Most Australian SMEs haven't outgrown ChatGPT. They've barely started. The Tech Council of Australia found only 1 in 4 SMEs use AI and just 5% use it broadly. The real divide is depth: ad hoc use of generic tools versus integrated, governed AI. The Privacy Act's 10 December 2026 obligation is sharpening it.
Are Australian SMEs really outgrowing ChatGPT?
Not as a market-wide trend. The Tech Council's *Accelerating AI Impact for SMEs* report is clear that adoption is shallow, not saturated. So "outgrowing" is a minority story, and a forward-looking one.
The interesting part is what sits behind the shallow numbers. The same report estimates an average SME moving from no AI to broad adoption could see a productivity uplift of about $136,000 a year. Regional SMEs lag, at 16% against 30% in metropolitan areas.
Treat the headline $93 billion figure with care. It's a modelled forecast, and commentator digidai notes it assumes adoption reaches roughly 53% of SMEs in about five years.
Why do the adoption numbers disagree?
Because everyone is counting something different. Cite any single figure with its definition attached:
- 12%: businesses using AI, per the ABS 2024–25 Business Characteristics Survey (released 25 June 2026).
- 44%: SME adoption in the National AI Centre tracker, February 2026.
- 30.8%: SMBs paying for AI tools in Weel card data, June 2026. The ABS, NAIC and Weel comparison comes from Scalesuite's reconciliation, a secondary source.
- 69%: regular use by January 2026 in Intuit research. That's vendor-commissioned, so read it accordingly.
The spread isn't a contradiction. "Has tried it once", "pays for it" and "runs the business on it" are three different things.
What's actually holding SMEs back?
Trust and skills, not raw capability. NAIC data for December 2025 to February 2026 shows 43% of SMEs reporting some adoption. Among non-adopters, about 65% cite distrust in AI decision-making or a preference for human control. Another 19% say they don't know how to use AI in their business.
Privacy matters too. Intuit's research found 39% of Australian respondents cited privacy and security concerns, higher than in the US, UK and Canada.
That's a rational response. If you can't see what a tool does with your data, hesitating is sensible. Generic tools make that visibility hardest.
Why does 10 December 2026 matter?
It turns "nice to understand" into "need to explain". From that date, APP 1.3 under the Privacy Act requires regulated entities to disclose in their privacy policies where a computer program makes, or is substantially related to making, a decision that could significantly affect an individual. That's per Bright Law's October 2026 update.
Two practical consequences follow:
- You need an inventory. You can't disclose automated decisions you haven't mapped.
- You need to know where data goes. The OAIC has published guidance on the new transparency obligations. It also advises against entering personal information into publicly available generative AI tools.
A team pasting customer details into a free chatbot is the exact pattern that guidance warns about. Whether your business is a regulated entity is a question for your legal adviser. The direction of travel is not subtle.
When does custom AI make sense?
Only where the workflow earns it. The market commentary is converging on a staged path, not a claim that off-the-shelf tools fail.
- Horn Tech suggests starting with tools such as ChatGPT Plus, and building custom only where a specific workflow keeps hitting friction.
- Growth Shuttle argues custom suits sensitive, multi-step work that needs an audit trail.
- Softdoes notes custom builds take months where off-the-shelf takes days or weeks.
So the test isn't "are we big enough?" It's whether the work is sensitive, multi-step or revenue-critical, and whether you need to show what the system did and why.
A word on vendor claims. Payback periods of 6 to 18 months get quoted often. They're unverified, so don't repeat them as fact. Ask for defined milestones and measurable outcomes instead.
What's still unsettled?
A fair bit. Australia has no AI Act, no AI regulator and no licensing regime.
- A Joint Select Committee on AI, appointed 20 August 2026, is due to report by 30 November 2026.
- Its early advice on 12 October recommended a proportionate, risk-based framework and minimum standards for data sovereignty.
- The Privacy Amendment (Personal Data Protection) Bill 2026 exposure draft closed consultation on 18 September 2026. It is not law.
The sensible move is to build for the direction, not the detail: know your data flows, keep humans in the loop on consequential decisions, and keep records.
Key takeaways
- Adoption is early: 1 in 4 SMEs use AI and only 5% use it broadly, so "outgrowing ChatGPT" describes a minority.
- Reported adoption ranges from 12% to 44% because definitions differ. Always cite the definition.
- Trust and skills are the main stated barriers, ahead of technology limits.
- From 10 December 2026, APP 1.3 makes it harder to be vague about what your AI does and where data goes.
- Move in stages. Go custom where workflows are sensitive, multi-step or revenue-critical, and treat vendor ROI claims as unverified.
Our take
The loudest advice says generic AI is a dead end. The data says most SMEs haven't gotten far enough to find out. We think the winning move is boring: start cheap, find the one workflow that keeps breaking, and only then build something purpose-made with an audit trail. Training organisations handling learner records should be first in line to ask where their data goes. Governance is the real reason to go custom, more than any productivity claim.
FAQ
What percentage of Australian SMEs use AI?
It depends on the definition. The ABS 2024–25 Business Characteristics Survey found around 12% of businesses use AI. The National AI Centre tracker put SME adoption at 44% in February 2026. The Tech Council of Australia reports only 1 in 4 SMEs use AI and 5% use it broadly.
What changes on 10 December 2026 for businesses using AI?
APP 1.3 under the Privacy Act requires regulated entities to disclose in their privacy policies where a computer program makes, or is substantially related to making, a decision that could significantly affect an individual. The OAIC has published guidance on these transparency obligations.
Is it safe to put customer information into ChatGPT?
The OAIC advises against entering personal information into publicly available generative AI tools. If your staff handle personal information, set clear rules on what can and can't be pasted into generic tools, and seek legal advice on your obligations.
When should an SME move from off-the-shelf AI to a custom build?
When a specific workflow keeps hitting friction, or the work is sensitive, multi-step or needs an audit trail. Off-the-shelf tools take days or weeks to adopt, while custom builds can take months, so start with the former and build custom where it clearly pays.
Is Australia going to regulate AI with a dedicated Act?
Not yet. Australia has no AI Act, AI regulator or licensing regime. A Joint Select Committee on AI is due to report by 30 November 2026, and its early advice favoured a proportionate, risk-based framework. Nothing is settled.
