MIT put ethics last. I'd put it first.

Depending on who you ask, either 11% of Australian small businesses use AI or two-thirds do. Both figures are correct, and most businesses sit somewhere between them.

Over the past 8 weeks, I completed MIT Professional Education’s Applied Agentic AI for Organisational Transformation, all while on the other side of the world. I spent part of the journey with my family in Germany, and also enjoyed a few days in Italy with my husband. We can never get enough of Italy! I submitted three assignments during the trip, some while travelling by train to and from Italy, and the last one from the plane, thanks to Starlink on the Qatar flight.

AI was a true partner during those eight weeks. I used it to explore beyond the course material. When we got to vibe coding, building a tool by describing what you want in plain English instead of writing code, I was already comfortable. I’ve built a few dashboards like that before, and I’m working on some software now.

Later, I’ll explain why most people using AI aren’t really saving time, and share the five-minute change I’d make if I were you. I’ll also mention Australia’s biggest bank and a Big Four consulting firm.

Everyone says they’re using AI. Very few are getting time back.

At a recent conference in Sydney, the message on stage matched what I see with my clients: very few businesses use AI well, and even fewer actually save time with it.

That’s what the 11% and the two-thirds are really telling us. The Australian Bureau of Statistics counted around 11% of small and micro businesses using AI in 2024-25. Deloitte Access Economics counted about two-thirds, because its figure includes owners who open a chatbot now and then. Under that headline, Deloitte found that only 5% of businesses using AI were set up to get real benefits.

Trying AI is easy. Actually saving time is another matter. The research group METR found that experienced software developers took 19% longer with AI, even though they later thought they were about 20% faster. Researchers at Stanford and BetterUp call this problem ‘workslop’, AI work that looks finished but isn’t. In their survey, four in ten workers had dealt with workslop in the past month, and each piece took almost two hours to fix.

If that sounds like your week with AI, the tool itself usually isn’t the problem. I wrote in July that AI is the most capable stranger you’ll ever meet. If you ask a stranger to write in your voice, you’ll end up spending the time you saved editing it to sound like you.

It’s easy to spend all the time AI saves you just fixing what it didn’t know about you.

That’s the first gap. The second gap is already inside your business.

The AI that isn’t on the org chart

Most businesses haven’t asked who’s in charge of the work, because AI is already part of their operations. It just doesn’t show up on the org chart.

If you have a team, someone is probably using AI right now, maybe your VA drafts client emails in a free ChatGPT account, or a junior figured out a chatbot writes proposals faster than she can. If you work alone, your shadow AI might be the free account you signed up for in 2023 and haven’t used since.

There’s a good chance nobody has told you about it. Research from the University of Melbourne and KPMG found that 60% of Australian workers in the study hid their AI use at work. Almost half of those broke company policy, sometimes by putting sensitive company information into free public tools.

MIT researchers call this the shadow AI economy.

The riskiest AI in your business is usually the one nobody chose.

Why small businesses get to go first

Some of the MIT material was already out of date by the time I read it, since AI moves faster than any curriculum can keep up. The principles still applied, and the most exciting one for small business wasn’t about technology, it was about who gets to win.

Big companies run the most AI pilots but turn the fewest into lasting changes. MIT’s research found that mid-sized businesses moved from pilot to everyday use in about 90 days, while large enterprises took nine months or longer.

Now imagine a business with twelve people, or just a founder and a VA. There’s no steering committee or long rollout plan. You can make a decision on Tuesday and be working differently by Friday. For once, being small is an advantage.

The downside is that moving quickly can also leave you exposed. Big organisations have compliance teams and lawyers. You have yourself and whatever your IT person set up three years ago. That’s why I’d start where MIT finished.

Why I’d put ethics first

MIT put ethics in the eighth and final module on purpose, as a way to review every decision made earlier. That makes sense in a classroom. But in a business where you’re also the compliance department, I’d do it differently.

If trust is what’s been holding you back from AI, you’re in good company. The National AI Centre’s tracking found it’s the biggest reason Australian small and medium businesses hesitate. Putting guardrails in place first makes AI safe enough to trust.

My capstone project made this real for me. I used my husband’s business as the case study, and I’m excited to share what we did. In his business, ethics and safety come first, so we’re working on a safe-use AI policy before trying any AI tools.

Here’s the order I’d follow, step by step, in any business, even if it’s just one person.

Nine moves to make before AI goes anywhere near your clients

Most of these steps take less than an hour. One only takes five minutes.

1. Find out who’s already using AI for your business. Ask your VA and anyone else who works with clients which AI tools they use and whose account they use. If you have a bigger team, use an anonymous survey to get honest answers. This is always my first step with businesses before choosing any new tools.

Do it this week: send one message. “Which AI tools do you use when you’re working on my business, and on which account?”

2. Write your AI rules on one page. Banning AI usually just stops people from telling you about it. One page is enough: list approved tools and accounts, and what should never go in, like client details, passwords, credit card details or confidential info. Make sure work stays on business accounts you own. That way, if your VA leaves, the chats and everything she built stay with you, not in her personal login.

Do it this week: download the free AI policy template in the National AI Centre’s Guidance for AI Adoption and cut it back to one page.

3. Start with the boring jobs. Begin with work only you will see, like drafts or admin tasks that take up your Monday. Customer-facing bots should come last. Australia’s biggest bank tried it the other way last year: CBA replaced 45 customer service roles with an AI voice bot, but the calls kept coming until team leaders had to get back on the phones. Within weeks, the bank apologised and reversed the decision. Treat AI like a new hire, start with small jobs and give it more responsibility once it earns your trust.

Do it this week: pick one internal task that eats an hour a week and hand it to AI. Nothing a client will see.

4. Flip one switch tonight. Most AI tools learn from your conversations unless you turn this off. In ChatGPT, look for “Improve the model for everyone” under Settings, then Data controls. In Claude, it’s under Settings, then Privacy. Turn this setting off on every account that handles client work. Also, check what each tool is connected to, like your inbox or drive, and only give it the access it needs. Paid business plans usually keep your content out of training by default, which is another reason to move off free accounts.

Do it tonight: five minutes, every account.

5. Mark 10 December in your diary. From that date, businesses covered by the Privacy Act must state in their privacy policy when software makes or helps make decisions using personal information that could significantly affect someone. If your turnover is $3 million or less, you’re usually exempt, unless you provide a health service, which is covered no matter your size. Even if this doesn’t apply to you yet, it shows where the rules are heading and is a good reminder to check where your AI tools store client data.

Do it this week: if you’re over $3 million or in health, book a quick call with your lawyer.

6. A human should read everything before it goes out. AI can make things up and do it confidently. Deloitte Australia learned this the hard way last year when it had to partially refund the federal government for a $440,000 report that cited academic papers that didn’t exist and included a made-up quote from a Federal Court judgment. In my business, every newsletter draft my AI writes goes into Notion for review, and I read and correct each one before my VA schedules it.

If this can happen to a Big Four firm, it can happen to your proposal on a Thursday afternoon.

Do it this week: make it a house rule that AI drafts and a human sends.

7. New and sexy. Just because something is new and exciting doesn’t mean it’s safe. Every week, a new agent promises to run your inbox or browse the web for you. Some are great, but many aren’t ready for client data. Let others find the bugs first. Before you connect anything new, ask yourself: if this went wrong at 2am, what could it send or delete? Nothing new gets access to your email or client files until you can answer that question.

8. Measure your results, or it’s just a guess. Remember those developers who thought they were faster but were actually slower? Before you give a task to AI, write down how long it takes you now, then check again in 90 days. If it’s not saving you time, the old way is fine, and that’s a good answer.

Do it this week: time the task you picked in move 3.

9. A human should always make decisions about people. AI learns from past data, including its blind spots. Amazon dropped an AI recruiting tool in 2018 after it started marking down CVs with the word “women’s”. If you use AI to shortlist a VA or rank enquiries, let it sort the pile, but make the final decision yourself. Here’s a good test from the course: would you be comfortable explaining this decision on the front page of the paper?

Do it this week: if AI touches any decision about a person in your business, add a human sign-off.

The human still signs off

I’m more excited about what AI will do in the next twelve months than I have been about anything in a long time. This year, it reorganised an entire course for me and worked alongside me during eight weeks at MIT. The businesses that succeed with AI will be the ones that use it intentionally, with a person still making the final decisions.

I always build things in the same order. The human leads, the system supports, and the system only gets more responsibility once it proves it can handle it. If you run a team, I now apply this to established businesses through AI by Design, starting with that anonymous survey and ending with a roadmap the business owns outright. If it’s just you, or you and a VA, start with move 4 tonight, it only takes five minutes. If you want your AI to stop feeling like a stranger, that’s what Claude by Design is for. It’s a hands-on workshop where we set up Claude with the foundation files that teach it who you are, who you serve, and how you sound. The next session is online on 4 November, with an in-person session in Glenelg on 16 November.

So here’s the question I brought home, and I’m leaving it with you.

Do you really know where AI is already working, in your business, and who is checking what it sends out?