Two in Three Australian Businesses Have Unauthorised AI Use

Two-thirds of Australian businesses have employees using AI tools without formal approval. Not hypothetically — right now. SAP's Value of AI report, developed with Oxford Economics across 200 Australian executives, found 69 per cent of organisations report staff using unauthorised AI tools at least occasionally. Only 38 per cent have a designated leader responsible for AI adoption.

This isn't a technology failure. It's a governance vacuum. And it's been sitting open long enough that the federal government built a free fix.

Shadow AI is any AI tool an employee uses without organisational approval — ChatGPT on a personal login, a free transcription app, an image generator processing client photos. A Journal of Accountancy survey found 59 per cent of workers use unapproved AI tools at work. Ninety-three per cent of executives and senior managers do it too. Three-quarters admit to pasting sensitive business data into these tools — employee details, customer information, internal documents.

For a trades business, that's a scheduler dumping the client database into ChatGPT to help with rostering. For an accounting firm, it's a graduate pasting financial statements into an AI summariser to save time on working papers. The intent isn't malicious. The exposure is real.

IBM's 2025 Cost of Data Breach Report quantified the damage: breaches involving shadow AI cost organisations US$4.63 million on average — US$670,000 more than standard incidents. Shadow AI now accounts for 20 per cent of all breaches, and 65 per cent of those involve compromised customer data. For an SME, the absolute dollar figure is smaller, but the ratio of damage to revenue is worse.

Deloitte's State of AI in the Enterprise 2026 report surveyed more than 3,000 C-suite leaders globally and found only 22 per cent of Australian companies have what they'd call a highly advanced governance model for AI. Meanwhile, 69 per cent are already deploying agentic AI — systems that take autonomous action, not just answer questions. The gap between capability and control is accelerating.

SAP's data shows the structural problem: just 22 per cent of Australian organisations have board-level sponsorship of AI initiatives, and the same proportion offer incentives for leaders to drive adoption. For most smaller businesses — without boards or chief technology officers — nobody owns AI governance. It sits in the gap between operations and IT and everyone assumes someone else is handling it.

On 11 May, the National AI Centre launched AI.gov.au — a central platform built specifically for SMEs navigating AI adoption. Among its resources: a free, 12-page AI policy template that gives any business a credible governance baseline without hiring a consultant or commissioning a custom framework.

The template covers seven principles: ethical use, clear accountability, risk assessment before deployment, quality and security standards, fairness protections, transparency (including maintaining an AI register), and human oversight for critical decisions. It comes with a companion screening tool for evaluating new AI use cases and a register template for tracking what AI your business actually uses.

The National AI Centre also published six practices for responsible AI governance: decide who is accountable, understand impacts, measure and manage risks, share essential information, test and monitor, and maintain human control. None of this requires a technology background. A business owner can download the template, customise it in an afternoon, and have something in place by the end of the week.

First: download the AI policy template from AI.gov.au and adapt it to your business. Even a basic version is better than nothing — IBM's data shows 63 per cent of organisations that experienced AI breaches had no governance policy at all. Second: ask your team what AI tools they're already using. Not as a crackdown — as a genuine inventory. You'll likely find tools that are useful and should be formally adopted. Third: pick one person who owns AI governance going forward. In a five-person trades business, that might be you. In a twenty-person accounting practice, it might be your operations manager. The point is someone's name is next to it.

The businesses that get value from AI aren't the ones with the most tools. They're the ones that know what tools are in use, who's using them, and what data goes where. That's not sophistication. It's basic operational hygiene — and now there's a free government template to get you there.

Key takeaways

Not sure where your AI governance stands?

A 30-minute call can identify the gaps between what your team is already doing with AI and what needs a policy around it. Book a call to get clarity.