The legal reality for small businesses using AI
Small business owners using AI often assume that compliance obligations are for big companies with legal teams. This is wrong in two ways. First, the law does not make size-based exemptions for most AI governance obligations — the Privacy Act in Australia, GDPR in the EU, and consumer protection law everywhere applies to small businesses using AI in the same way it applies to large enterprises. Second, small businesses are often more exposed, not less, because they lack the governance infrastructure to detect and respond to AI-related problems before they become regulatory or legal issues.
The good news: the compliance burden for a small business using AI appropriately is actually quite low. The core obligations are: know what AI tools you use and what they do with your data, do not make claims about AI capabilities you cannot substantiate, do not use AI in hiring or credit decisions without understanding the discrimination law implications, and have a basic privacy notice that accurately describes your AI use. This is a few hours of work, not a compliance programme.
The data handling test
The single most important question for any AI tool used in a small business is: does this tool train on my data? If the answer is yes, and you are using any customer information in the tool, you have a potential privacy law problem — the customer did not consent to their data being used to train an AI model. For Australian businesses, this applies to businesses with turnover above $3M and all health service providers. For businesses with EU customers, GDPR applies regardless of size. For UK customers, UK GDPR applies.
Checking the data handling terms: look for the tool's Privacy Policy and Terms of Service. Search specifically for terms like "train", "improve our models", "machine learning", "use your content". If you find language indicating the tool uses your inputs to train or improve its AI, assume your data is being used for training unless you have opted out or upgraded to a business plan that excludes training. Most paid business tiers of major AI tools — ChatGPT Team, Claude Pro for Business, Google Workspace AI — can be configured to exclude your data from training. The free consumer tiers generally cannot.
