Last updated 30 September 2026
AI has moved quickly from experimentation into everyday business operations.
Teams are using AI to analyse customers, screen candidates, automate workflows, generate recommendations and build internal tools. Employees are also connecting AI tools to business systems and increasingly using AI to build software themselves.
The technology is moving quickly.
The governance around it often isn’t.
And 10 December 2026 puts a hard date on part of that problem.
December 10 changes the conversation
From 10 December 2026, amendments to Australia’s Privacy Act introduce new transparency obligations for APP entities where personal information is used by a computer program to make, or substantially assist with, a decision that could reasonably be expected to significantly affect an individual’s rights or interests.
For businesses within scope, this means knowing where automated decision-making is happening, what information is being used and how that activity is disclosed in their privacy policy.
The question isn’t simply: are we using AI? It’s: do we actually know where AI and automated decision-making are operating across our business?
For organisations covered by the Privacy Act, serious or repeated privacy interference can carry significant penalties, including a maximum penalty for companies of up to $50 million, three times the benefit obtained, or 30% of adjusted turnover during the relevant period, whichever is greater.
But compliance is only part of the problem. The commercial risk starts much earlier.
The cost of poor AI governance isn’t just a fine
An AI tool doesn’t need to trigger a regulatory investigation to create a business problem.
It can happen when an automated workflow sends the wrong information to a customer.
- When an AI-generated recommendation is based on incomplete data.
- When a pricing process produces an inconsistent outcome.
- When an employee builds a useful internal tool that suddenly becomes critical to the operation but nobody else knows how it works.
- Or when a business discovers it has multiple AI tools accessing customer or commercial data, without a clear view of who owns them or what they’re doing.
The consequences can creep up slowly:
- Lost revenue from poor customer decisions or missed opportunities
- Margin erosion from rework and manual checking
- Customer retention when decisions or interactions become inconsistent
- Operational drag when teams spend time fixing problems created by automation
- Slower growth because every new technology initiative creates more complexity
- Technology debt as experiments quietly become permanent systems
- Management overhead because leadership can’t easily see what technology is actually running the business
The risk isn’t simply that AI might go wrong.
It’s that the business becomes dependent on systems it doesn’t fully understand or control. That’s a growth problem.
The problem isn’t AI. It’s invisible AI.
This is where governance theory meets what is actually happening inside growing businesses.
A small team might have people experimenting with ChatGPT, Claude or AI coding tools.
As the business grows, AI spreads across sales, marketing, finance, operations, HR and customer service.
More people have access to more tools.
More systems become connected.
More employees start building their own workflows.
And eventually, the business can reach a point where nobody has a complete picture of what is actually running.
That’s where the risk starts.
Not necessarily bad AI.
Invisible AI.
Vibe coding is accelerating the problem
AI-assisted development has made it dramatically easier for non-developers to build applications, automations and internal tools.
That’s a huge opportunity for growing businesses.
It also creates a new governance challenge.
A useful internal tool can quickly become operationally important without going through the same architecture, security or data review as a traditional technology project.
It might connect to a CRM.
It might access customer information.
It might sit on top of financial or operational data.
It might even make recommendations or decisions that affect customers or employees.
And because it was built quickly, the business may not have a clear record of:
- what the tool does
- what data it accesses
- who owns it
- who can access it
- how it was tested
- what happens when it fails
- whether it should still be running
That’s the shadow technology problem and AI is making it easier to create.
The point isn’t that businesses should stop people experimenting.
It’s that experimentation needs a path to control when it becomes operational.
Confidence isn’t the same as control
This is where the conversation needs to move beyond: Are we using AI?
The more useful questions are:
- What AI are we using?
- What business data does it touch?
- Who is accountable for it?
- Has it been reviewed?
- What happens when it gets something wrong?
Australia’s Voluntary AI Safety Standard provides practical guidance around accountability, risk management, data governance, testing and monitoring. It doesn’t create new legal obligations, but it gives organisations a useful framework for thinking about responsible AI adoption.
For growing businesses, the goal isn’t to build a bureaucracy around every AI experiment.
It’s to create enough visibility and control to scale what works without accumulating technology debt and unmanaged risk.
What businesses should be doing now
The businesses that are better prepared for December 10 won’t necessarily be the ones with the most sophisticated AI stack.
They’ll be the ones that understand what they already have.
1. Map where AI is being used
Start with the obvious tools, ChatGPT, Claude, Copilot and AI-enabled SaaS. then look deeper at automations, internal tools, agents and applications built by employees.
2. Understand what data it touches
Identify which systems, customer information, employee information and commercially sensitive data are flowing into AI tools.
3. Establish ownership
Every material AI system should have someone accountable for how it is used, maintained and reviewed.
4. Separate experimentation from production
Not every AI experiment needs enterprise governance.
But once an experiment touches real customers, employees, financial information or core operations, the standard needs to change.
5. Build governance into adoption
The goal isn’t to create another approval process that slows the business down.
It’s to create enough structure that people can use AI faster and more safely.
The Kinstone view
AI governance shouldn’t be another layer of bureaucracy.
It should be part of the foundation that allows a business to scale AI properly.
Our 5Cs—Culture, Commercial value, Capability, Capacity and Commitment—provide a practical way to assess whether an organisation is ready to move from AI experimentation to meaningful business adoption. Governance and control sit across all five, helping the organisation scale AI responsibly.
Because the businesses that benefit most from AI won’t necessarily be the ones using the most tools.
They’ll be the ones that can connect people, process, data and technology well enough to know where AI creates value and where it creates unnecessary risk.
So ask three questions:
- What AI and automated decision-making are actually running in our business?
- What data and systems do they touch?
- If someone asked us to explain how one of those decisions was made, could we?
If the answer isn’t clear, that’s not necessarily a technology problem. It’s a visibility problem.
And visibility is the foundation of good governance.