01 / Regulation
Canberra's AI rules just went from voluntary to mandatory
Last week we reported the new Office of AI as a coordination exercise and read the signals as pointing rules-light. One day later, the Prime Minister made the actual announcement, and it reads differently: a set of mandatory Australian Standards for AI, taken to National Cabinet in August, with legislation expected early next year. The government is calling it the first framework of its kind legislated anywhere.
Two details matter for small business. First, the heaviest obligations target large data centres - power, grid, water - not you. Second, the copyright line: the government says no company should be able to use Australian creative works to train AI without the creator's control. If your business produces original content - designs, photography, plans, articles - that is the first time Canberra has put your ownership stake in an AI framework on paper. The detail arrives with National Cabinet in August. This is worth watching, not rushing.
Owner takeaway: Nothing to sign this week. If you produce original creative work, note that a copyright control right is on the table - and keep “AI rules” on the quarterly review list where you put it last week. We will report what National Cabinet actually decides.
Original source: Prime Minister of Australia - AI in Australia's interests | White & Case - Australia changes course
02 / Privacy
Your privacy policy needs an AI clause by 10 December
Here is a deadline hiding in plain sight. From 10 December 2026, businesses covered by the Privacy Act must disclose in their privacy policies when computer programs - including AI tools - make or substantially drive decisions that significantly affect people, and what kinds of personal information those decisions use. The rule was legislated back in 2024; what changed is who it now catches. Since 1 July, more than 100,000 small businesses - lawyers, accountants, agents, high-value dealers - are inside the Privacy Act for the first time, and NAB's numbers say 42% of small businesses are using AI.
The OAIC's guidance adds two points worth knowing regardless of the deadline: do not put personal information into free public AI tools, and an AI-generated claim about an identifiable person counts as personal information even when it is wrong. For most small businesses, the useful bit is that the fix is a mapping exercise, not a legal bill - you cannot disclose what you have not listed. Do not automate the mess. Map it first.
Owner takeaway: List every decision in your business where an automated tool has a real say - quote approvals, tenant or applicant screening, credit terms, hiring filters. If any of them significantly affect a person, your privacy policy needs to say so by 10 December. Start the list now; December is closer than it feels.
Original source: OAIC - Guidance on privacy and the use of commercially available AI products | Gilbert + Tobin - OAIC AI Guidance
03 / Security
AI-written code works - it just isn't secure
An independent study covered by SecurityBrief Australia this week put numbers on a gap worth knowing about. Across 200 coding tasks, the latest AI models - including Claude Opus 4.8 and GPT-5.5 - produced code that worked 83 to 95 per cent of the time. Code that worked and was free of the security flaw the task was designed to catch? 24 to 36 per cent. The strangest finding: models often named the exact defence needed in their own planning notes, then wrote the vulnerable version anyway. The study was funded by a security vendor, which is disclosed - but the tests used established independent benchmarks.
Why this matters outside software companies: your team is almost certainly building things with AI now. A quoting calculator, a client intake form, a little tool that “just connects the spreadsheet to the website”. The demo working is not the finish line. If a vibe-coded tool stores customer details, takes payments, or sits on the open internet, it deserves the same scrutiny you would give software you paid for.
Owner takeaway: Ask one question about any AI-built tool in your business: does it touch customer data or the internet? If yes, have someone qualified review it before it goes further - and add “AI-built tools” to the staff survey we suggested last week.
Original source: SecurityBrief / IT Brief Australia - AI coding models make working code, not secure code
04 / Microsoft 365
Copilot discounts and a free 30-day trial - ask before your renewal
Last week we covered Copilot arriving in Microsoft 365 Business renewals and suggested asking your IT provider for your exact price. Here is the other half of that conversation: what your provider can currently access on your behalf. Microsoft's July channel price list includes Business Basic bundled with Copilot Business at 25 per cent off through December 2026, and standalone Copilot Business at around 15 per cent off over the same window. From 1 August, providers can also offer “Copilot in 30” - a free 30-day trial of Copilot Business for up to 25 users, built specifically for businesses under 300 seats.
Promotional pricing is exactly that - promotional - and a discount is not a reason to buy something you have not tested. But a free 25-user trial is the right way to answer the question the renewal forces: does Copilot earn its keep in your office, on your files, in your processes? The first practical test would be two or three roles that live in email and documents, for a full month, with a simple before-and-after note of hours saved.
Owner takeaway: Before your Microsoft renewal, ask your IT provider three things: your exact per-user price after renewal, which current Copilot promos apply to you, and whether they can run you through the free 25-user trial from August before you commit to paid seats.
Original source: Microsoft Partner Center - July 2026 announcements | Licensing School - Free 30-day trial for Microsoft 365 Copilot Business
What I would do first
The decision list
The decision list from item two. It is the same hour of mapping we keep recommending, pointed at a real deadline: write down every place an automated tool influences a decision about a person. That list does triple duty - it is your 10 December privacy disclosure, your AI-built-tools security check, and the honest starting point for any automation worth paying for. The Copilot trial can wait until August; the list should not wait past this month.
Running a business that needs someone accountable for technology decisions, not just automations? See the fractional CIO seat.