01 / Privacy & Compliance
From 10 December, your privacy policy has to say where a computer decides
The Privacy Act's automated decision-making rule starts on 10 December 2026. If a computer program, AI or otherwise, makes or substantially shapes a decision about a person, your privacy policy has to say what kinds of information it uses and what kinds of decisions it makes. Intake triage, rostering, credit terms, quote pricing, CV screening: all of that counts if the software is doing the deciding.
Two things matter for SEQ operators. Aged care and allied health providers are covered whatever their turnover, because health service providers never had the small business exemption. Distribution and wholesale businesses over $3 million are covered too. The OAIC's guidance is still in consultation with no publication date set, so the runway will be short once it lands. The useful side effect: if you cannot write down what a system decides and why, that is a decision you should not have fully automated in the first place.
Owner takeaway: Aged care and allied health operators, and distributors over $3m turnover: list every place software decides something about a client, applicant or staff member this month, and start the privacy policy update now, not in December.
Original source: Gilbert + Tobin - Automated decision-making transparency under the Privacy Act
02 / AI & Process
Microsoft gave 200,000 staff AI tools. Then it learned that was not the point.
Microsoft published what it learned rolling AI across its own workforce, and the honest bit is worth reading. Handing 200,000 people Copilot did not change how work happened. Usage went up; outcomes did not. So they stopped measuring adoption and started with the business result, then looked for where AI actually mattered.
One sales group tripled its priority use cases: revenue per account manager up 9.4 per cent, close rates up 20 per cent. Supply chain teams found that automating a broken workflow changes nothing, so they redesigned the process first, then added more than 100 agents, with cycle times down as much as 75 per cent on selected steps. Their summary line: the advantage comes from organisational learning, not model access. Every business will have the same tools soon. What differs is whether you redesigned the work, decided which decisions stay human, and picked the one or two places AI lets you do something you could not do before.
Owner takeaway: Any SME office team, and every owner in aged care, agri or distribution weighing a Copilot rollout: before you buy licences, pick one workflow, fix the process, then decide what AI adds. A licence without a redesigned process is a subscription, not a change.
Original source: Kathleen Hogan, Official Microsoft Blog - What we've learned from Microsoft's own AI transformation
What I would do first
Start with a one-page list of every place software decides something about a person in your business - that list is both the privacy policy update and the audit shortlist in one. Then pick the one workflow that annoys the team most and map it on paper before anyone buys a licence. If someone is already selling you AI licences, ask what process they expect to change; if they cannot say, wait.
Running a business that needs someone accountable for technology decisions, not just automations? See the fractional CIO seat.