Trust
Is AI safe to use in your business?
The most common reason Australian small businesses haven't adopted AI isn't cost. In the National AI Centre's most recent SME survey, around two thirds of non-adopters said they don't trust AI to make decisions, or want to keep people in control. That's a reasonable position. Here's how the risks actually break down, and how a careful build handles each one.
Rather just ask someone? Talk to usIn short
AI is as safe as the way it's built. The risks are real but specific: customer data sent to services you haven't checked, software acting on customers or money without a person approving, and confident mistakes nobody catches. Each has a plain fix: know where data goes, draw the line on what acts unattended, log everything, and review the output early.
This is a plain-English summary written by developers, not legal advice. Privacy obligations depend on your turnover, sector and the data you hold. For anything that turns on your specific obligations, talk to a lawyer or start with the OAIC's guidance.
- Human in the loop, in one sentence
- The software drafts, a person decides, for anything that leaves the business or moves money. Everything internal and reversible can run on its own. Where you draw that line is the most important decision in any AI build, and it should be yours, in writing, before anything is connected.
What actually matters
Know where the data goes
Every AI step sends text to a model somewhere. Ask which provider, whether the provider trains on your data (the business tiers of the major providers don't, by default), and where it's stored. For most small business work the sensible setup is a business account on a major provider with training off, and no customer data in tools nobody has checked.
Send less than you think you need
An automation that summarises an enquiry doesn't need the customer's full history. Strip what isn't needed before it goes to a model. Less data out means fewer questions to answer later, and it's simply good practice under the Australian Privacy Principles.
Treat the Privacy Act as the floor
If your business is covered, you already have obligations about collecting, using and securing personal information, and reforms are tightening them, including around automated decisions. AI doesn't create new data; it moves it. The same rules apply, so document what's collected, why, and who can see it.
Draw the line on what acts unattended
Internal summaries, drafts and record updates you can undo: fine to run automatically. Replies to customers, quotes, payments, anything with a legal or financial consequence: a person approves. That line is a design input, not a setting to fiddle with later.
Assume it will be confidently wrong sometimes
Models make fluent mistakes. Build for it: confidence thresholds that escalate rather than guess, a fixed set of approved answers for anything customer-facing, and a weekly read of what it did for the first month. Errors are cheap when caught early and expensive when nobody was looking.
Log everything, and be able to switch it off
Every action the software takes should be recorded: what came in, what it decided, what it did. And there should be one switch that stops it. If a vendor can't show you both, the system isn't ready for your customers.
Own it, so you can leave
Accounts in your name, workflows and code you can take elsewhere, no proprietary platform you can't export from. This is a safety property as much as a commercial one: the ability to walk away is what keeps everyone honest.
Questions to ask anyone selling you AI
Including us. Straight answers to all eight are the minimum.
- Which AI provider does this use, and does it train on our data?
- Where is our data stored, and for how long?
- What does the system do without a person approving it?
- What happens when it isn't sure?
- Can I see a log of every action it took?
- How do I switch it off?
- Who owns the accounts, the workflows and the code?
- What do we tell customers about it, and when?
When this isn't the answer
Some work shouldn't be automated yet: anything involving vulnerable people, legal or medical judgement, or decisions someone could be harmed by. If that's your business, use AI for the admin around the work, not the work. And if you can't get straight answers to the questions above from a vendor, the safe option is to wait.
Start with a 30-minute call
Tell us the task that eats the most time, or just that you're not sure where to begin. We'll tell you on the call whether it's worth automating, and what we'd do first.
Common questions
It goes to whichever provider the system uses, for the moment it's processed. On business accounts the major providers don't train on it by default and offer data handling terms. The questions to ask are which provider, which tier, and what's sent. Send only what the task needs.
If your business is covered by the Act, personal information you process with AI is covered the same way it would be in a spreadsheet. Reforms are adding transparency expectations around automated decisions. Treat it as existing obligations applied to a new tool, and get advice if you handle sensitive data.
It shouldn't be able to on its own for anything that matters, which is what the approval line is for. For the things it does handle, fixed approved answers and escalation when unsure keep mistakes small, and the log tells you exactly what happened.
They probably already do. A short written policy, business accounts with training off, and a rule about what must never be pasted in will cover most of the risk. Only around one in ten Australian SMEs has such a policy, so writing one puts you ahead.
No. What we build runs on accounts you own, and we don't retain customer data from your systems. We'll say the same thing in the agreement.
Also worth a look
- Where to Start With AI in a Small Business
- AI Agent vs Automation vs Chatbot: Which Do You Need?
- What AI Automation Costs in Australia (2026)
- Want the do-it-yourself guide to showing up in AI answers?
Last reviewed . Figures are indicative Australian ranges, not quotes.