AI Jumped From #10 to #2 on Australia’s Business Risk List. Here’s What That Actually Means if You’re Small.

Eight spots in one year. AI went from a footnote on the Allianz Risk Barometer (sitting at #10 in 2025) all the way to #2 in 2026. That’s the biggest single-year climb in the report’s history.

Cyber security held the top spot, as it has for several years running. But the jump AI made? That’s the story. “AI is the big mover in the Allianz Risk Barometer 2026,” said Michael Bruch, Global Head of Risk Consulting at Allianz Commercial. When risk managers at global insurers start tracking a technology as a top-tier business risk, pay attention.

The problem is most of the coverage has been written for enterprise risk teams, not small businesses. The risks aren’t the same. Here’s what actually matters if you’re running a small business in Australia.

The three risks that apply to you

Data privacy

Enterprise AI risk coverage fixates on systemic model failures: a large language model producing unreliable outputs at scale, or AI systems making consequential automated decisions that no one can explain. Those are serious problems, but they mostly hit large institutions running proprietary AI infrastructure.

For small businesses, the risk is more immediate: what data are you feeding into AI tools? When you paste a client email into ChatGPT to draft a reply, or upload a contract to an AI document tool, that data has to go somewhere. Many AI tools collect user inputs for training by default, and you often have to opt out explicitly — check the settings, not the marketing page. If your clients’ personal information ends up in a training dataset, you may have a Privacy Act problem.

What to do: Check the data retention settings on every AI tool your team uses. Most have a toggle. Turn off training data collection for anything that handles client information.

IP ownership

Who owns content generated with AI assistance? Australian law still hasn’t given a clear answer. The Copyright Act requires human authorship. AI-generated content technically has no copyright owner. If a client paid you to produce something and you used AI to generate most of it, the ownership question gets murky fast.

This connects to the deeper liability question we explored in our piece on AI contract liability. The short version: if you’re relying on AI output in a professional capacity and something goes wrong, you’re likely the one holding the risk, not the AI vendor.

What to do: Put AI use in your client contracts. One sentence. Something like: “Work product may be produced with AI assistance and is reviewed and warranted by [your business name].” It won’t eliminate all risk, but it creates clarity.

Staff misuse

Enterprise risk teams worry about AI enabling fraud at scale, deepfakes targeting executives, or employees using AI to exfiltrate data. Those are real, but they’re problems at volume.

The small business version is simpler and more common: a staff member uses an AI tool you haven’t approved, for work you don’t know about, with data you didn’t mean to share. No malice. Just convenience. Someone finds a tool that makes their job easier and starts using it. That’s how customer data ends up outside systems you control.

This is part of why AI moving from a tool to infrastructure changes things. Once AI is embedded in daily workflows, you can’t manage it like a one-off tool. It needs a policy.

What to do: One-page AI use policy. Not a legal document. Just a list of approved tools and one rule: no client data into unapproved tools. It takes 30 minutes to write and it closes most of the exposure.

The small business advantage

The situation is actually better than the headline ranking suggests. Enterprise firms are spooked because they’ve adopted AI fast, at scale, without the governance frameworks to match. Many large organisations genuinely don’t know what data is flowing through which models. At their scale, that’s a real governance gap.

Small businesses that stay intentional about how they use AI (knowing which tools they’re using, what data they’re handling, and having basic policies in place) are in a better position than a multinational that deployed 200 AI tools in 18 months without a data map.

Public trust in AI companies remains low in Australia. But the answer isn’t avoidance. It’s informed use. The Allianz barometer reflects how quickly AI has become part of the risk picture. Small businesses that understand those risks now will have an advantage over those who wait for a problem to figure it out.

Sources

• Allianz Risk Barometer 2026: allianz.com | full PDF
• Michael Bruch quote via Allianz Commercial press release (January 2026)

More in this hub: Hot Takes →

: News Deep Dives →

📖 More deep dives: News Deep Dives

📊 Compare AI tools side by side | 💼 Free resources & AI prompt packs