Australian and New Zealand businesses are adopting autonomous AI tools faster than they’re governing them. That’s not a prediction. It’s the finding from KnowBe4, a security awareness firm tracking how organisations actually use and manage technology.

The timing is bad. Cyber insurance premiums are climbing. A March 2026 Trend Micro survey found that while 64% of Australian organisations now have some kind of AI policy, more than 40% still flag unclear regulation and a lack of internal governance as their biggest barriers. Written policy or not, most businesses don’t have a working system for what happens when AI goes sideways.

For small businesses, the risk sits even closer to the surface. You’ve probably got AI tools running right now: ChatGPT drafting your marketing copy, Copilot autocompleting your emails, maybe an AI booking system handling customer appointments or a chatbot taking enquiries after hours. Each one is making decisions on your behalf. When did you last think about what happens when one of those decisions is wrong?

This isn’t abstract risk. It shows up as a privacy complaint, a legal dispute over AI-generated content, a customer relationship damaged by a chatbot response you never approved. The gap between “we use AI” and “we govern our AI” is where the liability lives.

Here is a five-point checklist you can work through this week. None of it requires a lawyer or a compliance team.

1. List every AI tool your business currently uses

Include the tools your staff brought in themselves, not just the ones you paid for. You cannot govern what you haven’t counted. If you’re not sure where to start, ask your team directly. Chances are they’re using tools you don’t know about. We’ve written about what your staff are doing with AI right now and why that matters before it becomes a problem.

2. Write down what data each tool touches

Which tools connect to your customer records? Which ones handle financial data? Does your AI booking system have access to client contact details? If a vendor has a data breach, does your customer data go with it? The data risk hiding in your team’s AI habit is often the one owners discover last.

3. Set a one-sentence rule for each high-risk use

Not a formal policy document. Just a rule. “We don’t paste client data into ChatGPT.” “All AI-generated content gets reviewed before it goes out.” “Our chatbot doesn’t make price commitments.” These rules take ten minutes to write and give your team something concrete to act on. A full written policy is better, but a working rule beats nothing.

4. Know your legal exposure

AI-generated content can raise copyright questions. Automated advice, even informal advice from a chatbot, can create liability. If your business produces content with AI or communicates with clients through it, you need at least a basic sense of where the line sits. The Australian reality around AI content and legal risk is worth understanding before you find out the hard way.

5. Build a simple off switch

What do you do if an AI tool starts behaving badly, or the vendor goes down? Most small businesses have no answer. They’ve built workflows that depend on tools they couldn’t quickly replace or shut off. That’s a dependency problem worth fixing now. Read more about why AI dependency is a real risk for Australian businesses.

The cost of skipping governance isn’t theoretical. It’s the insurance claim denied because you couldn’t demonstrate controls. It’s the privacy breach notification you have to send customers. It’s the reputational damage from a chatbot that said something you’d never say yourself.

The Trend Micro data puts it plainly: almost two in three Australian organisations have an AI policy on paper, but most still lack the internal governance to back it up. If that’s true of larger organisations with compliance teams, it almost certainly applies to small businesses operating without them.

The checklist above won’t make you fully compliant with whatever regulations come next. But it gives you a starting point, and something to point to if things go wrong.

Sources:

Australia and New Zealand AI adoption outpaces governance, Insurance Business Australia, reporting on KnowBe4 research
Trend Micro, March 2026 survey of Australian organisations on AI policy and governance barriers

: News Deep Dives →

📖 More deep dives: News Deep Dives

📊 Compare AI tools side by side | 💼 Free resources & AI prompt packs

📬 The SmallBizAI Brief

One practical AI tip for Australian small business. Every Tuesday. Free.

Join business owners getting smarter about AI every week.

Sources