If you’re wondering whether your staff are using ChatGPT, Copilot, or other AI tools for work without you knowing - they almost certainly are. A 2026 survey found 58% of Australian businesses now have staff using AI tools like ChatGPT and Microsoft Copilot at work. For most small businesses, that number didn’t come from a deliberate decision. It happened quietly, one convenient shortcut at a time.
The problem isn’t that your team is using AI. Most of what they’re doing with it is fine. The problem is that without any guidance, someone will eventually paste something they shouldn’t into a tool that wasn’t designed to keep it confidential - and you won’t know it happened until there’s a consequence.
An AI usage policy doesn’t need to be a legal document. For most small businesses, it’s a single page of practical rules that takes an afternoon to put together. Here’s what actually matters.
The risk isn’t the AI - it’s the data going into it
When a staff member pastes client information into ChatGPT to help write a report, uploads a contract to an AI summariser, or shares financial data to generate a spreadsheet formula - that data is leaving your systems. Depending on the tool and its configuration, it may be stored, used for model training, or accessible to the tool’s provider in ways you haven’t reviewed.
The Australian Cyber Security Centre (ACSC) published specific guidance in January 2026 on managing cybersecurity risks from AI for small businesses. Their core recommendation: establish a clear internal AI use policy that defines what data cannot be uploaded into AI platforms. That’s the starting point, not the end goal.
There’s also a compliance angle arriving soon. Australia’s Privacy Act is being updated with APP 1.7 obligations commencing December 2026, requiring businesses to disclose automated decision-making in their privacy policies. If your team is using AI in ways that affect how you handle customer data, you may already need to revisit your privacy policy before then.
What data needs to stay out of AI tools
The rule of thumb is straightforward: if the information isn’t yours to share publicly, it shouldn’t go into a free or unreviewed AI tool.
In practice, that means keeping these out:
- Client details - names, contact information, project scopes, anything identifying a specific customer
- Financial data - pricing, margins, invoices, payroll figures, revenue breakdowns
- Legal documents - contracts, NDAs, correspondence with lawyers, terms under negotiation
- Health information - especially important for allied health practitioners, NDIS providers, or anyone holding medical records
- Staff information - performance notes, salaries, disciplinary records, HR correspondence
- Internal strategy - unreleased plans, tender documents, competitive intelligence
The risk isn’t that ChatGPT will immediately publish your client list. The risk is subtler: AI providers’ terms of service and data handling practices change, enterprise plans have different privacy protections than free accounts, and a data incident involving a third-party AI tool could still constitute a notifiable breach under the Privacy Act.
What a small business AI policy actually needs to cover
You don’t need a lawyer to write this. You need five things documented clearly enough that a staff member knows what to do - and what not to do - without having to ask.
1. Which tools are approved List the specific AI tools your team is allowed to use for work purposes. ChatGPT (personal vs. Teams plan), Microsoft Copilot, Google Gemini, Canva AI, Grammarly - whatever your team actually uses. Anything not on the list requires sign-off before use.
2. What data categories are off-limits Use the list above as a starting point. Be specific enough that there’s no ambiguity. “No client information in personal AI accounts” is better than “no sensitive data” because sensitive is a judgement call.
3. When human review is required Any AI-generated output that goes to a client, into a legal document, or informs a financial decision needs a person to check it first. AI tools hallucinate - they produce confident-sounding wrong answers - and the consequences of that in a client-facing context can be serious and hard to walk back.
4. Who to ask before connecting a new AI tool Staff regularly encounter new AI tools and add them to their workflow. Some of those tools request access to your Google Workspace, your email, your CRM. That requires a deliberate decision, not a reflex “allow access” click. Nominate one person to make that call.
5. What the consequences are Not to be punitive - but people take rules more seriously when there’s a stated outcome for ignoring them. Even a line saying “unreviewed AI tools that access client data will be treated as a data breach incident” sets the right tone.
Three rules to put in place this week
If writing a full policy feels like too much right now, start with three rules you can communicate to your team in a five-minute conversation:
- No client data into personal AI accounts. ChatGPT free, Google Gemini personal - anything without a paid business subscription and a data processing agreement - client information stays out. No exceptions.
- AI-written content gets a human read before it leaves the building. Client emails, proposals, reports - if AI drafted it and it’s going out, someone checks it first.
- Ask before connecting any new AI tool to business systems. Especially anything that wants access to email, calendars, or your project management software.
These three rules won’t cover every edge case, but they’ll stop the most likely costly mistakes while you work on the fuller version.
The trust gap is real - but it’s straightforward to close
Around 65% of Australian SMEs that haven’t yet adopted AI cite trust - either distrust of AI decision-making or a preference to maintain human control - as the primary reason for holding off. That’s a legitimate position. But trust in AI tools mostly comes down to knowing what they do with your data and having clear rules about what you allow.
A simple AI policy doesn’t mean you’re endorsing every tool your staff might want to try. It means you’ve made a deliberate decision about where the limits are - and that’s more useful than hoping the question never comes up.
If you want help working out which AI tools are actually worth using in your business, or putting together a practical AI policy, get in touch - YourStuff helps Brisbane and Queensland small businesses get AI right without the enterprise overhead.
Photo by Dylan Gillis on Unsplash
