hand over to reception for anything beyond bookings. The privacy policy is updated to describe AI use, staff are briefed, and the first quarterly review three months later finds one incident, a letter drafted with a wrong medication name caught by the practitioner, which leads to a rule that drafting tools are never given medication details.

Common mistakes

• Banning AI outright Staff use it anyway, invisibly, with no rules. A short policy with approved tools is safer than prohibition.
• Writing a policy and never reviewing it Tools, terms and laws change every few months. Book the quarterly hour.
• Vague data rules "Use good judgement" is not a rule. Three colours with examples is.
• Letting AI make people decisions Hiring, performance and rostering tools can discriminate without anyone intending it. Keep a human accountable and test for uneven outcomes.
• Hiding incidents Unreported mistakes become breaches. Make reporting safe and fast.

KPIs to track

• Tools on the register versus tools in use Periodically check what staff actually use against the register. The gap should be zero.
• Staff briefed in the last six months Share of staff, including new starters, who have been through the policy. Target all of them.
• Incidents reported and closed A healthy business reports some and closes them quickly; zero reports usually means they are not being surfaced.
• Red-data incidents Instances of sensitive data in an unapproved tool. Target zero; treat each as a near-miss to learn from.
• Quarterly reviews held Four a year, documented. The simplest test of whether governance is alive.

Frequently asked questions

Is there an AI law in Australia I must comply with?

Not a dedicated one at present, but existing laws apply fully: the Privacy Act, Australian Consumer Law, anti-discrimination law and Fair Work obligations among them. The government has published voluntary AI ethics principles and a safety standard as guidance, and regulation is evolving, so check annually.

Does the Privacy Act apply to my small business?

Many small businesses have been exempt below a turnover threshold, but health service providers and some other categories are covered regardless, and the exemption has been under review. Check the current position with the OAIC, and in any case customers expect you to handle their information carefully.

Do I need to tell customers I use AI?

Where AI interacts with them directly, such as a chat assistant, yes: disguising it risks misleading conduct and erodes trust. Where it helps staff behind the scenes, a general statement in your privacy policy is good practice.

How much time does governance take?

An afternoon to set up, thirty minutes to brief staff, and about an hour a quarter to review. It is one of the highest-return hours in the business.

Key takeaways

• Governance for a small business is a named owner, a register, data rules, human-only decisions, disclosure and a review habit.
• Existing Australian law applies fully to AI use: privacy, consumer law, anti-discrimination and Fair Work.
• Classify data in three colours with examples; vague rules are not followed.
• A person stays accountable for any decision affecting someone’s money, job, health or legal position.
• Review quarterly and treat reported mistakes as the system working, not failing.