Say your office manager pastes a customer complaint into a free chatbot to soften the reply. A sales lead asks Copilot to summarise a tender folder, and your bookkeeper uploads a supplier spreadsheet to spot anything odd. Nobody did anything wrong on purpose, but nobody set the rules either. That gap is what AI governance closes. This guide covers what it means for an SMB, what is law versus guidance as at November 2026, the building blocks, and a plan for this month.
AI governance is the set of rules, roles and checks around how your business uses AI. It decides which tools staff may use, what information goes into them, who checks the output and who answers for mistakes. For most small and medium businesses, that means a named owner, a short policy, a tool register and clear data rules.
What AI governance means for a small business
For a 20-person business, governance is not committees and binders. It is a handful of written decisions that let people use AI tools with confidence.
The National Artificial Intelligence Centre describes AI governance at two levels. Some practices apply to the whole organisation, such as having an AI policy. Others apply to each use of AI, because the same tool carries different risks depending on the job. Its own example: using ChatGPT to draft marketing emails is different from using it to assess job applications.
Good AI governance also brings "shadow AI" into the open. These are tools staff adopt on their own, such as a free chatbot on a personal account. The aim is not a ban. It is to know what is in use, then steer people towards approved, properly configured tools.
Law versus guidance in Australia (as at November 2026)
AI governance in Australia rests on existing laws such as the Privacy Act. As the National AI Centre puts it, the laws that already govern your business also apply to AI. Government AI guidance sits alongside them as voluntary good practice.
This guide is general information, not legal advice. Check your own obligations with a qualified adviser or the regulator.
The Privacy Act already applies to AI
The Office of the Australian Information Commissioner (OAIC) states that the Privacy Act 1988 and the Australian Privacy Principles (APPs) apply to all uses of AI involving personal information. That covers what staff type or upload, and any output containing personal information. If an AI tool generates or infers information about an identifiable person, that counts as collecting it, even when it's wrong.
The OAIC's guidance on commercially available AI products explains how the APPs play out. APP 6 limits using or disclosing personal information to the purpose you collected it for, unless an exception applies. APP 10 requires reasonable steps to keep it accurate, and APP 11 requires reasonable steps to protect it.
Not every business is covered. According to the OAIC, most small businesses with an annual turnover of $3 million or less are exempt. Some are covered regardless, including health service providers, businesses that trade in personal information and Commonwealth contractors.
New privacy policy rules for automated decisions
On 10 December 2026, a change made by the Privacy and Other Legislation Amendment Act 2024 starts. Businesses covered by the Privacy Act must then say in their privacy policy when a computer program makes, or substantially and directly helps make, decisions using personal information. This applies to decisions that could significantly affect a person's rights or interests.
The OAIC's September 2026 fact sheet says a computer program includes generative AI and chatbots. A decision can be in scope even when a human reviews the output. Its examples include an AI tool that ranks job applicants and software that sets prices from a customer's address. If you're covered and use AI near decisions like these, review your privacy policy before 10 December. When unsure, the OAIC advises a cautious approach: include the information.
The Guidance for AI Adoption is voluntary
The government's current guidance for adopting AI is the Guidance for AI Adoption, published by the National AI Centre in October 2025. It is the first update of the Voluntary AI Safety Standard released in September 2024. It condenses that standard's 10 guardrails into six essential practices:
- Decide who is accountable.
- Understand impacts and plan accordingly.
- Measure and manage risks.
- Share essential information.
- Test and monitor.
- Maintain human control.
Foundations suits organisations starting out or using AI in low-risk ways. The implementation guidance covers more complex or higher-risk use and lists other laws that may apply, including the Australian Consumer Law, anti-discrimination law, work health and safety law and directors' duties. Free templates for an AI policy, an AI register and AI screening questions sit alongside it.
What about new AI law? On 15 July 2026, the government announced Australian Standards for AI. As announced, they focus on large data centres and AI training, with legislation expected early in 2027. They are not law as at November 2026.
On the cyber side, ASD's Essentials series, which evolved the Essential Eight in October 2026, includes an executive AI accountability principle. It targets larger organisations, though SMBs can use it where relevant.
What not to put into public AI tools
This is where AI governance does most of its everyday work. As a matter of best practice, the OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. ASD's Australian Cyber Security Centre (ACSC) gives similar advice. It notes that some AI providers may use customer-submitted data to train their models, depending on settings or subscription type.
A three-tier rule is easy for staff to remember:
- Never in public AI tools: personal information about customers or staff, health information, tax file numbers, bank or card details, passwords, and anything a client gave you in confidence.
- Only in tools the business has approved, signed in with a work account: internal documents, pricing, contracts and client work, within the limits your policy sets.
- Low risk in most tools: public information, and generic drafting with names and identifying details removed.
The ACSC's guidance on AI for small business also suggests removing or changing personal details before using an AI tool, so nothing links back to a person.
The building blocks of an AI governance framework
An AI governance framework for a smaller business does not need to be elaborate. Here is what each building block can look like in a 20-person business.
| Building block | What it looks like in a 20-person business |
|---|---|
| Owner | A director or operations manager who approves new tools |
| AI tool register | A spreadsheet of each tool, its owner, uses, data and account type |
| Acceptable-use policy | Two pages: approved tools, banned uses, data rules, review and reporting |
| Data rules | The three-tier list above, pinned where staff see it |
| Human review | A named person checks output before it reaches a client or affects someone |
| Vendor checks | Training use, data location, security and incident notice checked before approval |
| Permissions check | SharePoint, Teams and OneDrive sharing cleaned up before Copilot |
| Training | A short session at induction, refreshed when tools or rules change |
| Incident handling | A no-blame rule to report slips at once, plus steps to contain and assess |
| Review cadence | A quarterly register check and a yearly policy review |
1. Start with an owner and a register
The guidance's first step is to assign a senior leader as the overall AI governance owner. Next comes an AI register that records every AI system, including AI built into software you already use, such as HR or customer service tools. The National AI Centre notes that a register also helps reduce shadow AI use.
To fill it in, ask each team what they use, including free tools. Keep the question blame-free, or the answers will be incomplete. The register is the base of your AI governance, because you can't set rules for tools you don't know about.
2. Write an AI governance policy people will read
Before publishing, the National AI Centre suggests checking that your policy clearly covers:
- what AI can and can't be used for
- who approves higher-risk uses
- what data staff can put into tools
- when staff need to oversee AI use
- how to report issues or misuse
- when the policy will be reviewed.
A two-page AI governance policy that people read beats twenty pages nobody opens.
3. Keep a person accountable for the output
AI tools can produce confident, wrong answers. The ACSC cites a 2025 case where a lawyer submitted AI-generated false legal cases to a court without checking them. Good AI governance makes one rule clear: whoever sends, signs or acts on AI output owns it. For anything that affects a client, money or a decision about a person, a qualified human checks it first.
4. Check vendors before you approve a tool
The OAIC and the ACSC both recommend due diligence first. Ask:
- Will the provider use your inputs to train its models, and can you turn that off?
- Where is data stored and processed, and does it leave Australia?
- Who owns the data, and who else can access it?
- How will the provider tell you about a security incident?
The OAIC stresses that due diligence isn't "set and forget", so recheck when terms change.
5. Fix permissions before you switch on Copilot
Microsoft states that Copilot only surfaces organisational data that each user already has at least view access to. That protects you only if permissions are right. If a payroll folder is shared with the whole company, Copilot can find and summarise it for anyone who asks.
Microsoft's secure and govern blueprint for Copilot starts with fixing oversharing, then sets guardrails. SharePoint Advanced Management, included with Copilot licences, has reports that find overshared sites, access reviews for site owners and a setting that keeps high-risk sites out of Copilot. Ask your Microsoft 365 support provider to run this check first, so everyday Copilot tasks start on a clean footing.
6. Train staff and plan for slips
The ACSC recommends training staff on secure and responsible AI use. Cover your data rules, how to check output and AI-enabled scams. AI can make phishing emails, fake invoices and cloned voices more convincing, so staff should confirm important requests through a trusted channel. This builds on basic cyber security habits.
Slips will still happen. If someone pastes personal information into a public tool, they should report it at once. Record what was shared, where and when, then delete the conversation and check the tool's data settings.
The ACSC describes a 2025 case where a contractor uploaded personal information, including health records, into an AI system, which is considered a notifiable data breach. If you're covered by the Privacy Act, assess whether a slip is an eligible data breach within 30 days at most, as the OAIC expects. Add AI slips to your cybersecurity incident response plan and know the steps after a data breach.
7. Review your AI governance on a schedule
AI tools and their terms change quickly. Check the register quarterly and review the policy yearly, and after any incident, new tool or legal change.
Start this month: a simple AI governance plan
You can set the basics in four weeks without a big project.
- Week 1: Name the owner. Ask every team which AI tools they use, including free ones, and record them in the register.
- Week 2: Choose approved tools. Check each one's training settings, data location and admin controls, and move staff to business accounts.
- Week 3: Write a two-page policy from the government template, publish the three-tier data rules and brief all staff.
- Week 4: If Copilot is in use or planned, run a permissions check. If you're covered by the Privacy Act, check whether any AI use touches decisions about people and update your privacy policy before 10 December 2026. Then book the first quarterly review.
Conclusion
AI governance doesn't have to slow your team down. For most Australian SMBs, it comes down to four habits. Know which tools are in use, keep personal and confidential information out of public ones, make a person accountable for output and fix permissions before Copilot goes live. The Privacy Act already applies, the Guidance for AI Adoption offers a free voluntary framework, and the new automated decision rules start on 10 December 2026.
If you'd like help writing an AI usage policy or planning a Copilot rollout, Computer Support Professionals (CSPRO) covers both through its AI services.
