You want to use AI. Where do you actually begin?
Eight questions come up in almost every conversation with an Australian business considering AI. Here are straight answers to all eight, with the source behind each one. Where the honest answer is "nobody has published that", we say so rather than filling the gap.
Three questions wearing eight costumes.
However the question is phrased, it resolves to one of these. Knowing which one you are actually asking tells you which page to read next.
Faster proposals, more quotes out the door, work that used to be uneconomic becoming economic. The honest test is whether the hours saved get redeployed into billable or revenue-generating work, or just absorbed.
Client data in a foreign model. A decision you cannot explain. An answer your staff trusted that was wrong. This is the question that has a legal deadline attached to it, which is why it usually gets asked first.
Licences, tokens, the person who runs it, and the time to train everyone. The token bill is usually the smallest of the four and the only one people model.
Five steps, in this order.
Most businesses start at step four, buy a tool, then work backwards. Doing it in order costs less and produces fewer surprises.
- Find out what your staff are already using
In almost every business we have looked at, AI arrived before the policy did. Ask, without consequences attached, what tools people are already using and what they put into them. You cannot govern a tool you do not know about, and the register is worthless if it only lists what you approved.
Half a day · a spreadsheet and an honest conversation - Classify your data before you classify your tools
Decide which categories of information may leave the business and which may not: client records, health information, staff files, unpublished financials, anything under an NDA. This one decision answers most of the tool questions automatically, and it is the step people skip.
One afternoon · a four-column matrix - Write the rule down and have people acknowledge it
A policy nobody has read is not a control. What matters is that staff know what they may paste, what they may not, and who to ask when it is not obvious. Keep it short enough that people finish reading it.
A week including sign-off - Pick one workflow and measure it
Not a strategy, just one repeated task with a number attached. Time it before, time it after, and count the errors both ways. One measured workflow beats a company-wide rollout you cannot evaluate.
Four to six weeks to a defensible number - Only then decide what to buy and who runs it
By this point you know what your data rules are, what the work is worth, and who is actually doing it. Buying decisions made here are cheap to reverse. Buying decisions made at step one rarely are.
Ongoing
The eight questions.
What must my AI policy contain to comply with Australian law?
Nothing. There is no Australian law that requires you to have an AI policy, and none that specifies what one must contain. Australia has no AI Act. The National AI Plan of December 2025 confirmed the government is relying on existing technology-neutral law rather than a single AI statute, and the previously proposed mandatory guardrails for high-risk AI were dropped.
What does exist is one binding obligation and one voluntary benchmark.
The binding one is not about AI policies at all. It is a privacy policy disclosure. From 10 December 2026, if you are already covered by the Privacy Act and you use a computer program to make, or to do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect someone's rights or interests, your privacy policy must say so.
The voluntary one is the National AI Centre's Guidance for AI Adoption, six essential practices. It is not law. It is what a regulator, an insurer, a tender panel or an enterprise customer will measure you against, which in practice makes it the standard that matters:
Guidance for AI Adoption, National AI Centre / DISR, published 21 October 2025 · industry.gov.au. National AI Plan, December 2025. Privacy and Other Legislation Amendment Act 2024, APP 1.7–1.9, commencing 10 December 2026. Verified 7 September 2026.
Which AI tools am I allowed to use in Australia?
All of them. No AI tool is banned for Australian businesses. That is the wrong question, and asking it sends people looking for an approved-vendor list that does not exist.
The real question is not which tool but what you put into it. The obligations attach to the data, not the software. Work down this table and the tool question answers itself.
On that last row: of nineteen providers we track, only Amazon Bedrock and NVIDIA-on-Bedrock name an Australian region and publish a rate for it, both in Sydney. Google runs a Sydney Vertex region but does not state per-model availability on its pricing page. Every Chinese provider's hosted API serves from China or Singapore. Open-weight models under permissive licences, such as Mistral's Apache 2.0 releases, are the cheapest and can be run on your own Australian hardware.
The OAIC's stated best-practice position is not to enter personal information, and especially not sensitive information, into publicly available generative AI tools at all. Business-tier and enterprise agreements are a different matter, but you have to read what you signed.
OAIC, Guidance on privacy and the use of commercially available AI products, 21 October 2024 · Privacy Act 1988 (Cth), s 6 definition of sensitive information · Model availability verified 7 September 2026 against each vendor's own pricing page. See the model comparison.
How much will it cost me?
Four costs, and most businesses model only the second-smallest of them.
- Seat licences. Per-person subscriptions to the assistants your staff use. For most small and mid-size businesses this is the largest line and the easiest to forecast.
- Tokens. What you pay when software you built calls a model directly. Priced per million tokens, and the spread is enormous. The same workload costs A$851 a month on a frontier model and A$4.41 on the cheapest model that publishes a price. Our cost calculator prices your own volume across every model.
- The person who runs it. Usually part of an existing role rather than a hire. See the question below.
- Time to train everyone. Consistently underestimated. A tool nobody was taught to use produces a licence bill and no output.
Two levers move a token bill far more than model choice does: how much of each prompt repeats (caching typically cuts the input side by 80–90% where the vendor offers it) and whether the answer can wait (batch processing halves most of the rest). A team that gets both right runs a more capable model for less than a careless team pays for a cheap one.
Prices read off each vendor's own pricing page, verified 7 September 2026. Worked example: 50 users, 20 requests each working day, 4,000 input and 800 output tokens per request, 60% cached.
What return will I actually get?
We do not publish a return figure, because any honest one would be about your business rather than about AI. Vendor case studies quoting 30% or 40% productivity gains are marketing, and Australian businesses that have measured properly report a much wider spread, including workflows where it went backwards.
What we can give you is the arithmetic. Return on one workflow is:
Three things decide whether that number is real:
- Do the saved hours go anywhere? Two hours a week returned to a fully-booked professional is billable capacity. The same two hours returned to someone who was not capacity-constrained is not a saving, it is slack.
- What does checking cost? Output that a senior person must verify line by line can cost more than doing the work. Count the review time on the cost side.
- What does being wrong cost? A wrong internal summary is an annoyance. A wrong client-facing number is a different category. Weight the workflows accordingly.
Measure one workflow for four to six weeks before extrapolating to anything. The CFO workbook in Kit Pro sets this up with the arithmetic already in place.
What are my competitors using?
We do not know, and neither does anyone else who claims to. There is no Australian dataset that reliably reports which AI tools named companies use. What circulates as competitor intelligence is usually assembled from press releases, job ads and vendor logos on conference slides, none of which tells you whether the tool is in production or was trialled once and dropped.
We are building an evidence-based view for the AI First Australia page, built only on things a company has actually disclosed: published AI strategy, named partnerships, roles being hired, product features shipped, and governance disclosed in annual reports. It will be an evidence profile, not a ranking, and it will not be published until it is worth relying on.
In the meantime, the more useful competitive question is not what tool they bought but whether they have written down their data rules. A competitor with a policy can put AI in front of clients. One without a policy is one incident away from having to stop.
Do I need an AI expert in-house? What would they actually do?
Below roughly 200 staff, almost certainly not as a dedicated hire. What you need is a named owner: one existing person with the time formally allocated, not a job title bolted onto someone's evenings.
The work is real but it is not full-time at your size:
- Keeps the tool register current: what is approved, who owns each tool, what data class it may touch.
- Runs the approval gate: a short assessment before a new tool gets used on anything that matters.
- Is the person people ask: "can I put this in?" needs an answer in minutes, not a committee.
- Watches the regulatory feed: a few hours a quarter, so obligations don't arrive as a surprise.
- Owns the measurement: before-and-after numbers on the workflows you chose.
In practice this sits best with whoever already owns operations or risk, often the operations manager, the practice manager, or the CFO in a smaller business. It fits badly with IT alone, because most of the decisions are about data and process rather than technology.
What it is not: a data scientist. You are not building models, you are governing the use of someone else's. Hiring for machine learning skills to solve a governance problem is a common and expensive mistake.
The Guidance for AI Adoption's first essential practice is "decide who is accountable". Naming that person is the single cheapest thing on this page, and it is the one an auditor will ask about first.
Who else in the business will use it, and for what?
Adoption spreads along the same path in most Australian businesses we have looked at, and it is worth planning for rather than discovering:
- Sales and marketing first: drafting, proposals, first-pass copy, research summaries. Highest volume, lowest risk, most visible wins.
- Operations and admin next: meeting notes, summarising documents, drafting standard correspondence, cleaning up data.
- Finance: reconciling narratives, variance commentary, first-pass analysis. Higher stakes, more checking.
- Client-facing delivery last, and deliberately so, because anything that reaches a client should go through a policy and a named reviewer before it goes through a model.
- HR is the special case. Anything touching recruitment, performance or termination carries discrimination and Fair Work exposure that the other uses do not, and an AI-assisted decision about a person is exactly what the December disclosure duty is aimed at.
The pattern to avoid is the one where AI enters through the least-governed door. If sales is using it and nobody else knows, your first policy conversation happens after something has already gone out.
How do I measure whether it is working?
Pick four numbers per workflow and take a baseline before anything changes. Without the baseline you will be arguing about impressions in six months.
- Cycle time. How long the task took, start to finish, before and after.
- Rework rate. How often the output had to be materially fixed. If this rises, the time saving is not real.
- Volume. How many of the thing you now do. A faster process that produces the same volume has saved time, not made money, which is fine, but say which one you got.
- Cost per unit. Licences plus tokens plus review time, divided by output. The only figure that survives contact with a CFO.
Two rules that keep the measurement honest. Measure a workflow, not a department. Department-level productivity numbers are unfalsifiable. And keep a control where you reasonably can: one team on the new process, one on the old, same period.
Then set a kill rule in advance. Decide now what result would make you stop, and write it down. Projects without a stated kill condition tend not to have one when the numbers arrive.
Does the December duty reach you?
Two questions decide it: whether the Privacy Act covers you at all, and whether any computer program is involved in decisions that significantly affect people. Most businesses can answer both in under a minute, and a fair number find the answer is no.
Knowing it does not apply is a useful result. It is not a sales funnel. If you are outside the Act, we will tell you so.
The governance kit
Five editable documents that turn the six essential practices and the December duty into a policy, a register, a data rule and a board brief, with the source cited next to every clause that depends on official wording. Written for a business with 20 to 200 staff and no legal team.
The free government template covers the policy itself. Buy this if you also want the data-classification matrix, the tool register and the board brief, already drafted.