01 / Privacy
If you’re a lawyer, accountant, agent or jeweller, the Privacy Act now applies to you
From 1 July, the small-business exemption from the Privacy Act disappeared for businesses covered by the expanded anti-money-laundering rules - lawyers, conveyancers, accountants, real estate professionals, and dealers in high-value goods. The OAIC estimates more than 100,000 small businesses are affected, and turnover does not matter: under $3M no longer protects you if you are in one of these industries.
In practical terms, you now need a compliant privacy policy, proper collection notices, and a defensible answer to “what personal information do we hold, where, and why”. Privacy consultancy Helios Salinger notes the regulator is already running a compliance sweep of privacy policies, so this is not a theoretical risk. For most small businesses, the useful bit is that the work required - mapping what data you collect and where it flows - is the same work that makes automation possible later. Do not automate the mess. Map it first.
Owner takeaway: If you are in one of the newly covered industries, book an hour this week to list every place client personal information lives, then check your privacy policy exists and matches reality.
Original source: Helios Salinger - Privacy reforms to impact over 100,000 small businesses
02 / Microsoft 365
Your Microsoft 365 bill changed on 1 July - check what you’re now paying for
Microsoft’s new commercial pricing took effect on 1 July, announced back in December to give businesses time to plan. Alongside the price rise, the Business plans picked up real additions: Business Standard and Business Premium are now sold with Copilot included as permanent SKUs, Business Basic and Standard gained URL protection against malicious links in email, and Copilot Chat has been steadily improving - including the option to use Anthropic’s Claude as the model behind it.
For most small businesses, the useful bit is not the headline price change; it is that you may now be paying for AI and security features you have not switched on. If you are separately paying for a standalone AI chat subscription, the bundled Copilot may make it redundant - or not, depending on how your team actually works. That is a plan-level decision worth making deliberately rather than by default at renewal.
Owner takeaway: Pull up your M365 invoice and plan list this month. Confirm which plan you are on, what Copilot access it now includes, and whether any standalone AI subscriptions overlap.
Original source: Microsoft 365 Blog - Advancing Microsoft 365: new capabilities and pricing update
03 / Security
AI-assisted scams are beating basic defences - one process change helps most
Industry reporting this month put hard numbers on something we keep seeing locally: a survey covered by Tech Business News found 84% of Australian small businesses had a cyber incident in the past year, and AI is making the attacks better. Polished phishing emails, fake invoices with altered bank details, and cloned voices are now cheap to produce and hard to spot on sight. The sectors most exposed - construction, real estate, professional services, healthcare - are exactly the sectors where SEQ small business lives, because payments move quickly and on trust.
The Australian Cyber Security Centre has plain-English guidance for small businesses adopting AI tools, and it is worth a read. But the highest-value defence here is not a product. It is a rule: any change to payment details, from anyone, gets verified by phone on a number you already had. This is worth acting on, not just watching.
Owner takeaway: Set a written rule today that bank detail changes are always verified verbally via a known number, and tell every person who pays invoices.
Original sources: ACSC - Artificial intelligence for small business · Tech Business News - Australian small businesses face rising cyber pressure
04 / AI tools
OpenAI’s new “ChatGPT Work” produces finished documents, not chat
OpenAI launched ChatGPT Work on 9 July - an agent that takes a goal, works on it for hours if needed, and hands back finished spreadsheets, documents, presentations, and even simple websites, powered by its new GPT-5.6 model. It is rolling out from the top-tier plans down to Plus and Business users. The direction matters more than the product: every major AI vendor is now shipping tools that do the work rather than talk about it, and that will change what “using AI” means for small business admin over the next year.
That said, this is week one. Early agent products are impressive in demos and inconsistent on real, messy business tasks. This is worth watching, not rushing. The first practical test would be an internal, low-stakes job - a report you already know the right answer to - so you can judge quality without risking anything client-facing.
Owner takeaway: If you have a ChatGPT subscription, test ChatGPT Work on one internal task you can verify - do not point it at client work yet.
Original source: BNN Bloomberg - OpenAI launches ChatGPT Work
What I would do first
The payment-verification rule
It costs nothing, takes ten minutes to put in writing, and it directly counters the fastest-growing, most expensive threat on this list. Privacy compliance and the M365 plan review are this-month jobs; the scam defence is a today job.
If you want a second set of eyes on where AI and automation actually fit your business - including which of these changes touch you - start here:
Running a business that needs someone accountable for technology decisions, not just automations? See the fractional CIO seat.