The rules that matter when you use AI in a small business

Is there a law about AI now, and are you breaking it? Here’s what the regulators have actually published, with dates, and which bits are law and which are only guidance. Then a one-page set of rules you can write for your own business this afternoon.

Is there an AI law for small business in Australia?

No, not one that names AI and covers every small business. What there is: guidance for two groups on duties they already had, advice from the government for every small business, two changes that don’t mention AI but reach you when you use it, and one thing that didn’t change, though people say it did.

This is a summary of what has been published. It isn’t legal advice on your situation; for that, talk to a lawyer.

What didn’t change: the Privacy Act’s small business exemption

The Privacy Act 1988 still exempts a business under a set annual turnover, with some exceptions; check where you stand on the privacy regulator’s small business page.1 That’s how section 6D reads in the current version of the Act, compiled on 4 June 2026, and still the latest on 29 September 2026.

Some businesses are covered whatever their turnover, so don’t read it as “small enough, so the Act doesn’t apply to me”. The Office of the Australian Information Commissioner (OAIC), the national privacy regulator, lists who is covered regardless on its small business page.2 Check which side you’re on there.

You may also have seen a claim that the exemption ends on a set date this year. It isn’t in the Act. If the law changes, it will be in a new version of the Act, and you’ll be able to read the section yourself.

Is my profession one of the two with new guidance?

Only if you’re a registered tax or BAS agent, or you advertise financial products or credit. BAS is the Business Activity Statement, the form that reports GST (the goods and services tax). Both got guidance this year on duties they already had, not a new law.

Tax and BAS agents

The Tax Practitioners Board (TPB), which registers tax agents and BAS agents, issued guidance TPB(GS) 55/2026 on 22 July 2026.3 The guidance says registered practitioners “must obtain permission from each client prior to divulging client information to a third party (which can include entering client information into AI models and tools, depending on how these tools are configured and used)“.3

It binds registered tax and BAS agents, not every bookkeeper and not every small business. If that’s you, read the guidance itself; this post isn’t legal advice.

Anyone advertising financial products or credit

The Australian Securities and Investments Commission (ASIC), which regulates financial services, issued a new version of its advertising guide, Regulatory Guide 234, on 9 June 2026.4 The new version says it applies “regardless of any specific technologies that may be used, including artificial intelligence (AI)”. ASIC’s note says the laws “apply in the same way to AI-generated advertising content as human-generated content”.

ASIC adds that “the potential for hallucinated or biased content by AI tools may increase the risk of misleading or deceptive advertising”.4 Hallucinated means made up by the AI and stated as fact. So if an AI assistant writes your ad, the ad is still yours.

What does the government tell every small business to do?

Take personal details out before they go into an AI tool, train your staff, and read the tool’s settings. That’s advice from the Australian Signals Directorate, the government’s cyber security agency, published on 14 January 2026: “remove, anonymise or change personal details when using an AI application”, and read the vendor’s settings, terms and privacy policy.5 Advice, not law.

The OAIC’s guidance is older. Since 21 October 2024, updated 17 January 2025, it has recommended that “organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools”, meaning AI tools anyone can sign up to online.6

Both hold whichever AI assistant you use: ChatGPT, Claude, Copilot or Gemini. Each sells more than one plan, with different settings, so check yours.

Which changes don’t mention AI but still reach you?

Two: texts sent under your business name, and subscriptions.

Texts sent under your business name

From 1 July 2026, a text sent with a sender ID that isn’t on the register run by the Australian Communications and Media Authority (ACMA), the regulator for phones, internet and spam, has that name replaced with the word “Unverified”.7 A sender ID is the business name that shows at the top of a text instead of a phone number. Those texts are grouped together in one thread on the phone, and ACMA warns “People will likely treat unverified messages as scams”.7

ACMA says businesses “must register” their sender IDs. It publishes no fee. This matters if a tool sends texts for you, AI or not: the text still goes out under your name.

Subscriptions, from 1 July 2027

The Competition and Consumer Amendment (Unfair Trading Practices) Act 2026 became law on 6 July 2026 and starts on 1 July 2027.8 It puts duties on businesses that sell subscriptions, and protects the people who buy them. A seller will have to set out its terms and give subscribers an “exit method” that is “easy to find” and “straightforward”, online if they signed up online.

Those protections cover small business subscribers below a size the Act sets, not only consumers. They apply to contracts entered into, renewed, continued or varied from 1 July 2027.8 The AI tools you pay for each month are subscriptions too, and if you sell subscriptions yourself, it’s worth reading the Act with your lawyer before then.

Did anything change for reviews written by AI?

No. The Australian Competition and Consumer Commission (ACCC), the national consumer watchdog, hasn’t updated its guide on online reviews for AI; the guide dates from 3 December 2013.9 Its one statement linking the two, in a media release of 17 December 2025, warns that “AI may also be used to generate and disseminate large volumes of fake reviews”.9

As I read it, a fake review is a fake review whoever or whatever wrote it, and the old ban on them still stands.

What I looked for and didn’t find

Three things, in our research up to late September 2026: anything from Fair Work on AI at work, guidance from the Australian Taxation Office (ATO) on AI, and a NSW rule on AI for small business. Not finding them isn’t proof they don’t exist. Our research couldn’t open the ATO’s site in August 2026, for one, so treat that as “not found”, not “doesn’t exist”.

Write your own rules down: a one-page method

No law makes you do this. It’s still worth an hour, because it turns the advice above into something your staff can follow. Here’s the whole method.

Step one: list the tools

Write down which AI tools staff may use for work, and which plan each one is on. Anything not on the list isn’t used for customer work.

Step two: check the training setting

Some plans can use what you type to train the AI, unless the setting is off. Find the setting on each tool, write down what it says and the date you checked, and don’t take anyone’s word for it, mine included.

Step three: decide what never goes in

Customer names with their contact details, health details, tax file numbers, bank details, and anything a customer told you in confidence.

Step four: take names out before you paste

Swap every name for a stand-in, like Customer A, and take out phone numbers, emails and street addresses. Put the real details back afterwards, in your own system.

Step five: name who checks the output

A person reads every quote, email or ad the AI writes before it goes to a customer. Write down who.

Step six: add your profession’s rule

If you’re a registered tax or BAS agent, get each client’s permission before their information goes into an AI tool, and keep a record of the yes.3 If your profession has its own regulator or code, look there for a line on AI.

Step seven: put it up, and read it again

Pin the page where staff will see it. Read it again whenever you change tools or plans, or a vendor changes its settings.

A made-up example

This business is invented. A bathroom renovation business with five staff uses one AI assistant to write first versions of quotes and customer emails. Its page reads:

AI at our business: the rules

We use: one AI assistant, on its business plan, chosen by the owner. No other AI tools for customer work.

Training setting: checked on [date] by the owner, and written here.

Never goes in: customer names with contact details, health details, tax file numbers, bank details, anything told to us in confidence.

Before pasting: swap names for Customer A, Customer B; take out phone numbers, emails and street addresses.

Who checks: the owner reads every quote and email the AI writes before it goes out.

Read again: whenever we change tools or plans.

If you’d rather write it with someone

On our menu that’s the card Safe rules for AI in your business: what the AI may touch and what it must never, written down. It sits in our lowest price band, one dollar sign.

Book a free hour.