AI & Your Business

A monthly briefing on what's changing with AI and what it means for a small business. No hype: what happened, what it means for you, and one thing to do.

Most local businesses haven't thought about this yet. That's your opening: the ones that get ready now are the ones customers will find first.

Issue 1 · October 2026

Why now

More customers are asking AI assistants like ChatGPT and Google's AI who to call, and being given a short list of names. I've had a business owner tell me a customer found them exactly that way, and it turned into a job. Most of your competitors haven't looked at how they appear there. A few simple steps now can put you ahead of them, and they also protect you from the risks below, which is why this briefing covers both.

1. Scam emails now read like your real suppliers

What happened. On 6 October, ANZ warned Australian businesses that payment-redirection (fake invoices and changed bank details), business email compromise and impersonation scams are among the biggest risks to organisations of all sizes, and that AI is helping criminals make them harder to spot. It cites the Australian Signals Directorate's latest annual report, which counted more than 84,700 cybercrime reports in the 2024–25 financial year, with business email compromise among the top reported types for businesses.

Separately, BizCover's analysis of Scamwatch data, reported by IT Brief in August, found small-business scam reports fell 20.8% over the period, but total losses still rose 3.4% and the average loss per report rose 30.4%. In other words: fewer scams reported, but the ones that land cost more.

What it means for you. Spelling mistakes and awkward wording used to give a fake email away. That's far less reliable now. The thing that still works is checking the request, not the writing.

One thing to do. Make it a rule that any change to a supplier's bank details is confirmed by phone, on a number you already had, never by replying to the email. ANZ's other tip is worth adopting too: two people approve larger or urgent payments.

2. The government has told small businesses what to do about AI-powered attacks

What happened. On 6 July the Australian Cyber Security Centre published guidance for small businesses on defending against AI-enabled attacks. It says criminals can use AI to find and exploit weaknesses quickly, especially in websites, and to go from getting in to stealing data or demanding money much faster.

What it means for you. The advice is practical, not technical. Its main steps: turn off websites you no longer need and disable features you don't use on the ones you keep; turn on automatic security updates for staff computers, tablets and phones (especially browsers and operating systems); review the companies that hold your customer data; and make one named person or provider responsible for your website's security.

One thing to do. Write down every website and web page your business has ever had, including old ones nobody visits. If you can't say who looks after each one, that's the first job. The ACSC also suggests asking whoever maintains your site: is the software still supported, are updates applied automatically, and if we're hacked, how fast would you notice and restore from a clean backup?

3. Putting customer details into ChatGPT: the regulator's view

What happened. The Office of the Australian Information Commissioner's guidance on commercial AI products says privacy law applies to personal information you enter into an AI tool, and recommends that organisations "do not enter personal information, and particularly sensitive information, into publicly available generative AI tools". It also says AI output should be checked by a person.

And from 10 December 2026, a new rule starts: organisations covered by the Privacy Act that use a computer program, which the OAIC says includes AI and chatbots, to make or help make decisions that significantly affect someone, using their personal information, must say so in their privacy policy. The OAIC advises that if you're unsure whether you're covered, take the cautious approach and include it.

What it means for you. Whether the Privacy Act covers your business depends on its size and type, and the rules have been changing. If you aren't sure, ask, and the Privacy Commissioner's website is the place to check. Either way, your customers expect you to treat their details carefully.

One thing to do. Agree a simple rule with your staff this month: AI is fine for drafting and summarising, but no customer names, addresses, health or financial details go into a public AI tool. Using AI well and keeping customers' trust are not in conflict.

4. ChatGPT now has ads in Australia. Here's what that does and doesn't change

What happened. OpenAI began showing ads in ChatGPT in Australia from 17 April. They appear only for logged-in adults on the Free and Go plans, not paid plans. OpenAI says ChatGPT's answers stay independent of advertising.

What it means for you. An ad is not the same as ChatGPT recommending you. When someone asks an AI assistant "who's a good local accountant?", the names it gives come from what it can find about businesses: your website, your Google listing, reviews, and whether your details match everywhere. Nobody outside the AI companies knows exactly how it chooses, so treat anyone who claims to guarantee a mention with caution. But the basics are things you control.

One thing to do. Ask ChatGPT and Google the question a customer would ask about your business and your area. Note whether you're named, and who is. Check your Google listing: right phone number, hours and services, and recent reviews. This is exactly what I do each month in the Growth Report.

Sources

This briefing is general information, not legal advice. Check the original sources before acting on anything affecting your legal obligations.

Want help with any of this?

Call or text, or send a message and I'll get back to you.

0409 662 196Send a message