Most SME owners assume they would know if their team was using generative AI. The evidence suggests otherwise. An employee AI acceptable use policy is no longer a nice-to-have document. It is the control that decides whether a data incident becomes your problem or stays contained.
The exposure is not technical. It is legal. It sits in your privacy obligations, your client contracts, and the duties your directors owe the company.
Your staff are probably already using AI tools
A KPMG and University of Melbourne study of trust in AI, run across 47 countries between November 2024 and January 2025, reported that 49 per cent of Australian respondents use AI regularly at work. The same study found 48 per cent of AI users admitted using it in ways that breach company policy, including uploading sensitive company information to free public tools. Sixty per cent hid their AI use.
Those figures come via secondary reporting, so treat them as indicative rather than precise. They align with other data. Gartner surveyed 302 cybersecurity leaders between March and May 2025 and found 69 per cent of organisations suspect or have evidence that staff use prohibited public generative AI. Gartner predicts that by 2030, more than 40 per cent of enterprises will have security or compliance incidents linked to shadow AI.
Only 30 per cent of Australian respondents in the KPMG study said their organisation had a generative AI policy at all. If your business has no policy, you are in the majority. That is not a comfortable place to be.
What actually goes wrong when staff paste client data into a chatbot
The typical scenario is mundane. An account manager drafts a client proposal and asks a public chatbot to tidy the wording. A bookkeeper pastes a supplier list to summarise payment terms. A consultant uploads a spreadsheet to find duplicates.
Each of those actions sends personal information to a third party. Once it leaves your systems, you have lost control of where it is stored, who can access it, and whether it becomes training data for the model.
The NSW Reconstruction Authority reportedly disclosed in October 2025 that a former contractor had uploaded a spreadsheet of more than 12,000 rows to ChatGPT in March 2025. The file held personal information, and some health information, for up to 3,000 people. The incident illustrates the risk: one employee, one upload, thousands of affected individuals.
Privacy law: what the OAIC expects from you
The Office of the Australian Information Commissioner published guidance on privacy and commercially available AI products in October 2024, updated in January 2025. It sets out several points that matter for SMEs.
The Privacy Act applies to any use of AI that involves personal information. That covers the information you put in and any personal information that comes out.
The OAIC recommends that organisations do not enter personal information, and especially sensitive information, into publicly available AI chatbots. It cites significant and complex privacy risks.
Under Australian Privacy Principle 6, you can only use or disclose personal information for the purpose you collected it. Consent is one exception. Another is a secondary use the individual would reasonably expect, provided it is related to the original purpose (directly related, for sensitive information). The OAIC says it may be difficult to establish that a person would reasonably expect their information to be fed into an AI tool. Where that expectation cannot be clearly established, the regulator suggests seeking consent or offering a meaningful opt-out.
Two further points catch people out. If an AI tool generates or infers personal information about someone, that is a collection and APP 3 applies. This includes information that is wrong or invented. And under APP 10, you must take reasonable steps to keep personal information accurate. The OAIC notes generative AI is especially prone to inaccurate output.
Before adopting any AI product, the OAIC expects due diligence: testing for the intended use, human oversight, privacy and security risks, and who can access the data entered. It requires ongoing review. Ongoing review, staff training and monitoring are part of the expectation.
Does the Privacy Act apply to your business?
It depends. The OAIC’s small business guidance sets the threshold at $3 million in annual turnover or less, counting income from all sources.
Most small businesses below that line are not covered. Some are, regardless of turnover: health service providers, businesses that trade in personal information, Commonwealth contractors, reporting entities under the AML/CTF Act 2006, businesses related to a covered business, and those that have opted in, among others.
The small business exemption remains in force. The Government released an exposure draft of the second tranche of Privacy Act reforms in August 2026, and it does not propose removing the exemption. Commentary that cites 10 December 2026 as the end of the exemption is usually confusing it with a separate change. That date is when APP entities must start disclosing in their privacy policies when computer programs make, or substantially assist in making, decisions that could reasonably be expected to significantly affect an individual’s rights or interests. It applies to APP entities, not to exempt small businesses.
If you sit outside the Privacy Act, do not treat that as the end of the analysis. Confidentiality obligations and your client contracts apply regardless of turnover.
Confidentiality and contract exposure
Privacy law is only one source of risk. Most professional services engagements include confidentiality clauses that cover client information broadly, not just personal information. Pasting a client’s commercial data into a public tool can breach those clauses even when no individual is identifiable.
There is a second problem. Many AI providers’ terms allow inputs to be used for model improvement. That can amount to disclosing confidential information to a third party, and in some cases to the public. Your client’s contract does not care that you did not intend it.
Directors should also consider their duty of care and diligence. A board that knows staff use AI tools but has no policy, no training and no oversight has a harder argument to make if something goes wrong. The OAIC’s guidance points in the same direction: policies, procedures, updated privacy notices, and a privacy impact assessment for higher-risk uses.
What an employee AI acceptable use policy should cover
A workable policy does not need to be long. It needs to answer the questions staff will actually face.
- Which tools are approved. Name them. A blanket ban on AI is unrealistic and drives use underground.
- What data can never be entered. Client personal information, sensitive information, financial records, unpublished commercial terms, and anything covered by a confidentiality clause.
- What staff must do before using AI output. Verify facts, check names and figures, and treat drafts as drafts.
- Disclosure expectations. Tell staff how and when to flag AI use, and make clear that hiding it is a disciplinary matter.
- Reporting. A clear path to report an accidental upload, without fear of blame.
- Review cycle. Set a date to revisit the policy as tools and guidance change.
Managers may also need to restrict use by role, based on data security and confidentiality requirements. The University of Minnesota’s guidance on appropriate generative AI use takes that approach, and it translates well to a commercial setting.
Training matters as much as the document. A policy nobody has read will not help you in a dispute or an investigation.
Where this fits in your broader governance
An AI policy is one control among several. It should sit alongside your privacy policy, your data breach response plan, and your contracts with clients and suppliers. If your privacy policy does not mention AI, it needs updating. If your client contracts are silent on how you handle their data in AI tools, that gap is worth closing.
The businesses handling this well are not waiting for a regulator to knock. They are treating AI use as a business risk with a documented response, in the same way they treat cybersecurity or credit risk. That is a commercial decision, not a technical one, and it is usually cheaper to make it now.
Businesses in this position should work through their specific requirements and put the right documents in place.
Book an appointment with one of our Lawyers to discuss your specific needs.
Book a ConsultationA Note on the Information We Share
Reading this information does not create a lawyer-client relationship between you and SLK Lawyers. This only occurs with a formal written agreement. Content is current at publication and applies to Victorian law unless stated otherwise. It is general information only and not a substitute for specific legal advice. Strict time limits apply to legal claims. You should seek immediate legal advice on your specific situation to ensure your rights are protected.