What Are the Risks of Using AI in Business?
The main risks of using AI in a business are wrong answers stated confidently, personal or confidential information entered into tools that are not built to protect it, unclear ownership of AI-generated content, and staff relying on output nobody has checked. Each one is manageable with a few clear rules: decide which tools are approved, what information may go into them, and which outputs a person must review. The businesses that get into trouble are rarely the ones using AI carefully. They are the ones where AI use happened without anyone deciding how.
Risk 1: Confident, wrong answers
AI models produce text that sounds right. Most of the time it is. Sometimes it is not, and it reads exactly the same either way. This is often called hallucination: the AI fills a gap with something plausible rather than saying it does not know.
For internal drafting this is a nuisance. For anything a customer relies on, it is a liability. In a widely reported 2024 case in Canada, an airline was held responsible for incorrect information its website chatbot gave a customer about fares. The tribunal did not accept that the chatbot was responsible for its own answers. The business was.
How to manage it: Restrict customer-facing AI to your own approved information. Test it on real questions before launch. Have a person review anything involving prices, policies, legal or financial matters, or health and safety. Make it easy for customers to reach a human.
Risk 2: Privacy
If your business handles personal information, the Privacy Act and the Australian Privacy Principles apply to how you use it, including in AI tools. Putting customer details into an AI tool is a use, and potentially a disclosure, of that information.
The Office of the Australian Information Commissioner has published guidance on privacy and the use of commercially available AI products. Its recommendation is clear: as a matter of best practice, organisations should not enter personal information, particularly sensitive information, into publicly available AI chatbots.
How to manage it: Use business plans with clear data-handling terms, and check whether your data is used to train models. Remove names and identifying details where the task does not need them. Update your privacy policy if AI tools process customer information.
Risk 3: Confidentiality
Client contracts, pricing, tenders, financial results and legal advice are often covered by confidentiality obligations. Pasting them into a consumer AI tool can breach those obligations even if no personal information is involved.
How to manage it: Treat AI tools like any other external service provider. If you would not email a document to an unknown third party, do not paste it into an unapproved AI tool.
What you should never put into ChatGPT
As a working rule for staff, never enter the following into a free or personal AI account:
- Client or customer personal details: names with contact details, addresses, dates of birth, account numbers.
- Health, financial or other sensitive information about any person.
- Passwords, API keys or login details, even to ask for help with an error message.
- Confidential business documents: contracts, tenders, legal advice, unreleased financial results.
- Anything covered by a non-disclosure agreement or a client's confidentiality terms.
Business plans and tools built for the purpose can handle some of this safely under the right terms. The rule is about knowing which tool you are using and what it does with the information.
Risk 4: Ownership and copyright
Two questions come up. First, do you own what the AI produced? Australian copyright generally depends on human authorship, so content generated by AI with little human input may not be protected in the same way as work you write or substantially edit. Second, could the output copy someone else's work? It is uncommon for ordinary business writing, but it is possible, particularly with images and distinctive styles.
How to manage it: Treat AI output as a draft that a person shapes and approves. Check licence terms for AI image tools used commercially. Do not ask AI to imitate a specific living artist, writer or brand.
Risk 5: Security
AI tools connected to email, documents or business systems create new ways for things to go wrong. A well-known example is prompt injection, where hidden instructions in an email or web page trick an AI assistant into doing something it should not, such as revealing information or taking an action.
How to manage it: Give AI tools the least access they need. Be cautious with assistants that can send emails, make payments or change records on their own. Keep a person approving actions with real consequences, at least until the tool has a track record.
Risk 6: Bias and unfair decisions
AI can reflect patterns in the data it learned from, including unfair ones. This matters most when AI helps decide who gets hired, approved or offered something. Australian anti-discrimination law applies to those decisions whether or not software was involved.
How to manage it: Do not let AI make decisions about people on its own. Use it to prepare information, and have a person make and own the decision.
Risk 7: Over-reliance
The quietest risk is gradual: staff trust the output, stop checking and lose the skill to spot errors. Over time, quality drifts and nobody notices until a customer does.
How to manage it: Keep review steps for important work. Spot-check AI-assisted output regularly, even when things seem fine.
A simple AI policy for a small business
You do not need a long document. A one-page policy covering these points is enough for most small businesses:
- Approved tools: which AI tools staff may use for work, and on which plan.
- Information rules: what may and may not be entered, using the list above.
- Review rules: which outputs a person must check before they are sent or published.
- Customer-facing AI: who is responsible for its information, testing and monitoring.
- Who to ask: one person who approves new tools and answers questions.
The Australian Government's Guidance for AI Adoption sets out six essential practices for using AI responsibly and is a useful reference if you want more detail. For how businesses are using AI day to day, see how small businesses are actually using AI.
Frequently asked questions
What are the risks of using AI in business?
The main risks are incorrect answers stated confidently, privacy breaches from entering personal information into unsuitable tools, confidentiality breaches, unclear ownership of AI-generated content, security weaknesses in connected tools, biased decisions and staff relying on output without checking it.
What are the things you should not tell ChatGPT?
Do not enter customer or client personal details, health or financial information about anyone, passwords or login details, confidential business documents such as contracts or legal advice, or anything covered by a non-disclosure agreement into a free or personal AI account.
Is a business responsible for what its AI chatbot says?
Generally, yes. Businesses are responsible for the information they give customers, including through automated tools. In a widely reported 2024 Canadian case, an airline was held responsible for incorrect fare information given by its website chatbot.
Does the Privacy Act apply to using AI tools?
Yes. If your business is covered by the Privacy Act, its obligations apply when you use personal information in AI tools. The OAIC recommends, as best practice, that organisations do not enter personal information, particularly sensitive information, into publicly available AI chatbots.
VareonHQ builds AI assistants and automation for Australian businesses, restricted to approved information, tested before launch and with people kept in the loop where it matters. If you want to use AI without these risks, talk to us about the task.
