Most owners wouldn't hand a new hire the keys to every filing cabinet, the shared inbox and the bank login on day one. Australia's cyber security agency, working with its overseas counterparts, recommends a similar mindset for AI agents: start small, and widen access only as trust builds.
An AI agent is different from a chatbot that drafts an email for you to send. According to the Australian Cyber Security Centre (ACSC), part of the Australian Signals Directorate, agentic AI connects to software systems and can reason, plan and take actions without a person approving each step.
Not many small businesses are there yet. The National AI Centre's SME AI Pulse, a monthly survey run by Fifth Quadrant, found that 43% of Australian SMEs reported some level of AI adoption between December 2025 and February 2026. Content generation and data analytics led the way, each used by 54% of businesses using or planning to use AI. More complex uses, agentic AI among them, remain largely untapped, the centre said. Among SMEs not planning to adopt AI, around 65% cited distrust in AI decision making or a strong preference to keep human control of their processes.
Other surveys paint a busier picture. Dynamic Business reported in April that a Deloitte Access Economics survey of more than 1,000 Australian SMBs found about two thirds were using AI, though only 5% were fully enabled to benefit from it. The surveys ask different questions of different groups, so the numbers won't line up neatly.
Start With Less Access
On 1 May, the ACSC published joint guidance with agencies from the United States, Canada, New Zealand and the United Kingdom, titled Careful Adoption of Agentic AI Services. It is aimed at government, critical infrastructure and industry rather than small business specifically, and parts of it are highly technical. The access advice is easy to follow,though. The agencies recommend adopting agentic AI with security in mind and "never granting it broad or unrestricted access, especially to sensitive data or critical systems". They also say to use it only for low risk tasks that don't involve sensitive data.
The guidance gives two examples of access that is too broad: a calendar bot that can see all meeting data instead of just the requesting user's, and an email assistant that can write to any inbox. It suggests rolling agents out in stages, starting with clearly defined low risk tasks and expanding only after checking how they behave.
A verification company, Sumsub, announced a product aimed at this problem on 20 October. Its KYA Module for MCP sits between an agent and the company data it connects to, and the company says it screens each request and strips out personal information before the agent sees it. Sumsub's AI advocate, Mick Amelishko, described AI agents as becoming "the connective tissue between people and their data" and said that convenience shouldn't come at the cost of control. The launch is built around technical gateways, starting with Amazon Bedrock AgentCore Gateway, and the announcement doesn't mention pricing or Australian availability.
Vendors are moving because of numbers like these. The Cloud Security Alliance, in a survey commissioned by AI agent security company Token Security, found that 65% of 418 IT and security professionals reported at least one incident involving an AI agent in the past year. Data exposure (61%) and operational disruption (43%) were among the impacts. The sponsor sells security for AI agents, so it's one data point.
Name Someone Responsible
The National AI Centre's Guidance for AI Adoption: Foundations, released in October 2025, condenses responsible AI into six practices. The first is deciding who is accountable. For businesses just starting out, its Foundations version recommends naming a senior leader as the overall AI governance owner and writing a short AI policy. After that, every AI system the business uses gets a specific person accountable for it
It also asks businesses to keep an AI register listing each system and how it's used, including AI built into other tools such as HR and customer engagement software. Where a vendor, a developer and an integrator are all involved, the guidance says to make clear who is responsible for which part, so you know who to call when something breaks.
Keep a Human in Reach
The sixth practice is maintaining human control. Oversight should match how much autonomy the system has and how high the stakes are. That could mean automated monitoring for low stakes uses and mandatory human review for high stakes decisions. The guidance also asks for clear points where a person can pause, override, roll back or shut the system down, and for a way to keep critical functions running if the AI malfunctions.
Its risk section gives a simple illustration. A chatbot answering basic questions during business hours, while a staff member can monitor it, is a low risk use. The risk grows if it runs around the clock without oversight and takes on harder questions.
The cyber agencies add that the people running the system, not the agent itself, should decide when human approval is required. Their examples of actions worth a person's sign off include deleting critical records, and they recommend holding any request to delete logs until someone approves it. Sumsub's announcement describes a similar trigger, an agent trying to approve an invoice above a set limit, which prompts a live check that a real, authorised person is behind the request. The ACSC's separate advice on Using AI securely in your business (as well as its guide on Artificial intelligence for small business) says to keep a person involved in decisions in high stakes or sensitive operations.
Mind the Customer Data
The Office of the Australian Information Commissioner (OAIC) says privacy obligations apply to any personal information entered into an AI system, and to AI output that contains personal information. In its October 2024 Guidance on privacy and the use of commercially available AI products, it recommends as best practice not entering personal information, particularly sensitive information, into publicly available generative AI tools. It also says AI products "should not be used simply because they are available," and advises a privacy impact assessment before adopting them.
The ACSC's small business guidance covers the practical side. It suggests an internal AI use policy that spells out what data can't be uploaded, and checking each vendor's terms to see whether your data may be used to train their models. It also advises removing or anonymising personal details before using an AI tool.
Customers are part of this too. The National AI Centre's survey found that about half of businesses using AI check outputs before they reach customers. Telling customers about AI use and offering a way to raise concerns lag well behind. The Foundations guidance says to disclose AI use clearly, especially when it influences decisions or could be mistaken for a person.
The National AI Centre publishes an AI policy template, an AI register template and a screening tool alongside its guidance. The ACSC's small business page carries a nine point checklist for vetting AI tools.