Client guide
We help your organisation understand AI and put practical controls in place, so your team can use it productively and prevent privacy, security, accuracy and reputational mistakes.
Please note: Everything here is guidance and general information. We recommend that, once your AI and automation advice has been implemented, it is reviewed and certified by a qualified legal or AI governance expert. Your obligations depend on your business. Last reviewed 7 October 2026.
Tap any title to jump straight to it.
Our approach
It's about knowing where AI creates risk, keeping important decisions accountable, and helping businesses adopt AI with confidence.
01 · How we work
Eight steps, in order. Each one is simple on its own, and together they put real controls around AI.
Find out which AI tools your people already use and where your information goes.
Give your team the knowledge to spot risks, through realistic, hands-on scenarios.
Agree who is accountable and write clear rules everyone can follow.
Put sensible access, data and AI checks in place, and guide your team on safe use.
Choose and approve the right tools for your business and your information.
Try everything out before launch, and record the results.
Go live with clear owners and an incident process ready.
Review how AI is used and keep improving, on a regular schedule.
This isn't about teaching your staff to use ChatGPT. It's about giving your business the rules, tools, training and human oversight to use AI confidently.
02 · Security basics
No single tool makes a business safe. It takes several simple protections working together, so that one mistake doesn't become a serious problem. We explain these basics so you know what to ask for.
Every person has their own login, protected by two-step verification. People only see what their job needs, and access is removed the day someone leaves.
How we help: Simple checklists for accounts, two-step login and regular access reviews.
Clear rules about what can and can't be put into AI tools, backed by settings that stop confidential files being shared by accident.
How we help: Clear rules about what can be shared, and questions to ask your IT provider.
Business-grade AI accounts replace free personal ones, so you know where your information is stored and who can see it.
How we help: Tool assessments, an approved tools list, vendor checks.
Prompts and AI answers can be checked for things like confidential data, harmful instructions and unsafe content before they reach people.
How we help: Planning and setting up Google Cloud Model Armor to screen prompts and responses.
Activity is logged and reviewed, and everyone knows what to do if something goes wrong.
How we help: An incident procedure and a regular review routine.
Security fails when staff don't understand it. Short, practical training turns the rules into everyday habits.
How we help: Role-based training, quick reference sheets, training records.
03 · Australian guidance
The short version, in plain English.
Australia doesn't currently have one general AI law. Instead, AI use is covered by laws that already exist:
The Government's AI adoption guidance helps organisations use AI responsibly. It doesn't replace any of those legal obligations.
The guidance encourages organisations to write down their AI governance, so they can audit, review, learn and improve. We help you keep clear records of:
You don't need a perfect system first. The guidance recommends starting across all six practices below and improving as you go.
From the Australian Government's Guidance for AI Adoption (National AI Centre, October 2025). We build our service around them.
Decide who owns AI in your business, and set the policies and skills to support them.
We help with: An AI owner, named responsibilities, an AI policy.
Work out who or what each AI use could affect, and how.
We help with: An AI inventory and impact notes for each use.
Identify, assess and control the risks before AI is used.
We help with: An AI risk register with a green, amber and red rating.
Make sure the right people understand your AI systems and how they're used.
We help with: Plain-English notices, staff guidance and customer information.
Test before launch, then keep watching after it.
We help with: Test records, monitoring checks and a review schedule.
Keep people able to oversee, step in and override AI.
We help with: Human review points and clear approval steps.
04 · Starts 10 December 2026
From 10 December 2026, some organisations must add extra information to their privacy policy when software helps make decisions that significantly affect people.
Does this apply to you? The rules apply to “APP entities”. Most small businesses with an annual turnover of $3 million or less are currently exempt from the Privacy Act, with some exceptions (for example, health service providers and businesses that trade in personal information). We can help you work out where you stand, but for a formal answer, ask a qualified legal expert.
It's broader than AI. The law refers to a “computer program”. That can include rule-based software, machine learning, generative AI and chatbots. It isn't a “ChatGPT law”.
The OAIC says a decision can still be covered where a person reviews the program's output. For example, if AI ranks job applicants and HR makes the final choice, the ranking step may still need assessing.
Not every automated task counts. The decision must reasonably be expected to significantly affect someone's rights or interests, such as their contract rights, access to important services, benefits or healthcare. The effect can depend on the person's circumstances.
“Our software provider makes the decision” isn't an answer. The OAIC expects organisations to understand and oversee third-party programs they choose to use, including when buying them, and to make responsibilities clear in contracts.
Our service
A short review to find out whether any of your systems are affected, before the deadline.
“Do any of your systems use personal information to rank, recommend, approve, decline, escalate or otherwise influence decisions about customers or employees?”
If the answer is yes or maybe, this review is for you.
Ask about this reviewSource: OAIC guidance on transparency for AI and automated decision-making. Requirements and guidance can change, so check the latest before acting. Guidance and general information. We recommend your finished setup is reviewed and certified by a qualified legal or AI governance expert.
05 · AI policies
AI governance is the set of rules and responsibilities that decide how AI can be used inside a business. That starts with your policies.
How your organisation allows AI to be used: which tools, what information, and who checks the results.
How your organisation manages personal information, including (from December 2026, for organisations covered) how automated decisions use it.
Accountability
Who owns AI governance?
Approved use
What can AI be used for?
Prohibited use
What can't it be used for?
AI systems
Which tools are approved?
Data
What information may be used?
Privacy
How is personal information protected?
Security
How are systems and accounts protected?
Human oversight
Who checks the results?
Risk
Which uses need extra assessment?
Transparency
When should customers be told?
Buying new tools
How are new AI vendors assessed?
Testing
How do we know it works?
Monitoring
How is performance reviewed?
Incidents
What happens when something fails?
Training
What must staff understand?
Review
When is the policy reassessed?
06 · Approved tools
Many businesses already have staff using AI tools the business never approved. That's called shadow AI, and it's the biggest gap we find.
Your people may already be using these, with no idea where the information goes:
Blocking AI completely usually isn't realistic. A better approach is knowing what your people use and setting clear boundaries.
We don't recommend AI platforms simply because they're popular or offer a paid plan. We assess the tools against your business needs, information sensitivity, existing technology, security requirements and governance obligations before recommending which ones your team can use.
This is also consistent with Australia's OAIC guidance, which calls for due diligence before adopting commercial AI products, including evaluation of privacy risks, access to personal information and human oversight.
All product names are trademarks of their owners. BREVORA is an independent consultant and is not a reseller or partner of these providers.
07 · Staff training
Generic online AI training doesn't know your rules. Ours finishes with exactly what your staff can and can't do in your business.
What AI is, where your team meets it, and what it can and can't reliably do.
What staff can share, and what stays confidential: customer and sensitive data.
Business tools versus free consumer tools, and what shadow AI is.
Writing useful prompts without exposing information you shouldn't.
Made-up answers, bias, misinformation and how to verify sources.
What always needs checking, and when a manager must approve.
Chatbots, AI content, being open with customers and automated decisions.
Exactly what staff can and can't do in your organisation.
More than slides: people practise real decisions.
Understand
What is the risk?
See
A realistic example.
Decide
What would you do?
Teach
The correct response.
Practise
Work through a scenario.
Confirm
A short knowledge check.
Document
Training completion is recorded.
08 · What you receive
Clear documents your whole team can use, kept simple and practical.
09 · What we help with
Assess. Train. Govern. Protect. Approve. Test. Launch. Monitor.
Tell us how your team uses AI today. We'll point out the biggest gaps and what to do first. Custom quotes follow the call.