07 3114 280807 3180 0965Chip, AI agenthelpdesk@realbytes.com.auLive service status
Worked with us? Leave a review:Google ReviewCloudTango Review
Remote SupportStoreContact
Talk to an engineer07 3114 2808CallContact

AI governance guide

Guidance for AI Adoption: the six practices, in plain English

Chances are your staff already use AI, and some of it touches client information. The six practices from the National AI Centre keep that safe without banning the tools. The guidance is voluntary. Privacy law is not.

Checked 10 November 2026.Written by the Real Bytes engineering team

Get an AI starter quoteRun the starter check
Three colleagues at a meeting table, one pointing to a printed document while another works on a laptop showing charts.
Published by
National AI Centre (DISR)
Released
21 October 2025
Replaces
Voluntary AI Safety Standard
Structure
6 practices, 2 versions
Status
Voluntary. Existing laws apply
Templates
Policy, register, screening tool. Free

In short

  • Six practices replaced ten guardrails. Work done on the old standard carries across.
  • It is voluntary for ordinary businesses. Privacy and consumer law already apply to AI.
  • The mandatory measures announced so far target data centres, AI training and frontier AI companies.
  • Start with a named owner, a one-page AI policy and a register of the AI already in use.
  • Keep personal and client information out of public AI tools. That is the OAIC's advice.

What Australian SMEs that use AI use it for

Share of SMEs currently using or planning to use AI, December 2025 to February 2026.

Content generation54%
Data analytics54%
Cyber security and threat detection48%
Show as a table
What Australian SMEs that use AI use it for
ItemValue
Content generation54%
Data analytics54%
Cyber security and threat detection48%

The risk today: client data in free AI accounts

The Office of the Australian Information Commissioner says privacy obligations apply to personal information you put into an AI system, and to any AI output that contains personal information. Its best practice advice is not to enter personal information, and especially sensitive information, into publicly available AI tools.7

Whether the Privacy Act applies to a particular business depends on its turnover and the work it does, so check the OAIC's guidance for your situation. Even where it does not apply, treating client information this way is good practice.

The rule to write down this week

Client and staff personal information only goes into AI tools the business has approved, signed in with work accounts. Free personal accounts are off limits for work data.

An example AI register. The last row is the one that keeps privacy officers up at night.

What the Guidance for AI Adoption is

Six practices for using and building AI responsibly, in two versions for different starting points.

The Guidance for AI Adoption is the National AI Centre's set of six essential practices. It updates the Voluntary AI Safety Standard from September 2024, condensing ten guardrails into six practices and widening the audience from businesses that use AI to those that build it as well.139

Free templates sit alongside it: an AI policy template, an AI register template and an AI screening tool. For a small business those three documents are most of the work.1

Which version is yours?

If your staff use Copilot, ChatGPT and the AI built into your other software, and you have no AI policy yet, start with Foundations.

Foundations

Written for
Organisations starting out or using AI in low-risk ways
Typical user
A business using off-the-shelf AI tools
Where to begin
Owner, policy, register

Implementation guidance

Written for
Mature governance, technical teams or higher-risk uses
Typical user
A business that builds or customises AI
Where to begin
The detailed practices and the crosswalk

Many small businesses use AI. Fewer govern it.

The National AI Centre's monthly SME AI Pulse found 43 percent of Australian SMEs reported some AI adoption between December 2025 and February 2026. About half of those using AI check its output before it affects customers. Telling customers when AI is used, and giving them a way to raise concerns, lagged well behind.8

That gap is what the six practices are for. Using AI is now ordinary. Knowing which tools are in use, who owns them and what happens when one gets something wrong is where most businesses have work to do.

43%of Australian SMEs report some AI adoption
About halfof AI users check output before it reaches customers

Why non-adopters hold back

Share of SMEs not using AI that gave each reason.

Trust65%
Not relevant to the business54%
Show as a table
Why non-adopters hold back
ItemValue
Trust65%
Not relevant to the business54%

The six practices, and the small business version of each

The practice names are the National AI Centre's. Scroll through each one: what Foundations asks, and how it looks in a business of 10 to 100 people.

  1. A senior leader owns AI governance, there is an AI policy, each AI system has a named owner, and roles with vendors are clear.

Step 1 of 6. Keep scrolling to move through each step.

1. Decide who is accountable
2. Understand impacts and plan accordingly
3. Measure and manage risks
4. Share essential information
5. Test and monitor
6. Maintain human control

The small business version of practice 1

The owner signs a one-page AI use policy and names who looks after each tool.

What is voluntary, what is law, and what is coming

For a business using AI tools rather than building frontier models, the rules that bind you today are the ones you already know: the Privacy Act, consumer law and your industry regulator. The National AI Plan relies on those laws and on regulators managing AI harms in their own sectors.4

The July 2026 Australian Standards for AI focus on large data centres, AI training and protecting creative work. The November 2026 announcement targets frontier AI companies and a new regulator able to issue significant penalties, with detail to follow after consultation.56

Check again before relying on this

The July and November 2026 measures are still being designed. We check the official releases each time we update this page.

  1. Voluntary AI Safety Standard published

    Ten guardrails for organisations using AI.

    Voluntary
  2. Guidance for AI Adoption replaces it

    Six practices, in Foundations and Implementation versions.

    Voluntary
  3. National AI Plan released

    Existing laws stay the foundation. Regulators manage AI harms in their sectors.

    All businesses, via existing law
  4. Australian Standards for AI announced

    Large data centres, AI training and creative works, plus an Office of AI. Legislation expected early 2027.

    Data centres and AI developers
  5. Frontier AI protections announced

    Mandatory safety and security protections and a new AI safety regulator.

    Frontier AI companies

Where AI governance usually goes wrong

  • A policy nobody owns

    The document exists but no senior person is accountable, so it never changes when the tools do.

  • A register that misses built-in AI

    Teams list the chatbot and forget the AI inside their CRM, email, meeting and accounting tools.

  • Client data in free tools

    Staff use personal accounts on public AI tools, against the OAIC's best practice advice.

  • Vendor claims treated as testing

    A supplier's marketing page is not evidence. Try it on your own data.

  • No plan for when the AI is down

    If a process depends on an AI tool, someone needs to know how to do the job without it.

How we set it up for clients, and what it costs

After the first pass, staff know which AI tools are allowed and what never goes into them, every tool is on one list, and client data stays in approved tools.

  1. Find the AI already in use

    We list the AI apps connected to your Microsoft 365 tenant and the AI features switched on in tools you already pay for, then ask staff what else they use.

  2. Write the one-page policy

    We start from your existing policies and the free government template. Our shadow AI policy generator gives you a first draft.

  3. Set up the register and the screen

    A register you can keep current, and a short screen for any new tool.

  4. Put data controls behind the policy

    Data loss prevention and sensitivity labels in Microsoft 365 keep client information inside approved tools.

  5. Keep a person in charge

    The same rule we apply to our own AI agents. A person approves anything that changes your environment.

Your three routes
RouteWhat it costsWhat you get
Do it yourselfFree templates, your team's timeThe National AI Centre's policy, register and screening templates, plus our shadow AI policy generator
With Real BytesQuoted for your business before we startThe AI in use found, a signed policy, a register and data controls in Microsoft 365
Do nothingClient data in tools nobody approvedPrivacy obligations still apply to anything staff paste into AI

Real Bytes holds CyberCert SMB1001 Gold and is an ACSC Network Partner.

Check your starting point

0 of 6 practices in place

Not yet in place

  • Name an owner and sign a one-page AI policy. Practice 1.
  • Write down who your AI affects and how they can ask for a person. Practice 2.
  • Add a short screen before any new AI tool. Practice 3.
  • Start an AI register, including AI built into your software. Practice 4.
  • Ask suppliers for testing evidence and trial tools on your own data. Practice 5.
  • Name who can switch each tool off, and write the fallback. Practice 6.

You have 6 gaps. Send us this list and we will tell you which to close first and what it involves.

Get my AI gaps reviewed

Questions about the Guidance for AI Adoption

Is the Guidance for AI Adoption mandatory?

No, not for a typical Australian business. It is guidance from the National AI Centre. The National AI Plan keeps existing laws as the foundation, so the Privacy Act, consumer law and your sector regulator already apply to how you use AI. The mandatory measures announced so far in 2026 are aimed at large data centres, AI training and frontier AI companies.

What happened to the Voluntary AI Safety Standard?

It was updated. The Voluntary AI Safety Standard came out in September 2024 with ten guardrails. In October 2025 the National AI Centre published the Guidance for AI Adoption, which condenses those guardrails into six practices and widens the audience to AI developers. Work you did against the ten guardrails still counts.

Should we use Foundations or the Implementation guidance?

Start with Foundations if you use off-the-shelf AI tools and have not set up AI governance yet. Move to the Implementation guidance if you build or customise AI, have mature governance already, or use AI for higher-risk decisions such as people's money, health or employment.

We only use Copilot and ChatGPT. Does this apply to us?

Yes. The most useful parts for a small business are a named owner, a short AI use policy, a register of the AI tools staff use, and a rule that personal or client information does not go into tools you have not approved.

Some people call it AI6. Is that the same thing?

Yes. AI6 is shorthand some advisers use for the six essential practices. The official name is the Guidance for AI Adoption.

Does SMB1001 cover AI?

Yes. SMB1001 Gold has required a responsible AI use policy since the 2026 edition, and the 2027 edition adds an AI governance framework at Platinum. Doing the Foundations practices well gives you most of the evidence for both.

Where are the government templates?

The National AI Centre publishes an AI policy template, an AI register template and an AI screening tool alongside the guidance on ai.gov.au. They are free.

Use AI and keep your clients' trust.

Tell us which AI tools your team uses. We will tell you which practice to start with, in plain English.

Get an AI starter quote 07 3114 2808

Sources

See all 9 sourcesChecked 10 November 2026. The small numbers in the page link here.
  1. National AI Centre, Guidance for AI Adoption: Foundations (PDF). ai.gov.au
  2. National AI Centre, Guidance for AI Adoption: Implementation guidance. ai.gov.au
  3. Voluntary AI Safety Standard. industry.gov.au, September 2024
  4. National AI Plan: Keep Australians safe. industry.gov.au, December 2025
  5. Prime Minister, AI in Australia's interests. pm.gov.au, 15 July 2026
  6. Prime Minister, New Australian AI safety and security protections. pm.gov.au, 10 November 2026
  7. OAIC, Guidance on privacy and the use of commercially available AI products. oaic.gov.au
  8. National AI Centre, AI adoption insights: December 2025 to February 2026. ai.gov.au, SME AI Pulse by Fifth Quadrant, minimum 400 SMEs
  9. Allens, Governance doesn't stand still: 9 FAQs on the Guidance for AI Adoption. allens.com.au, November 2025