Australia and New Zealand issue guidance on artificial intelligence and cyber security for small businesses

The Australian Signals Directorate’s Australian Cyber Security Centre, together with the New Zealand National Cyber Security Centre and the Council of Small Business Organisations Australia, published guidance for small and medium-sized businesses on using AI securely.

AI, or AI, refers to computer systems that can perform tasks such as writing text, analysing data, or responding to customer questions. Many small businesses now use cloud-based AI tools, including chatbots and content generators, because they are affordable and easy to access online.

While these tools can improve efficiency, the guidance warns that they also introduce cybersecurity and privacy risks. AI systems often require access to sensitive information, such as customer or financial data. If this data is shared without safeguards, it can be exposed or misused. In some cases, information entered into AI platforms may be stored or reused by providers, depending on their policies.

The document also highlights risks linked to unreliable AI outputs. AI systems can generate incorrect or misleading information or be manipulated through malicious inputs. Relying on these outputs without human checks can lead to poor decisions or legal and reputational harm.

Another concern is supply chain risk. Many AI services depend on third-party providers, meaning weaknesses in a vendor’s systems can affect businesses using their tools.

To manage these risks, the guidance recommends clear rules on what data can be shared with AI tools, staff training on responsible use, careful selection of vendors, and keeping humans involved in important decisions. The publication aims to help small businesses benefit from AI while avoiding avoidable cybersecurity and privacy problems.