Understanding AI risks 

Every software developer is different, with some investing heavily in security while others focus on fast releases to keep up with the market. 

Without proper due diligence, it’s difficult to know what risks you are introducing into your business.

 Solution: 
Treat AI-enabled software like any other business-critical investment. 

Understand: 

• Who is the provider and what is their backstory?
• How do they manage security?
• Where is your data stored? How are their AI features trained?
• What ongoing costs might you be exposed to?

A robust vendor assessment can help prevent some of the security, compliance and budget challenges that could become deeper issues later on. 

Establishing clear policies for AI use, and ensuring employees understand them, is critical for every business. 

This includes policies around:

• what information can be shared
• what constitutes confidential data
• which AI tools are approved for business use.

Training plays an important role, and technology controls provide valuable protection. 

Web filtering and data loss prevention tools can help create a safer environment where employees can benefit from AI without unknowingly exposing sensitive information.

Other tools might generate outputs that lack the quality or context you need, and this wastes time, creates frustration, and can damage your business’s reputation.

 Solution: 
Start with the business problem then select the technology. Evaluate AI solutions against clear criteria such as:

• functionality
• accuracy
• security
• ease of adoption
• fit for purpose.

Importantly, ensure there is an embedded process for critically reviewing outputs before they influence business decisions or go public. 

When people assume AI outputs are automatically correct and allow communications, analysis or decisions to proceed without review, the consequences can be significant.

 Solution: 
Make sure AI users know that AI makes mistakes and the harm it could cause the business if those mistakes aren’t caught. Train staff to treat AI like a capable junior team member. 

It is also important to define who:

• is responsible for using AI
• reviews its outputs
• remains accountable for the final outcome.

When there is clear ownership, AI can support decision making, but it does not replace essential human judgement.

Today's junior employees eventually become tomorrow's leaders, equipped with all the knowledge they gained from years at the coalface. 

These experiences help them develop judgement, communication skills, an understanding of the business, and industry expertise. Without this pipeline of talent, we are likely to see strong skills shortages in almost every sector in the decades to come.

 Solution: 
Continue investing in future talent while adapting training for an AI-enabled workplace. Employees entering the workforce today should learn both the fundamentals of their profession and how to work effectively with AI.

The ultimate combination is to cultivate experienced people who understand the work, know how to apply judgement, and can use AI to amplify their expertise.

 Privacy Act 

The Privacy Act sets out how organisations must handle personal information. When AI tools are used to process customer, employee or other sensitive information, those privacy obligations still apply.

If your AI tools handle personal information, you need to:

• Understand what information employees are entering into AI systems.
• Review where that information is stored and processed.
• Check whether the AI provider uses the information for training purposes.
• Assess whether sensitive customer or employee information should be entered into the tool at all.
• Establish clear policies for approved AI use.

 This means 

Before someone uploads a customer list, employee record or confidential document into an AI tool, you need to understand where that information is going, who can access it and how it will be used. 

If you don’t know, do not upload any information that could be considered sensitive or private.

 Copyright and intellectual property 

Copyright and intellectual property laws protect creative works and business assets. AI raises new considerations around both the use of other people's content and the ownership of AI-generated outputs.

When using AI-generated content you should:

• Understand what material was used to create the output.
• Review AI-generated content before publishing it.
• Apply critical judgement to important content.
• Consider ownership and commercial use rights.
• Establish guidelines for the use of AI-generated materials.

 This means 

Because copyright laws only relate to works produced by a human (not a robot), you can’t assume that all AI-generated content automatically belongs to you. If ownership matters, ensure you make a substantial contribution to the final output and review it carefully. 

You might also check with original source information to check for potential plagiarism and attribute sources where appropriate. If copyright is a particular concern, consider contacting a lawyer who specialises in copyright law.

 Employment and consumer law 

Businesses remain responsible for decisions that affect employees and customers, even when AI is used to inform those decisions.

When using AI in decisions affecting employees or customers, you need to:

• Deeply consider AI-generated recommendations before acting on them.
• Keep people accountable for final decisions.
• Monitor AI outputs for inaccurate, biased or misleading information.
• Verify information relating to pay, employment conditions, products and pricing.
• Document how AI is being used in key decision making processes.

 This means 

AI can assist with analysis and recommendations, but businesses will always be responsible for employment decisions, customer engagement, and the accuracy of the information they provide.