Privacy Act Small-Business Exemption Ending: AI Impact

Posted: 9 June 2026 · Category: Legal, Compliance & HR

If your business turns over $3 million or less, you've almost certainly never had to think hard about the Privacy Act. That's about to change — and the timing matters, because the same businesses getting pulled under the Act are the ones now feeding customer data into AI tools.

What's changing

Since 1988, the Privacy Act has exempted "small business operators" — broadly, those with annual turnover of $3 million or less — from its obligations. That exemption has been on the reform agenda for years, and the current direction of travel is its removal, bringing millions of small businesses under the Act for the first time.

A precise word of caution: as of mid-2026 the exact commencement is still subject to legislation. Treat the end of the exemption as scheduled and on track, not as enacted — the date could move. What is firmer is a parallel change: from 1 July 2026, an expansion of anti-money-laundering (AML/CTF) obligations pulls an estimated 100,000+ additional businesses — including real estate agents, lawyers and accountants ("tranche two" professions) — into a separate compliance regime regardless of the privacy timeline.

The AI angle is the part most relevant to readers here. The reforms also introduce rules on automated decision-making: where an AI system makes or substantially helps make a decision that significantly affects someone, businesses will be expected to give people "meaningful information" about how those decisions are made.

What it means for Australian businesses

In plain terms: if you use AI to screen job applicants, score customers, decide who gets a quote or an offer, or process personal information at scale, the days of "the small-business exemption covers us" are numbered. The Office of the Australian Information Commissioner (OAIC) has already published guidance on using commercially available AI products — and it's pointed: businesses remain responsible for personal information they put into a third-party AI tool, including checking where that data goes and whether the tool trains on it.

This connects directly to a theme running through our reviews. When we score a tool's Australian Fit, "where does your data live, and does it train on your inputs?" isn't a nice-to-have — it's a compliance question. A free AI tool that trains on your inputs by default, hosts data offshore, and offers no Australian region is a very different proposition for a business that's now inside the Privacy Act.

What to do now

You don't need to panic, but you should get ahead of it:

Know what data your AI tools see. Make a short list of every AI tool touching customer or staff personal information.
Check the data terms. For each, confirm: does it train on your inputs (and can you turn that off)? Where is the data stored? Our reviews flag this for every tool — it's exactly why we weight Australian Fit the way we do.
Watch the automated-decision rules. If AI helps make decisions that affect people — hiring, credit, pricing — start documenting how, so you can explain it.
For regulated professions, mind 1 July. If you're in real estate, law or accounting, the AML expansion lands on a fixed date — that one isn't "scheduled," it's coming.

The bottom line

This is the biggest regulatory shift on the horizon for the small businesses we write for — and it lands at exactly the moment AI is becoming a normal part of how they operate. It isn't a reason to stop using AI. It's a reason to choose tools that already treat Australian data seriously, and to know what yours do with it. That's the entire point of how we score.

Frequently asked questions

What's changing?

The Privacy Act's small-business exemption — covering businesses under $3 million turnover since 1988 — is on track to be removed, bringing millions of small businesses under the Act for the first time. The reforms also introduce automated decision-making rules. Treat the exemption's end as scheduled, not yet enacted.

Does this affect Australian businesses using AI?

Yes. If you use AI to screen applicants, score customers, set quotes or process personal information at scale, "the exemption covers us" is numbered. Businesses stay responsible for personal information put into a third-party AI tool — including where the data goes and whether the tool trains on it.

What should I do now?

List every AI tool touching customer or staff data; check whether each trains on your inputs and where data is stored; document how AI helps make decisions affecting people. Regulated professions (real estate, law, accounting) should note the AML expansion on 1 July 2026 — that date is fixed. This is general information, not legal advice.

This is general information, not legal advice. For your obligations under the Privacy Act or AML/CTF rules, talk to a qualified professional.

Sources

Primary — Office of the Australian Information Commissioner, Guidance on privacy and the use of commercially available AI products, oaic.gov.au — checked 9 June 2026.
Primary — Office of the Australian Information Commissioner, media release on new AI guidance for business, oaic.gov.au/news — checked 9 June 2026.
Context — Australian Government privacy-reform materials on the small-business exemption and AML/CTF "tranche two" commencement (1 July 2026). The exemption-removal commencement is subject to legislation; confirm the current status before acting.

Status of the exemption removal is "scheduled / subject to legislation," not enacted — we will update this post as the position firms up.

The AI Directory Australia is independent. We review and score AI tools for Australian users — AUD pricing, AU availability, data residency, GST. We don't write ads; affiliate links are disclosed and sponsored content is labelled. Edited by Adam.

The small-business privacy exemption is ending — what it means if you use AI on customer data