by The Computing Australia Group | 
AI in the workplace has moved on. A year ago, most businesses were experimenting with chat tools. Today, AI is built into the software your staff already use, it can take actions on their behalf, and Australia’s privacy rules are catching up. As a result, the question for leaders is no longer whether to use AI. It’s how to use it safely, measure what it delivers and keep people in charge.
This playbook sets out where we stand, what has changed, and a practical seven-step path from first pilot to everyday use. It draws on our experience as a Perth IT and AI provider and on the government’s own guidance, and it includes two templates you can copy today.
Updated 28 October 2026
What’s changed for AI in Australian workplaces
- New disclosure rules start 10 December 2026. If a computer program makes or substantially supports decisions that significantly affect people, your privacy policy must say so. The OAIC released guidance on 30 September 2026.
- No AI-specific law, but existing laws apply. The National AI Plan (2 December 2025) dropped the proposed mandatory guardrails in favour of updating existing laws such as privacy law.
- Six practices replaced the voluntary standard. The government’s Guidance for AI Adoption (21 October 2025) condenses responsible AI into six essential practices.
- AI agents have arrived. Tools can now draft, decide and act across your systems, so permissions and approvals matter more than ever.
Our view: six principles for AI in the workplace
These six principles shape how we approach AI with our clients. In short, they’re how we think every leader should start.
Start with one repeated task
Pick a job your team does every day. Small, measurable wins beat a grand AI strategy that never ships.
Fix permissions before AI
AI assistants see whatever your staff can see. Clean up file sharing and access first, or AI will surface what it shouldn’t.
People own the decision
AI drafts, summarises and suggests. However, a named person stays accountable for anything that affects customers or staff.
Measure time, not licences
Count hours saved, errors avoided and faster responses. Licences bought tell you nothing about value.
Give agents least privilege
An AI agent should have only the access it needs, with approvals for anything it can’t undo.
Governance speeds you up
Clear rules let staff use AI with confidence. Without them, they either avoid it or use it in secret.
What has changed since the first wave of AI
The first wave of workplace AI was mostly chat: staff copied text into a public tool and pasted the answer back. That created quick wins, but also “shadow AI”, where company data ended up in tools nobody had approved.
Now the picture is different. First, AI sits inside everyday platforms such as Microsoft 365, CRMs and accounting software, so it works with your real data. Second, agents can complete multi-step tasks, such as triaging an inbox or updating records, not just answer questions. Third, regulation is arriving through existing laws rather than a single AI act. Together, these shifts move AI from a productivity trick to a business system, and business systems need ownership, security and measurement.
Step 1: Tie AI in the workplace to business outcomes
Before you compare tools, agree what you want to improve. Start with three questions: where are our bottlenecks, which outcomes matter most this quarter, and what would we stop doing if we had to choose?
Then turn each answer into a problem statement AI can help with. For example, “cut the time to process a supplier invoice from five minutes to one” is far more useful than “use AI in finance”. Each pilot also needs a named business owner, a target metric and a one-page brief. To make that easy, there’s a pilot brief template further down.
Step 2: Get your data and permissions ready
AI is only as good as the data it can reach, and only as safe as the permissions around it. Before a pilot, check five things:
- Catalogue: what data you hold, where it lives and who owns it.
- Cleanliness: duplicates, gaps and inconsistent formats.
- Completeness: enough history for the task you have in mind.
- Controls: who can access what, how long you keep it, and whether personal information is involved.
- Connectivity: whether your systems can share data through connectors or APIs.
For most businesses, the biggest risk sits in Microsoft 365: old SharePoint sites and “anyone with the link” sharing that an AI assistant will happily search. Consequently, we recommend a permissions review before any Copilot rollout, backed by our cyber security services.
Step 3: Choose a first pilot
A good first pilot solves a painful, well-understood problem, uses data you already hold, carries little privacy risk and has a keen business owner. In addition, it should show a clear result within a couple of months. Here are six that work well across most businesses.
Finance
Capture and check supplier invoices automatically, routing only the exceptions to a person. Measure cost and time per invoice.
Customer service
Draft replies from your knowledge base for staff to approve. Measure response time and first-contact resolution.
Operations
Forecast repeat orders and flag likely stock-outs early. Measure forecast accuracy and urgent orders.
Sales and marketing
Summarise enquiries, score leads and draft tailored follow-ups. Measure conversion and response speed.
HR
Draft position descriptions and onboarding packs. Keep people in charge of any decision about a candidate.
IT support
Answer common questions and handle routine requests through a help desk assistant. Measure tickets resolved.
Not sure which task to start with? A business process analysis maps where your team’s time goes and shows which jobs AI can genuinely speed up.
Step 4: Choose the right tools and partners
The AI market is noisy, so focus on fit rather than the flashiest model. As a rule, buy when the task is common, such as meeting notes or invoice capture. Blend when you need your own rules on top of a vendor’s engine. Build only when the capability is genuinely your edge and you can maintain it.
Whatever you choose, check the same things: security certifications and where data is stored, how personal information is handled, audit trails, how well it connects to your systems, how easy it is for non-technical staff, and the total cost, including training and support.
Step 5: Bring your people with you
AI adoption is a change in how people work, not just a new tool. Therefore, give every pilot a small team: a business owner, someone who knows the data and integrations, someone to configure the AI, a subject expert to test outputs and someone to lead training and communication.
Training should match the role. Leaders need a short session on what AI can and can’t do. Frontline staff need practical, safe-use training. Meanwhile, a few champions should go deeper. Above all, publish a clear AI use policy listing approved tools and what data they can use. That single step does more to stop shadow AI than any blocking tool.
Step 6: Govern AI in the workplace the Australian way
Australia has no AI-specific law. Instead, the government’s Guidance for AI Adoption sets out six essential practices, and existing laws such as the Privacy Act apply. Here’s what each practice looks like in a typical business.
Decide who is accountable
Name an executive owner for AI and an owner for each use case.
Understand impacts and plan
Ask who could be affected, and how, before you switch AI on.
Measure and manage risks
Keep a simple AI register with the risks and controls for each tool.
Share essential information
Tell staff and customers where AI is used and how to reach a person.
Test and monitor
Check outputs before launch and keep sampling them afterwards.
Maintain human control
Keep a person in the loop for decisions that matter, and a way to switch AI off.
New from 10 December 2026: automated decisions must be disclosed. If a computer program makes, or does something substantially related to making, a decision that could significantly affect someone’s rights or interests, and it uses their personal information, your privacy policy must say what kinds of personal information and decisions are involved. The OAIC’s new guidance explains the detail. In practice, list your AI and automation tools now and check which ones touch decisions about people.
Security frameworks are adapting too. For instance, NIST’s draft Cyber AI Profile applies its Cybersecurity Framework to AI, which we cover in our NIST CSF roadmap.
Step 7: Measure, then scale
AI isn’t set-and-forget, so build evaluation into everyday work. Track four layers: task quality (accuracy and errors), process (cycle time and cost), outcomes (customer satisfaction, revenue and risk) and adoption (who uses it and how often).
A simple return-on-investment model is enough to start. Annual benefit equals hours saved times the loaded hourly rate, plus any revenue lift times margin. Annual cost covers licences, implementation, training and support. Finally, scale only what proves itself, and always keep a human override for high-impact actions.
Agentic AI: what leaders need to know
Agents are the biggest shift in workplace AI this year. Unlike a chat assistant, an agent can take a goal, plan the steps and act across your systems, such as sending emails, updating records or booking jobs. That’s powerful, but it also changes the risk.
Treat an agent like a new staff member with system access. Give it the least access it needs, require approval for anything it can’t undo, log what it does and make sure someone can switch it off. Start agents on internal, reversible work before you let them near customers or money.
A 90-day plan for AI in the workplace
Here’s a realistic first quarter for a small or mid-sized business.
Days 1–30: Discover
Run a leadership workshop, pick one or two pilots, write the briefs, review Microsoft 365 permissions and publish an AI use policy.
Days 31–60: Build
Configure tools, connect data, train pilot users, test on real cases and update your privacy policy if decisions about people are involved.
Days 61–90: Prove
Measure against the baseline, share results with leadership, then decide what to scale and which pilot comes next.
Templates you can copy
To get moving, copy these two templates into Word or your intranet and fill in the brackets.
1. AI pilot brief
Use in Step 1. One page per pilot.
AI PILOT BRIEF (one page) Pilot name: [name] Business owner: [name, role] Date: [date] Problem: [what is slow, costly or error-prone today] Goal: [measurable target, e.g. cut invoice processing from 5 to 1 minute] Baseline: [today's numbers] Data used: [systems and data types; any personal information? yes/no] Tool: [approved tool or platform] People affected: [staff, customers] - human review step: [who checks what] Risks and controls: [privacy, accuracy, security] Success measure and review date: [metric] by [date] Decision at review: scale / adjust / stop
2. AI readiness checklist
Use before your first pilot, then every quarter.
AI READINESS CHECKLIST Strategy [ ] 1-3 measurable outcomes for the next 90 days [ ] One-page brief and business owner for each pilot Data and security [ ] Data map and owners for pilot data [ ] Microsoft 365 / file-sharing permissions reviewed [ ] Personal information identified; privacy policy checked for automated decisions People [ ] AI use policy published (approved tools, allowed data) [ ] Training planned for leaders, users and champions Governance [ ] Executive accountable for AI named [ ] AI register: tools, uses, risks, controls [ ] Human review and an off switch for high-impact uses Measurement [ ] Baselines captured before launch [ ] Monthly review of quality, time saved and adoption
Common pitfalls (and how to avoid them)
Finally, most stalled AI projects fail for the same few reasons.
Tech before outcomes
Lead with a business metric and a one-page brief, not a tool demo.
Messy permissions
Review who can see what before switching on any AI assistant.
Scope creep
Time-box pilots and give each one a single main measure.
Shadow AI
Publish approved tools and a use policy, then train people on them.
Over-automation
Keep people in the loop, and start with low-risk, reversible tasks.
Ignoring privacy
Check which tools touch personal information and update your privacy policy.
How CAG helps
We make AI safe, simple and valuable for Australian businesses, from the first workshop to everyday use. Moreover, because we also run managed IT and security, your AI plans and your systems are designed together.
How CAG helps with AI
- AI opportunity assessments to find where AI will genuinely save time
- Workflow automation and AI assistants built around your processes
- AI tool setup and integration with the systems you already use
- Document processing and automated reporting
- Microsoft 365 Copilot readiness, starting with a permissions review
- An AI use policy and staff training, so people use AI safely
Learn more about our AI consulting and automation services.
AI opportunity assessment
Find the one task worth automating first
We’ll look at how your team works, check your data and permissions, and recommend a first pilot with a clear measure of success.
AI in the workplace: frequently asked questions
Is AI only for large businesses?
No. Today’s tools are built into everyday software, so small and mid-sized businesses can automate admin, improve service and save time without a data science team.
Are there AI laws in Australia?
There is no AI-specific law. Instead, existing laws such as the Privacy Act, consumer law and workplace law apply, and the government’s Guidance for AI Adoption sets out six recommended practices.
Do we have to tell customers when we use AI?
From 10 December 2026, if a program uses personal information to make or substantially support decisions that significantly affect people, your privacy policy must say so. Being open about AI is good practice anyway.
How do we handle sensitive data?
Classify your data, restrict access, use approved business tools rather than public ones and keep what you share with AI to a minimum. For anything involving personal information, run a privacy impact assessment first.
Will AI replace our people?
AI changes jobs more than it removes them. The best results come when AI handles repetition and summarising, while people handle judgement, relationships and exceptions.
How long until we see value?
A well-chosen pilot usually shows whether it works within a couple of months. That’s why we start small, measure from day one and only scale what proves itself.
Sources and further reading
- Department of Industry, Science and Resources — Guidance for AI Adoption
- OAIC — New resources on transparency for use of AI and automated decision-making
- Piper Alderman — Australia now has a National AI Plan
- NIST — Cyber AI Profile (IR 8596), preliminary draft
This guide is general information, not legal advice. Last reviewed 28 October 2026.
About the author
Chris Karapetcoff
Director (Client Growth and Success), The Computing Australia Group
Chris has been with The Computing Australia Group for over 20 years and looks after its client relationships. He helps organisations get outstanding value from their IT spend, with plain-English advice and a complete IT solution they can build on. As he tells every client: your IT system should just work.
