AI Security and Privacy Checklist for Australian Small Businesses

Start with an AI use policy

The Australian Cyber Security Centre published guidance on artificial intelligence for small businesses on 14 January 2026. It focuses on cloud-based AI tools and identifies risks including data leaks and privacy breaches, unreliable or manipulated outputs and supply-chain vulnerabilities. Its recommended actions include an AI-use policy, vendor due diligence, verification and human oversight, and staff training.

A practical policy should list approved tools, permitted uses, prohibited information and who approves new AI applications. It should explain when outputs require review and how staff report a concern. Keep it short enough for people to follow.

Classify information before entering it

Create simple categories such as public, internal, confidential and personal or sensitive information. Decide which categories each approved tool may receive. Customer records, employee information, financial details, passwords and confidential contracts should not be pasted into a tool merely because it is convenient.

The OAIC’s guidance on commercially available AI says privacy obligations can apply to personal information entered into AI products and to outputs containing personal information. It also notes that inferred or incorrect information about an identifiable person can be personal information. Generated content is not exempt simply because AI produced it.

Check whether privacy obligations apply

The OAIC explains that most small businesses are not covered by the Privacy Act, but some are, including certain businesses with lower turnover. Exceptions include health service providers and businesses trading in personal information. Check your own position rather than assuming coverage or exemption.

Even where the Act does not apply, careful data handling remains good practice and supports customer trust. Businesses covered by privacy obligations should review collection, use, disclosure, notices, access and security in the context of the specific AI workflow.

Do vendor due diligence

Review the provider’s terms, privacy policy, retention settings, security documentation and administration controls. Ask whether inputs may be used to improve services, where data may be processed, how access is logged and how information can be deleted. Business plans and consumer accounts can have different settings.

Connectors and plugins add suppliers and permissions. Approve only the systems needed for the task and remove access that is no longer required. A product appearing in a marketplace or directory is not proof that it suits your data.

Keep human review proportionate

Require review where outputs affect customers, money, employment, legal obligations, safety or sensitive information. Reviewers should check facts against source records, not merely confirm that the writing sounds professional. For automated workflows, require approval before consequential actions.

Train staff to spot incorrect information, prompt manipulation, suspicious instructions in documents or emails and accidental disclosure. Record and investigate incidents. Review the checklist when tools, workflows or legal requirements change.

If an incident occurs, stop the affected workflow, preserve the minimum evidence needed for investigation and notify the person responsible for security and privacy. Check whether access must be revoked, customers informed or a formal notification assessed. Do not rely on the AI tool itself to decide your legal response. Document what changed before resuming use, and test the revised controls with the team.

What this means for Australian businesses

Australian small businesses should use ACSC security guidance alongside an entity-specific privacy assessment. This article is general information, not legal advice.

Customer trust depends on transparent, careful handling of information. Avoid feeding sensitive data into unapproved tools or allowing AI to make consequential decisions without review.

Practical next steps

1. Publish a short approved-tool and data-handling policy.
2. Classify information and prohibit sensitive data in unapproved tools.
3. Complete vendor checks covering retention, location, access and deletion.
4. Use least-privilege accounts and approval before consequential actions.
5. Train staff and create a simple AI incident reporting process.

Read MindFish’s security and support approach