How many Australian small businesses use AI?

The Tech Council of Australia's report, released on 22 October 2026, found roughly one in four SMEs use AI and only 5% have adopted it broadly across their organisation. Other surveys give higher figures because they define use differently, as the CPA Australia figure of 88% from earlier in October shows.

What did the latest cyber threat report say about businesses?

A report on the Australian Signals Directorate's 2025-26 annual cyber threat report says the average self-reported cost of cybercrime for businesses rose more than 16% to $93,500, and that ASD received more than 82,000 cybercrime reports. It also says AI is a key factor in the threat picture and urges patching and basic controls.

Should I let an AI agent access my email and files?

Government guidance reported on 21 October 2026 says to avoid broad or unrestricted access, especially to sensitive data, to start with low-risk tasks, and to keep a human approving actions such as deleting critical records.

Blog

In the World of AI: Week of 20 October 2026, Tech Council Sizes the SME Opportunity

2026-10-27

Australia's Tech Council put a number on what small businesses could gain from AI, while two government agencies published sobering data on breaches and cyber threats. Guidance on AI agents added a practical note on how much access to give them. This is the week from 21 to 27 October 2026, with one step for each story.

1. The Tech Council forecasts $93 billion from SME AI use

The Tech Council of Australia's release of 22 October introduced a report called Accelerating AI Impact for Small and Medium Enterprises. It estimates wider AI use by SMEs could add up to $93 billion a year in economic value over five years, and about $136,000 a year in productivity gains for an average SME that moves from no AI to broad use. It found roughly one in four SMEs use AI and only 5% use it broadly, with a gap between regional and metropolitan businesses. Of SMEs using AI, 94% reported productivity improvements. The report was prepared by Delwood Advisory with support from Employment Hero, Google and Deputy, and it recommends more affordable, practical training and industry-specific examples.

Why it matters: These are modelled forecasts, so treat the dollar figures as potential and not a promise. The 5% figure shows that most businesses are still at the start.

This week: Check where you sit by asking whether any process in your business uses AI every week. If not, our answer on whether your business is ready for AI is a place to start.

2. Guidance on AI agents says start small

Dynamic Business reported on 21 October on guidance called Careful Adoption of Agentic AI Services, published on 1 May by the Australian Cyber Security Centre with agencies from the US, Canada, New Zealand and the UK. The article says it targets government, critical infrastructure and industry rather than small business specifically. The guidance advises against giving agents broad or unrestricted access, rolling them out in stages starting with low-risk tasks, avoiding over-broad permissions such as an email assistant that can write to any inbox, and having people decide when approval is needed, for example before deleting critical records.

Why it matters: An AI agent that can read and send email or change records can also make mistakes at speed. Limiting what it can reach limits the damage.

This week: If you are trialling an agent, list exactly which accounts and folders it can access and cut that to the minimum. Our answer on what an AI agent is explains the term.

3. Google adds Gemini controls and features to Workspace

Google's Workspace Updates blog lists several AI items for 21 and 22 October. On 22 October, Google Vault added filtered exports for Gemini in Workspace, which lets administrators filter and export users' Gemini conversations. Also on 22 October, real-time speech translation in Google Meet expanded to 63 languages with automatic language detection. On 21 October, Docs Live let people dictate and draft structured documents by voice in the Docs mobile app, and a new hub centralised Gemini skills and connected apps.

Why it matters: The Vault change is a reminder that Gemini conversations can be reviewed by administrators, which matters if staff use AI for client work. Translation in Meet could suit businesses with customers or suppliers who speak other languages.

This week: Tell staff plainly whether AI conversations on work accounts can be reviewed, and put it in your AI use policy.

4. Data breach reports keep rising

Cyber Daily reported on 26 October on the OAIC's statistics for the first half of 2026. There were 667 notifications, up from 662 in the previous period. Breaches affecting more than one million people rose from 4 to 11. Malicious or criminal activity was the top cause. Health providers reported the most with 149, followed by education with 85 and business and professional associations with 79. More than half of breaches were reported within 10 days. The article does not mention AI.

Why it matters: The main cause of reported breaches is deliberate attack. If staff paste customer data into AI tools, that data sits somewhere new that you also need to protect.

This week: Write down where customer data lives, including any AI tools that receive it, and who you would call if one of them reported a breach.

5. ASD's annual report names AI as a threat factor

Region reported on 27 October on the Australian Signals Directorate's Annual Cyber Threat Report for 2025-26. It says AI is a key factor, helping malicious actors find and exploit weaknesses at greater scale and speed, and that AI tools became more accessible with new frontier models. ASD received more than 82,000 cybercrime reports, about one every six minutes, and responded to more than 1,500 incidents. The average self-reported cost of cybercrime for businesses rose more than 16% to $93,500. The report also says AI can help defenders and urges organisations to strengthen patching and basic controls.

Why it matters: The advice is plain. Most protection comes from updates, strong sign-in and attention to unusual requests, and AI raises the stakes on those basics.

This week: Check that automatic updates are on for your computers and phones, and that every business account uses multi-factor authentication.

What to do this week

Note which business processes use AI each week, if any.
Limit any trial AI agent to the minimum accounts and folders it needs.
Tell staff whether AI conversations on work accounts can be reviewed.
Map where customer data lives, including AI tools.
Turn on automatic updates and multi-factor authentication.

Sources

Tech Council of Australia, "TCA AI x SME Research Launch", 22 October 2026: techcouncil.com.au
Dynamic Business, "Letting AI act for you? Australian guidance says start small", 21 October 2026: dynamicbusiness.com
Google Workspace Updates, October 2026 posts (items dated 21 and 22 October 2026): workspaceupdates.googleblog.com
Cyber Daily, "Stat dump: data breaches impacting Aussies continue to rise, OAIC says", 26 October 2026: cyberdaily.au
Region, "ASD report highlights increasing number of AI-enabled cyber threats", 27 October 2026: region.com.au

good questions, straight answers

Frequently asked questions

How many Australian small businesses use AI?: The Tech Council of Australia's report, released on 22 October 2026, found roughly one in four SMEs use AI and only 5% have adopted it broadly across their organisation. Other surveys give higher figures because they define use differently, as the CPA Australia figure of 88% from earlier in October shows.
What did the latest cyber threat report say about businesses?: A report on the Australian Signals Directorate's 2025-26 annual cyber threat report says the average self-reported cost of cybercrime for businesses rose more than 16% to $93,500, and that ASD received more than 82,000 cybercrime reports. It also says AI is a key factor in the threat picture and urges patching and basic controls.
Should I let an AI agent access my email and files?: Government guidance reported on 21 October 2026 says to avoid broad or unrestricted access, especially to sensitive data, to start with low-risk tasks, and to keep a human approving actions such as deleting critical records.

read these next