No new rule this week, but 10 December is 45 days away
No new Australian rule this week, and 45 days until the automated decision rule starts
Hello, the theme this week is that no new rule arrived, which makes the dates already set the thing to plan around. The automated decision rule starts on 10 December 2026, 45 days from today, and the tools your staff already use keep changing where information is stored. This follows last week's edition, which went through the OAIC guidance on that rule in detail.
What changed: nothing new, and one date to keep
In the sources I checked, I found no new Australian rule, regulator direction or enforcement action this week that is specific to AI use by small to medium businesses. The most recent change is the OAIC's final guidance, published on 30 September 2026, for the transparency obligation in APP 1.7 to 1.9. That obligation came from the Privacy and Other Legislation Amendment Act 2024.
From 10 December 2026, an APP entity must say in its privacy policy when it has arranged for a computer program to make, or do something substantially and directly related to making, a decision that could significantly affect a person's rights or interests, and personal information about that person is used to run the program. The OAIC states the obligation applies to APP entities. The OAIC's page does not mention the small business exemption, so whether it reaches you depends on whether the Privacy Act applies to your business at all.
1,205 data breach notifications were made to the OAIC in 2025, up 8% from 1,112 in 2024, the highest number since the scheme began in 2018 (OAIC, 6 July 2026).
The OAIC also published its Annual Report 2025-26 on 23 October. I have only seen its listing on the OAIC media centre, not the report itself, so I am not drawing any conclusions from it.
Still coming: the second round of Privacy Act changes
Consultation on a draft Privacy Amendment (Personal Data Protection) Bill 2026 closed on 18 September. A Pinsent Masons summary reports it is expected to pass by the end of 2026. Among the proposals are a fixed 72-hour deadline to notify a breach and a wider test for what counts as personal information. The same summary says the draft makes no direct change to the small business exemption. This is a draft, not law, and I did not open the Attorney-General's Department's own text, so check it before you rely on any detail.
What this means for your business: find out first whether the Privacy Act applies to you. If it does, list any tool that scores, ranks or screens people, such as recruitment, credit or customer triage software, and check what your privacy policy says about it. Start with whether the Privacy Act applies, then read the 10 December 2026 automated decision rule.
Tool changes that affect your client data
Copilot Pages and Notebooks are moving to OneDrive
Microsoft message centre post MC1449182 says new Copilot Pages created in Copilot Chat or the Microsoft 365 Copilot app, and new Copilot Notebooks, will be stored in OneDrive for Business. Rollout started in mid-October and is expected to finish by late November 2026, later than first announced. New pages pick up OneDrive controls: retention labels, DLP policies and eDiscovery. Existing pages are not migrated and stay where they are, so for a while your business may hold AI-generated content under two sets of controls. Microsoft says no admin action is required, and recommends reviewing your existing DLP, retention and compliance policies for OneDrive. I read the post through a third-party tracker that mirrors Microsoft's message centre, so confirm it in your own admin centre.
What this means for your business: ask whoever manages your Microsoft 365 where existing Copilot Pages sit and whether your retention and DLP settings now reach OneDrive. If staff put client information into Copilot, which AI tools can hold client data is the page to read.
Accounting software can now be connected to Claude and ChatGPT
IT Brief reported on 17 August 2026 that MYOB is letting small to medium businesses pull financial insights, such as customer balances, overdue invoices and profit and loss figures, into Claude and ChatGPT, through a phased rollout in their app directories. The report does not describe permissions, consent settings or how the data is stored, so I cannot tell you what the controls are. Check them with MYOB. This item is a few weeks old, but it shows the pattern: a connector turns a financial system into something an AI tool can read, and the decision about who may switch one on sits with the owner.
What this means for your business: before anyone connects an AI tool to your accounting or client records, decide who can approve it and read what the connector can see. Staff using free AI tools sets out the questions.
Scams to brief your staff on
Fake sites and endorsements built to pass a quick search
ASIC media release 26-195MR (17 August 2026) warns that scammers use generative AI to build networks of fake websites, fake reviews, fabricated news articles and AI-generated videos. Some claim a financial services licence they do not hold, use another firm's licence number, or impersonate a licensed business. ASIC says a quick online search is not enough and points to its professional registers for checking licence holder names and numbers.
ASIC removed more than 19,400 scams in FY26, up 182% on the 6,915 removed in FY25 (ASIC, 17 August 2026).
Scamwatch's news and alerts page adds two related warnings. On 28 September it listed investment scams that sit in social media groups, arrive through trusted contacts or appear on fake news sites. On 14 July it listed fake purchase messages that claim you bought something and urge you to call a number to reverse the payment. I read the summaries on that page, not the full alerts.
What this means for your business: give staff one control they can repeat. No payment, refund, login or investment step because of an inbound message or call; contact the organisation on a number or website you already hold. If someone has already shared a login or client details, is it a data breach sets out what to assess.
One thing to decide this week
Who may switch on or connect an AI tool?
Name one person who approves AI tools and connectors in your business. Give them a short list: which tools are approved, and what client information each one may hold. That single decision answers the Copilot Pages question, the connector question and part of the 10 December question, because you cannot say where a decision-making tool sits if nobody knows which tools are in use.
What this means for your business: write the name and the list down this week, even if the list is short. Do I need an AI policy explains when that list becomes a policy, and the twelve-question check works through a single tool.
The bigger picture
All three items share a pattern. Dates and defaults are set by regulators and vendors, and the responsibility for where information goes stays with the owner. A quiet week for new rules is a good week to work out which rules already apply to you, because 10 December does not move.
If you advise other businesses as a bookkeeper, accountant, broker or IT provider, expect clients to ask where their data now goes. Legal, accounting and management services recorded 81 notifiable data breaches in 2025 according to the OAIC's figures, so advisers hold the kind of information that gets targeted. What this means for your business: pick one client conversation to have this month about where their information goes, and use every Australian AI framework as the map of what applies.
This is general information, not legal advice.
That is the week. If one thing in here applies to you, the reference pages say which rule it falls under and link the source, so you can act on it or hand it to your adviser.
Where is AI already touching your client information?
Ten yes or no questions, about two minutes, no login. Every yes is a place AI is already touching client, patient or customer information, and the result points you to the page that answers it.
Take the AI Exposure CheckMore on this: the reference pages · the Limitless AI Framework · something else in mind
See you next Monday.
Ashley
General information for Australian small to medium businesses, not legal advice. Sources are linked in the text.
