1. Australia Moves to Legislate AI Standards
On 15 July 2026, the Prime Minister announced that the government intends to legislate Australian Standards for AI and has established an Office of AI within the Department of the Prime Minister and Cabinet to coordinate the design of the framework across government.
That is a genuine shift. Australia had spent several years in the consultation-and-voluntary-guidance phase — the National AI Centre published its Guidance for AI Adoption in October 2025, setting out six essential practices known as the AI6, and that guidance remains the primary government reference for responsible adoption. What changed in July is the stated intention to put standards into law rather than leave them as best practice.
What this does and does not mean for a small business
It does not mean an AI compliance burden is landing on a ten-person business next quarter. Legislation is expected to be introduced in early 2027, and the framework is aimed principally at high-risk uses and large infrastructure. What it does mean is that the direction is settled: using AI on customer data will be a regulated activity in Australia, not an unregulated one. Decisions you make now about where your AI runs, whose data it touches and what records it keeps are decisions you will be asked about later. Choosing tools that already handle that properly is cheaper than retrofitting.
2. Data Centres Go to National Cabinet This Month
The second half of the July announcement is the more concrete one. The government has proposed bringing large AI data centres under nationally consistent rules covering their location, supporting infrastructure, energy use and water consumption.
The proposals reported include requirements that large data centres underwrite new power supplies, cover their share of grid connection costs, and add at least as much electricity to the grid as they consume, alongside obligations to minimise water use, improve energy efficiency and fund any additional water infrastructure they need. The Prime Minister is seeking agreement from state and territory leaders at National Cabinet in August 2026, with legislation expected in Parliament in early 2027.
2×
Australian data centre capacity is on track to double between 2026 and 2030
A$25bn
Microsoft’s Australian expansion commitment, April 2026
A$20bn
AWS’s Australian commitment, June 2025
Aug 2026
National Cabinet considers the framework
Why a phone company is writing about this: because the reason all that capacity is being built in Australia is the same reason it matters to you. Compute located in Australia is compute inside Australian jurisdiction. As AI moves into ordinary business tools — including call transcription and AI receptionists — the question of which country your customers’ voices are processed in stops being an abstraction and becomes a line in your privacy policy. Where your data actually lives is the version of this argument that applies to a phone system.
The contested part is energy. AI data centres are large, concentrated loads arriving on a grid already under pressure, and modelling has warned of upward pressure on power prices if capacity is added without matching generation. That is precisely what the “add at least as much as you consume” proposal is designed to address, and it is why the framework needs the states at the table.
3. Everyone Has Agents. Almost Nobody Has Governance
This is the finding of the year, and it is remarkably consistent across sources.
| Finding | Figure | What it tells you |
|---|---|---|
| AI agent deployment across Australia and New Zealand (Salesforce research) | ~50% of organisations | Agents are mainstream, not experimental |
| Of those, how many have formal governance | Frequently little or none | The gap between doing and governing is the exposure |
| Australian organisations with AI assistants deployed beyond pilot (Proofpoint 2026) | 87% | This is not a future technology conversation |
| Of those, describing their AI security posture as catching up, inconsistent or reactive | 52% | More than half know they are behind their own deployment |
The honest reading is not that Australian organisations are reckless. It is that agents arrived through the side door. A team enables an assistant inside a tool they already pay for; nobody files a project; nobody writes a policy, because from the inside it does not feel like deploying AI, it feels like ticking a box in software you already had.
The version of this that bites a small business
You do not need an enterprise AI strategy to have this problem. You need one staff member who pastes a customer list into a public chatbot to draft a mail-out. That is a disclosure of personal information, not a shortcut, and the OAIC has been explicit that privacy obligations attach both to what you put into an AI system and to output containing personal information. The mitigation is a single sentence said out loud to your team, not a governance framework: customer data goes only into tools we have chosen, never into a public one.
4. The Quieter Problem: Architecture, Not Ambition
Alongside the governance gap sits a structural one. Research from Google Cloud found that 58% of Australian enterprises have IT architectures too rigid to support AI properly, against 83% globally needing upgrades for agentic AI.
Translated out of enterprise language: the systems cannot talk to each other. An AI agent is only as useful as the data and actions it can reach, and in most organisations the customer record, the booking system, the phone system and the accounting package are four islands connected by a person copying between them. Put an agent on top of that and it can draft an email but it cannot book a job.
The test that matters
Can your systems be connected by an API, or only by a human? That single question predicts whether AI will do anything useful for you more reliably than any vendor demonstration.
Why small businesses often win here
Fewer systems, newer systems, less custom integration debt. A ten-person business running four cloud tools is frequently better positioned than a large firm running twenty-year-old middleware.
The phone is usually the worst island
In most businesses, the phone system is the system that shares the least. Calls happen, and nothing about them reaches the CRM unless somebody types it.
What to do about it
When replacing anything, treat open APIs as a requirement rather than a feature. It is the cheapest AI investment you can make, because it makes every later one possible.
5. The OAIC Starts Checking
The Office of the Australian Information Commissioner has announced its first-ever compliance sweep, a targeted review of selected businesses’ privacy policies to test whether they meet the requirements.
A sweep is not an investigation and it is not an enforcement action. It is a regulator reading documents that are supposed to be public and accurate, and finding out how many are neither. For most businesses the finding will be one of three: no privacy policy at all, a policy copied from a template in 2019 that describes practices you no longer follow, or a policy that never mentions the AI tools you now use.
A twenty-minute job
Open your privacy policy. Check three things: does it describe what you actually do with personal information today, does it mention any AI or automated processing you now use, and does it tell people how to contact you and complain. If your answer to any of those is no, fix it before somebody else reads it. This is general information rather than legal advice — take your own, particularly if you handle health information.
6. The 10 December Deadline Nobody Mentions
Here is the item most likely to catch an Australian business unprepared, because it has had almost no coverage outside legal newsletters.
From 10 December 2026, APP entities that use personal information in automated decisions capable of significantly affecting an individual must set out in their privacy policy the kinds of personal information used and the kinds of decisions made. OAIC guidance is expected around September 2026. Separately, the OAIC has been working towards registering the Children’s Online Privacy Code by the same date, following an exposure draft released on 31 March 2026 with submissions closing on 5 June.
| Question | Answer |
|---|---|
| Does this apply to me? | If you are an APP entity. The $3 million turnover small business exemption still exists as at writing, but many small businesses are covered regardless of turnover — including health service providers of any size and businesses that trade in personal information — and removing the exemption entirely has been on the reform agenda for years. |
| What counts as an automated decision? | A decision made by a system rather than a person, using personal information, where the outcome could significantly affect someone. Eligibility, credit, pricing that varies by individual, prioritisation of service. |
| Does an AI receptionist count? | Generally not, if it is answering, taking details and routing. It starts to if it decides who gets served, who is turned away, or who receives a different price. The line is whether a decision is being made about the person. |
| What do I actually have to do? | Disclose it in your privacy policy: the kinds of information used and the kinds of decisions made. It is a transparency obligation, not a prohibition. |
The practical advice is simple. Between now and December, write down every place in your business where software makes a decision about a person without a human looking at it. For most small businesses the list is short or empty, and finding that out takes an hour. For the ones where it is not empty, an hour in August is considerably cheaper than a scramble in December.
7. Breaches Keep Coming, Privacy Teams Keep Shrinking
The background against which all of the above is happening. OAIC data recorded 532 notifiable data breaches in the first half of 2025, with each incident affecting an average of more than 10,000 individuals. At the same time, reporting through 2026 has described Australian privacy teams shrinking even as AI-related risk grows — fewer people, more surface area.
The board-level shift being described in the security press is a move away from perimeter thinking toward the full data lifecycle: not just who can get in, but what you collect, why you kept it, where it went, and when it is deleted. That reframing is useful for a small business too, and it produces a much better question than “are we secure?”
The better question: what personal information are we holding that we do not need? Every record you have deleted is a record that cannot be breached, cannot be subpoenaed and does not have to be disclosed. For most Australian small businesses, a retention clean-out is the highest-value hour of security work available, and it costs nothing. The Origin Energy breach is the case study.
What This Adds Up To for a Normal Business
Seven stories, three consequences.
| Consequence | Why | Practical implication |
|---|---|---|
| Jurisdiction is becoming a purchasing criterion | AI standards heading into law, a national data centre framework, and privacy obligations that attach to AI processing | “Where does this run?” belongs on your vendor questionnaire, next to price |
| Governance is now the bottleneck, not capability | Half of ANZ organisations already run agents; the shortfall is policy and architecture, not technology | The cheapest AI work available is writing down what your team may and may not put into a tool |
| Transparency obligations are arriving on a date | 10 December 2026 for automated decision-making disclosure, with OAIC guidance expected around September | An hour of inventory in August beats a scramble in December |
Why the Telephone Keeps Turning Up in This Story
It may look odd for a phone company to write a technology briefing. There is a reason the two subjects keep colliding.
The telephone is simultaneously the most personal-information-dense system in most businesses and the least connected. Every call is a person telling you their name, their address, their problem and often their health or financial situation. Modern phone systems record and transcribe that. And in most organisations, none of it flows anywhere else — it sits in a recording nobody has classified, with no retention policy, in a system nobody thought of as a data store.
Recordings are personal information
So are transcripts and AI summaries. Where they are stored, how long they are kept and who can hear them are privacy questions, not IT questions. Australian call recording law is state-based and specific.
Processing location matters
If your AI receptionist transcribes an Australian customer’s call, the country that happens in is a fact you should know and be able to state.
It is the island worth connecting first
Connecting the phone to the CRM turns the least-integrated system into the most useful one, and it is usually the cheapest integration available.
Retention is the free win
Most businesses keep every call recording forever because nobody chose otherwise. Choosing a retention period is a five-minute decision that reduces risk permanently.
Six Things Worth Doing Before December
All of this, reduced to a list you could finish in a working day.
| # | Action | Time |
|---|---|---|
| 1 | Say the sentence out loud to your team: customer data goes only into tools we have chosen, never into a public chatbot. | ✓ 5 minutes |
| 2 | List every AI feature switched on across your business, including the ones inside tools you already paid for. Most people are surprised by the length. | ✓ 30 minutes |
| 3 | Write down anywhere software makes a decision about a person without a human reviewing it. Usually short, occasionally not. | ✓ 1 hour |
| 4 | Read your privacy policy as if you were the regulator. Fix what is no longer true, add what is now true. | 1–2 hours |
| 5 | Ask every vendor holding customer data one question in writing: which country is it processed and stored in? | ✓ 20 minutes |
| 6 | Set a retention period for call recordings and transcripts, and apply it. Deleted data cannot be breached. | ✓ 30 minutes |
None of that is an AI strategy, and it is not meant to be. It is the small set of decisions that determine whether the next two years of AI adoption in your business happen deliberately or by accident. If you want the practical starting point rather than the policy view, can a small business actually use AI is the companion piece, and the August telco briefing covers the other half of the month.