About AI Framework

AI is supposed to make business easier.

AI brings plenty of useful things to a business. It also brings updated privacy obligations that most businesses aren't ready for - and that's not their fault.

More than four in ten Australian SMEs are now using AI. Most of them have no structured governance around it. Many don't even think of what they're doing as “AI adoption.” The ABS says 12% of businesses formally report using AI. The real number is more than three times that. Many businesses don't realise they're using AI - they're using ChatGPT the way they used to use Google. Drafting an email, looking something up, summarising a document. It doesn't feel like something that needs governing. Except it does.

Where AI touches personal information, or feeds into a decision that could significantly affect someone, existing privacy obligations apply. A property manager pasting tenant details into ChatGPT to draft a breach notice. A recruitment platform auto-scoring candidates nobody asked it to rank. A practice management system that started triaging appointments after a software update. None of that was a decision anyone in the business made - but it's all personal information being handled by AI, and privacy obligations cover it.

A surgeon I spoke to recently told me that so much of what they're doing now is interacting with AI. Not a tech founder. A surgeon. It's everywhere, across every profession, in ways people aren't even registering.

Adoption is running well ahead of governance. That's the gap this product helps with.

The framework that needs to come off the shelf

The government has produced a solid framework for AI governance. The National AI Centre published its Guidance for AI Adoption in October 2025, built around six essential practices they call the AI6 - accountability, impact assessment, risk management, transparency, testing and monitoring, human oversight. It's good work.

Unfortunately, it's generic. It tells you what good AI governance looks like in the abstract. It doesn't tell you which legislation applies to your specific business, in your state, in your industry, at your size. And it can't - it's guidance for the whole country, not a tool for a specific business.

That's why we built AI Framework.

You answer a profiling questionnaire - industry, state, size, turnover, how you're using AI, what data you're handling - and we map the relevant Commonwealth and state legislation to your situation. Then we structure an AI governance framework around those six AI6 practices, tailored to what actually applies to you.

The first two practices come back free. The complete AI governance framework is $88 including GST, one-time. No subscription.

The gap between $88 and an expensive consulting engagement

Governance consulting takes weeks and costs thousands. That's fine if you're a large organisation with complex systems. But there are 2.8 million actively trading businesses in Australia, and 97% of them are not big. They're already drowning in red tape - $5.5 billion in compliance costs added over the last five financial years, and 53% of businesses saying the burden is too high. They don't have the time or the budget for another one.

Free templates exist, but they're generic - they can't map legislation to your specific industry, state or size. You can spend a weekend filling one in and still not know what actually applies to your business.

This product sits in the gap between the consulting engagement you can't afford and the template that doesn't actually cover you.

Why now

There's a deadline. On 10 December 2026, automated decision-making disclosure requirements begin under the Australian Privacy Principles. Businesses using AI in ways that could significantly affect someone's rights or interests will need to disclose that in their privacy policy. Most don't know it's coming.

APP 1.7 is good policy. Everyone should feel comfortable knowing what AI knows about them and how it's being used to make decisions that affect them.

Enforcement is real. The first civil penalties under the Privacy Act have already landed - millions of dollars. The OAIC ran its first compliance sweep in January 2026, examining businesses across six sectors. Since June 2025, individuals can also sue businesses directly for serious privacy breaches - enforcement is no longer limited to the regulator.

These businesses aren't negligent - they're stretched, and nobody told them what an AI governance framework should look like.

That's why we built this. Not because governance is exciting. Because ticking this box shouldn't cost thousands and take weeks.

Get started at aiframework.com.au.

This post is general information, not legal advice.
Current as at September 2026.

Contact

Kentron Pty Ltd · ABN 31 123 944 927 · contact@aiframework.com.au